ML18065A025

Joseph M Farley March 12, 2018, Public Meeting - Draft 4b Application Enclosures

ML18065A025
Person / Time
Site:	Farley
Issue date:	03/06/2018
From:	Shawn Williams Plant Licensing Branch II
To:
Williams S, NRR/DORL/LPLII-1
Shared Package
ML18065A015	List: ML18065A020 ML18065A022 ML18065A025
References
Download: ML18065A025 (167)

Text

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 2 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 DRA FT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table of Contents 1.0 Introduction........................................................................................................... 2 2.0 Requirements Related to Scope of FNP PRA Model ........................................... 2 3.0 Technical Adequacy of FNP Internal Events and Internal Flooding PRA Model ... 2 3.1 RG 1.200 Peer Review for FNP Internal Events PRA Model against ASME PRA Standard Requirements .................................................................... 3 3.2 Resolution of Findings from RG 1.200 Internal Events Peer Review ......... 3 4.0 Technical Adequacy of FNP Fire PRA Model ..................................................... 45 4.1 RG 1.200 Peer Review for FNP Fire PRA Model against ASME PRA 5.0 6.0 4.2 D Standard Requirements ........................................................................... 45 Resolution of Findings from RG 1.200 Fire PRA Peer Review ................ 46 RA General Conclusions Regarding PRA Capability ................................................ 73 References ......................................................................................................... 73 FT 1

to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 1.0 Introduction This enclosure provides information on the technical adequacy of the Farley Nuclear Plant (FNP) Probabilistic Risk Assessment (PRA) internal events model (including flooding) and the FNP fire PRA model in support of the License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1).

NEI 06-09, as clarified by the NRC final safety evaluation (Reference 1), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool required to implement this risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.174 requirements for risk-informed plant-specific changes to a plant's licensing basis.

SNC employs a multi-faceted approach to establishing and maintaining the technical adequacy and fidelity of PRA models for all operating SNC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process and the use of self-D assessments and independent peer reviews. The following information describes this approach as it applies to the FNP PRA.

Section 2 of this enclosure describes requirements related to the scope of the FNP PRA internal RA events model. Section 3 outlines requirements for the internal events PRA from RG 1.200 and how these are met. Section 4 similarly outlines requirements for the fire PRA from RG 1.200 and how these are met. Section 5 provides general conclusions. Finally, Section 6 lists references used in the development of this enclosure.

2.0 Requirements Related to Scope of FNP PRA Model FT The FNP internal events PRA model as referenced in the peer review (Reference 11) is an at-power model (i.e., it directly addresses plant configurations during plant modes 1 and 2 of reactor operation). The model includes both at-power internal events core damage frequency (CDF) and large early release frequency (LERF). Internal flooding is included in both the CDF and LERF models. Note that this portion of the FNP PRA model does not incorporate the risk impacts of external events. The treatment of seismic risk and other external hazards for this application is discussed in Enclosure 3. Various PRA notebooks were used for disposition information contained within Tables E2-2 and E2-4, which are available for inspection.

3.0 Technical Adequacy of FNP Internal Events and Internal Flooding PRA Model NEI 06-09 requires that the PRA be reviewed to the guidance of Regulatory Guide 1.200, Revision 0 (Reference 5) for a PRA which meets Capability Category (CC) II for the supporting requirements of the American Society of Mechanical Engineers (ASME) internal events at power PRA standard (Reference 6). It also requires that deviations from these capability categories relative to the RICT program be justified and documented. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09 (Reference 2) takes exception to the reference to RG 1.200, Revision 0, currently listed throughout TR NEI 06-09, Revision 0.

The NRC staff requires an assessment of PRA technical adequacy using RG 1.200, Revision 1, and the updated PRA standard which, at the time, was ASME RA-Sb-2005.

The FNP PRA has been subjected to a number of peer reviews and self-assessments, including one performed in accordance with the 2009 version of the PRA Standard (Reference 6) as endorsed with clarifications by RG 1.200, Revision 2 (Reference 3). The FNP PRA Peer review conducted in March 2010 was performed using the process defined in NEI 05-04 (Reference 2

to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

13) and it was a full-scope peer review. NEI 05-04 (Reference 13) guidance supplants the NEI 00-02 (Reference 10) guidance for conducting a peer review. The results of the RG 1.200 peer review (Capability Category and Findings) are described in Section 3.1. Section 3.2 summarizes the resolution of findings identified in the RG 1.200 peer review.

The information provided in this section demonstrates that the FNP internal events PRA model (including flooding) meets the requirements of RG 1.200.

3.1 RG 1.200 Peer Review for FNP Internal Events PRA Model against ASME PRA Standard Requirements The 2009 version of the PRA Standard (Reference 6) contains a total of 326 numbered supporting requirements (SRs) in fourteen technical elements and one configuration control element. Eight of the SRs were determined to be not applicable to the FNP PRA. Thus, a total of 318 SRs are applicable.

Among 318 applicable SRs, 92% met Capability Category II or higher, as shown in Table E2-1.

CC-I CC-II CC-III CC-I/II CC-II/III DRA Table E2-1. Summary of FNP Capability Categories Capability Category Met CC-I/II/III (or SR Met)

No. of SRs 213 9

30 12 13 24

% of total applicable SRs 66.8%

2.8%

9.4%

3.8%

4.2%

7.6%

SR Not Met 17 5.4%

Total 318 100%

FT Seventeen SRs were judged to be not met. These were IE-C5, AS-C2, SY-A6, SY-C1, HR-G7, HR-I3, IFEV-B3, IFPP-B2, IFPP-B3, IF-QUA7, IF-SNA4, IFSN-B3, IFSO-B3, QU-A5, QU-C2, QU-F1, and MU-B4. An additional 9 SRs met CC-I, but not CC-II. These were: IE-A5, IE-A9, IE-B3, HR-D2, HR-G1, LE-C2, LE-C9, LE-C11, and LE-C12. The peer review generated 40 Findings. These Findings and their resolutions are described in Section 3.3. These include resolution of the Findings related to the 17 SRs that were not met, and to 5 of the 9 SRs judged to be CC-I. Findings were not issued for the LE SRs judged to be not met, but a discussion of those 4 SRs is also provided in Section 3.2. Thus, the FNP internal events PRA (including flood) meets the requirements of RG 1.200.

3.2 Resolution of Findings from RG 1.200 Internal Events Peer Review Table E2-2 shows the details of the 40 Findings and the associated resolutions developed after the peer review. Resolution of these Findings results in all SRs met to at least Capability Category II. Also included are discussions of the 4 LE SRs judged to be CC-I, but for which no findings were issued.

3 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-A5-01 PERFORM a systematic There is no evidence of a system by Resolved This F&O is resolved.

evaluation of each system, system review of the Farley systems to including support systems, verify no additional initiators exist. A A systematic review of the to assess the possibility of systematic review of the Farley systems Farley safety and non-safety an initiating event and trains should be performed to systems was performed that occurring due to a failure ensure that all potential initiators are resulted in the development of of the system. USE A identified and that the initiators are a Table C-1 Farley Initiating STRUCTURED grouped properly on the basis of impact Event Identification Analysis APPROACH [SUCH AS A SYSTEM-BY-SYSTEM A FAILURE MODES AND EFFECTS ANALYSIS (FMEA), OR OTHER SYSTEMATIC PROCESS]

D REVIEW OF INITIATING EVENT POTENTIAL, OR RA and frequency.

Add a systematic review of the safety and non-safety systems that could cause a plant scram to verify that no additional initiators are needed.

which is documented as part of the Farley Initiating Event Notebook. This table lists each Farley system ordered by a system group identifier, system ID, system description, impact of system loss and treatment of system loss in Farley PRA. The TO ASSESS AND treatment of system loss DOCUMENT THE addressed specifically whether POSSIBILITY OF AN INITIATING EVENT RESULTING FROM INDIVIDUAL SYSTEMS OR TRAIN FAILURES.

FT the loss of a system would result in an initiating event and how the initiating event was grouped. There is no impact on the PRA model since no additional initiators are identified.

4 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-A7-01 In the identification of the Section 2 states that events occurring Resolved This F&O is resolved.

initiating events, during Modes 3-6 are considered to INCORPORATE (a) determine if they are applicable at- These two events were events that have occurred power. Appendix B-1 includes events reviewed and it was at conditions other than at- that occurred at power levels less than determined that they should be power operation (i.e., 10%. However, the review does not removed from the plant specific during low-power or seem to look at the event applicability for frequency analysis. Appendix shutdown conditions), and Mode 1. Two of the reactor trips at 0% B-1 of the Initiating Events D

for which it is determined that the event could also occur during at-power operation (b) events RA resulting in an unplanned controlled shutdown that includes a scram prior to reaching low-power power were due to Source Range Monitors (SRMs). These events would not be applicable to the at-power analysis since the SRM would be replaced by the APRMs for Mode 1.

Clarify the review of the LPSD events included in Appendix B-1 and how they Notebook was revised to reflect the changes to the analysis.

conditions, unless it is are included in the plant specific determined that an event frequency analysis.

FT is not applicable to at-power operation 5

to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-A9-01 REVIEW plant-specific There is no indication that IE precursors Resolved This F&O is resolved.

operating experience for such as intake clogging have been initiating event precursors, performed. Precursor reviews generally A search was performed using for identifying additional include a significant plant event that did the Condition Reports initiating events. FOR not cause a scram but could have if database for significant non-EXAMPLE, PLANT- prompt action is not taken. scram events. A comparison of SPECIFIC EXPERIENCE the results was made to WITH INTAKE Review significant non-scram events at Farleys initiating events list.

STRUCTURE CLOGGING MIGHT INDICATE THAT LOSS OF INTAKE STRUCTURES SHOULD BE IDENTIFIED AS A D

POTENTIAL INITIATING EVENT.

RA the plant to determine if any precursors exist.

No new initiating event precursors to plant trips were found. Added methodology and review results in Appendix A of the Initiating Events notebook There is no impact on the PRA model since no additional initiating event precursors are identified.

FT 6

to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 IE-A10-02 For multi-unit sites with The Farley IE notebook indicates that Resolved A sensitivity analysis was shared systems, INCLUDE failure of the Service Water (SW) pond performed to show SW Pond multi-unit site initiators dam was included as a special initiator. Dam failures contribution to (e.g., multi-unit LOOP However, a search of the model did not the CDF and LERF.

events or total loss of locate the dam failure. Further, the service water) that may probability of a loss of the SW pond dam This F&O is resolved impact the model. is estimated to be 1.9e-7 failures per year based on the FNP River Water Based on the dam failure Study (dated 1982). This analysis is assessment study, it was based on a generic estimate of 1.9e-5 concluded that loss of SW due DRA failures per year for earthen filled dams that in the opinion of Alabama Power Company should be reduced to 1.9e-7 per year due to design, monitoring, maintenance, and responsiveness of the owner to problems. Loss of the dam would result in a dual unit loss of service water. For an event of the magnitude of to a random failure of the dam as an initiating event does not need to be modeled in the internal events PRA based on the screening criteria in IE-C6 (b) of the ASME PRA Standard (Reference 6).

a dual unit loss of service water, the supporting evidence for reduction of the FT generic value by a factor of 100 is treated very lightly. An initiating event that would result in a dual event initiator should be included in the initiating event portion of the model. Evidence for reducing the generic dam failure probability is qualitative in nature, and the extension of this information to justify a factor of 100 reduction in the generic probability is not clear and poorly supported. Further, dam failure analysis technology has improved since 1982, and use of the newer approaches to analysis should be considered.

7 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition Consider revisiting the estimation of the probability of dam failure using newer technology and better supported calculation. Add the loss of the SW pond dam to the model, if appropriate.

IE-B1-01 COMBINE initiating events Events are grouped in general Resolved This F&O is resolved.

into groups to facilitate categories. It is not clear that the impact definition of accident on systems are similar or that the Table C-1 Farley Initiating D

sequences in the Accident Sequence Analysis and to facilitate quantification.

RA grouped event frequency includes these events Loss of Turbine Building Cooling is grouped with loss of Service Water.

However, the frequency for these events is expected to be similar and may have different impact on the PSA systems.

Other potential groupings, such as the 7300 bus and 4.16 KV buses identified Event Identification Analysis was created and documented in the Farley Initiating Event Notebook. This table lists each Farley system ordered by a system group identifier, system ID, system description, impact of system loss and treatment of through the operator interviews were not system loss in Farley PRA. The clearly grouped. In other cases, the treatment of system loss FT review of the events from NUREG/CR-3862 and NUREG/CR-5500 are not directly tied to an initiating event class.

Include the impact of the initiator (especially the transient events) on the PSA systems in the model.

addressed specifically whether the loss of a system would result in an initiating event and how the initiating event was grouped.

8 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-C1-01 CALCULATE the initiating In section 4 of the initiating event Resolved This F&O is resolved.

event frequency notebook, Farley discusses the accounting for relevant quantification of the vessel rupture Revised section 4.1 of the generic and plant-specific frequency. They present the WASH- Initiating Events notebook and data unless it is justified 1400 median frequency of 1E-07 with added reference 18 (PWROG that there are adequate the associated error bounds but then project: PA-RMSC-0463) to the plant-specific data to proceed to treat that value as a mean. reference section to include a characterize the parameter This is mathematically incorrect and more current data source.

D value and its uncertainty.

RA introduces a slight non-conservative bias. It is not likely to impact the overall results.

Calculate the mean from the median and error factor and use that in the quantification. (Mean should be about 2.7E-07.) There is also a newer generic source that has a better number.

IE-C5-01 CALCULATE initiating Farley did calculate their initiating event Resolved This F&O is resolved.

event frequencies on a reactor year basis.

FT INCLUDE in the initiating event analysis the plant availability, such that the frequencies are weighted by the fraction of time the plant is at power.

frequencies on a reactor year basis.

However, they did not modify the resultant frequencies to address plant availability. Discussions with the Farley staff indicated that the adjustment was not made as part of quantification either.

The frequencies are slightly conservative.

The adjustment has been made as part of the model quantification. Appendix B-2 of the Initiating Events notebook contains the development of the annual average availability factor.

The initiating event frequency should be modified to address plant availability.

This can be done by multiplying each initiating event frequency by the availability factor or the adjustment can be done as part of the quantification.

9 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-C15-01 CHARACTERIZE the Table 7 of the Farley Initiating Events Resolved This F&O is resolved uncertainty in the initiating Notebook presents the initiating event event frequencies and frequencies for the special initiators but This is a documentation issue:

PROVIDE mean values for does not characterize the uncertainty. As discussed in the issue use in the quantification of The special initiators are quantified statement, the uncertainty of the PRA results. using fault tree analysis so the special initiating event is uncertainty intervals inherently can be evaluated during quantification quantified based on the uncertainty data process.

DRA for basic events. However, the variance is not presented and there is no discussion of this beyond stating that the frequencies are calculated using fault trees. This is a documentation issue.

There is no indication that the uncertainty was not included in the overall model quantification.

Document how the uncertainty for the FT special initiators was characterized/

quantified as part of the discussion in section 3.3 of the Initiating Events Notebook.

10 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IE-D1-01 DOCUMENT the initiating Farley did document their initiating event Resolved This F&O is resolved.

event analysis in a manner analysis. However, the structure and that facilitates PRA content of the documentation was such Many documents including applications, upgrades, that it was often difficult to trace the initiating event notebook and and peer review. identification, grouping and documentation reflecting an quantification of the IEs in an easy to earlier version have been follow manner. This issue was identified updated since the peer review in virtually all Technical Elements of the was performed.

DRA Farley PRA. It was often difficult to determine what Farley had done to address a given SR and required detailed evaluation of the model and many discussions with the Farley PRA staff. One part of the problem was that in several places, the documentation reflected an earlier version of the model (Version 8 versus Version 9) or did not match the model (treatment of FT miscalibration errors). This made the PRA difficult to review. However, of greater concern, the documentation could only support applications or updates if a knowledgeable/

experienced engineer was involved. This touches on virtually all PRA documents.

1. Ensure that the documentation reflects the latest version of the model.

2. Review the documentation to see if it has sufficient content and is structured such a less experienced engineer can understand the analysis.

11 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition AS-C2-01 DOCUMENT the In the discussion of large, medium, and Resolved This F&O is resolved.

processes used to develop small Loss Of Coolant Accidents accident sequences and (LOCAs), the operator failure to transfer The description for OAR_A_1--

treat dependencies in to low head recirculation is discussed. ----H in the Accident Sequence accident sequences, For large LOCAs, this error is notebook was revised to note including the inputs, OAR_A_1- -----H, and for other LOCAs that operator action is still methods, and results. (or event trees) the error is OAR_A_2---- required to align CCW cooling

--H. The only difference between the two to the RHR heat exchanger. to DRA errors is timing. However, the discussion of OAR_A_2------H indicates that the operator must manually align Component Cooling Water (CCW) cooling to the Residual Heat Removal (RHR) heat exchanger. The discussion of OAR_A_1------H does not include the requirement for the operator to realign be consistent with the description of OAR_A_2------H .

CCW to the RHR heat exchanger. The two errors appear to have been modeled FT correctly, but the difference in the description in the AS notebook is confusing.

Add the discussion of the operator realigning CCW to the RHR heat exchanger to the description of OAR_A_1------H.

12 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition AS-C2-02 DOCUMENT the Table 2.6-1 of the Farley AS notebook Resolved This F&O is resolved.

processes used to develop identifies events %LOSSACF and accident sequences and %LOSSACG as Loss of Power to 4kV The Accident Sequence treat dependencies in Bus F and Loss of Power to 4 kV Bus G, notebook was revised to accident sequences, respectively. However, the table in correctly reference the loss of including the inputs, Section 2.6.4 identifies these events as bus initiating events. The methods, and results. Loss of 4160 V Bus F and Loss of 4160 descriptions of the %LOSSACF V Bus G, respectively. These two events and %LOSSACG events in DRA (Section 2.6.4) are not recoverable by the EDGs because of damage to the respective buses. In Section 2.6.4, the events Loss of Power to 4 kV Bus F and Loss of Power to 4 kV Bus G are labeled as %LOSPF and %LOSPG, respectively. Initiating events %LOSPF and %LOSPG are not included in Table Section 2.6.4 were not changed because they are correct. Instead, the descriptions for those events were corrected in Table 2.6-1 and events %LOSPF and

%LOSPG were added to Table 2.6-1. Documentation was 2.6-1. Table 2.6-1 is incomplete because revised.

it is lacking initiating events %LOSPF FT and %LOSPG. Table 2.6-4 incorrectly characterizes initiating events

%LOSSACF and %LOSSACG.

Add initiating events %LOSPF and

%LOSPG to Table 2.6-1. Correct the descriptions of initiating events

%LOSSACF and %LOSSACG in Table 2.6-4.

13 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SC-A2-01 SPECIFY the plant The maximum core temperature of two Resolved This F&O is resolved.

parameters (e.g., highest cases of Medium LOCA (CL3-MLO-S2 node temperature, core and CL5-MLO-S1) exceeds 1800F early While the core damage criteria collapsed liquid level) and times after accident, but they are of 1800°F was exceeded for a associated acceptance considered as success. In the MAAP short period of time, these 2 criteria (e.g., temperature analysis notebook describes "only MAAP cases are considered limit) to be used in exceeded 1800°F for less than 6 min; successful pertaining to the determining core damage. considered success." (Appendix B, core damage success criteria.

SELECT THESE PARAMETERS SUCH THAT THE DETERMINATION OF CORE DAMAGE IS AS REALISTIC AS PRACTICAL, IN A MANNER CONSISTENT DRA Table B-1) In addition, there are two SGR cases (S1 and S2) in which the core temperature is oscillating unstably, exceeding 1800 F in some of the later oscillations. It is not clear that these or successes or that a stable configuration has been achieved. It is not clear that the identified cases cannot meet the Attachment 1 has been added to Success Criteria notebook to address the maximum core temperature of two cases of Medium LOCA (CL3-MLO-S2 and CL4-MLO-S1). Refer to disposition of SC-A5-01 for resolution of the SGR cases WITH CURRENT BEST success criteria for core damage. noted.

PRACTICE. DEFINE COMPUTER CODE-PREDICTED ACCEPTANCE CRITERIA WITH SUFFICIENT MARGIN ON THE CODE-CALCULATED VALUES TO ALLOW FOR LIMITATIONS OF THE FT First possible resolution is to perform analysis using another tool instead of MAAP (e.g., a more detailed model that would allow a higher core damage temperature as a success criterion) for these two cases. Second one is to describe the details in the notebook why the analyst assumes these cases as CODE, SOPHISTICATION success.

OF THE MODELS, AND UNCERTAINTIES IN THE RESULTS, IN A MANNER CONSISTENT WITH THE REQUIREMENTS SPECIFIED UNDER 14 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SC-A5-01 SPECIFY an appropriate There are two SGR cases, S1 and S2, Resolved This F&O is resolved.

mission time for the for which the maximum core modeled accident temperature is oscillating wildly beyond MAAP analysis was performed sequences. For 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, sometimes exceeding 1800 using MAAP 4.0.8 to address sequences in which stable °F. These cases are evidently two SGR cases. The plant conditions have been considered as successes, though it is calculation showed that the achieved, USE a minimum not evident that a stable configuration maximum core temperature did mission time of 24 hr. has been reached at 24 or even 30 not oscillate and did not D

Mission times for individual SSCs that function during the accident sequence RA may be less than 24 hr, as long as an appropriate set of SSCs and operator actions are modeled to support the full sequence hours. In addition, there are cases for which the mission time is listed as less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without explanation.

Either do additional calculations to show the two SGR cases are successes or provide adequate explanation of why they are considered successes and a exceed 1800 F for the cases.

mission time. For stable condition has been reached. In sequences in which stable addition, provide additional explanation the modeled plant equipment and human actions, PERFORM ADDITIONAL EVALUATION OR MODELING BY USING FT plant conditions would not be achieved by 24 hr using of the mission times that are shorter than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

AN APPROPRIATE TECHNIQUE.

15 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SC-B3-01 When defining success The current success criteria for LOCAs Resolved This F&O is resolved.

criteria, USE are based on plant capabilities and thermal/hydraulic, system responses. Although the MAAP analyses were structural, or other definitions for small, medium and large performed for a 6 break LOCA analyses/evaluations break LOCAs are reasonable based on which is a lower end of large appropriate to the event this criteria, the specific break sizes LOCA spectrum and upper end being analyzed, and associated with the transitions between of the medium LOCA accounting for a level of the LOCA definitions have not been spectrum. The MAAP analyses modeling.

D detail consistent with the initiating event grouping and accident sequence RA adequately justified. Currently the break sizes are based on the original IPE criteria and no thermal hydraulic analyses of the break sizes have been performed. Per the requirement, thermal hydraulic evaluations are required at a level of detail to support the definitions/break sizes so that the shows that the LOCA is able to be mitigated by either medium LOCA success criteria or large LOCA success criteria. .

appropriate initiating event frequencies can be determined. Several utilities FT PRAs were dramatically impacted when the MAAP code was used to determine actual break sizes and some utilities determined that an additional fourth size LOCA was required to adequately model their plant. This has the potential to dramatically impact the CDF.

16 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SC-B3-01 See above Supplemental Comments: See above See above (continued) This comment is a general comment on thermal-hydraulic analysis for Farley.

More plant-specific analysis would be required. According to your notebook, break sizes for MAAP analysis are as follows:

- Large LOCA : 8.25 ft2 (about 39 in DRA diameter)

- Medium LOCA : 2.18E-02 ft2, 4.91E-02ft2, 1.36E-01ft2 (2 in, 3in, 5 in diameter)

- Small LOCA : 7.64E-04ft2, 5.45E-03ft2, 2.18E-02ft2 (0.37 in, 1 in, 2 in diameter)

The above break sizes are different from FT NUREG/CR-6928 (Reference 14).

Furthermore, they do not appear to explicitly cover the full range of potential LOCAs (from 5 inches up to 39 inches does not appear to be explicitly addressed).

17 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 SC-B3-01 See above According to NUREG/CR-6928 See above See above (continued) (Reference 14), the break sizes for LOCA are defined as follows:

- LLOCA : greater than 6 inches inside diameter (D.2.2) ---> about 0.2 ft2

- MLOCA : between 2 and 6 inches inside diameter (D.2.4) -- -> about 0.02 ft2 ~ 0.2 ft2

- SLOCA : between 0.5 and 2 inches DRA inside diameter (D.2.19) ---> about 0.00005 ft2 ~ 0.02 ft2 The success criteria change for the different break classes but there is no analysis to show that the success criteria are appropriate for both the upper and lower end of the break spectrums. For example, the primary FT difference between LLOCA and MLOCA is typically the number of accumulators required and possibly the number of pumps required. The primary difference between MLOCAs and SLOCAs is that secondary side heat removal is needed for small LOCAs. However, the MAAP analyses do not show that for LOCAs greater than 2 inches, the break is sufficient to remove decay heat while below 2 inches secondary heat removal is required. More and appropriate selection of break size would be required, such as 6 inches, 0.5 inches, etc. Develop LOCA break sizes based 18 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition on Farley specific flow capacities and required systems.

SC-B5-01 CHECK the This SR requires that the Resolved This F&O is resolved.

reasonableness and reasonableness and acceptability of the acceptability of the results SC results be verified. Although there New text concerning the of the thermal/hydraulic, was a table added the Success Criteria reasonableness of the SCs has structural, or other (SC) notebook (during the last few days been incorporated into supporting engineering prior to the peer review) that compares Sections 3.0 of Success success criteria.

D bases used to support the RA the SCs for Farley to SCs for Summer and Turkey Point, there was no text discussing the table, how the comparison was done, and the reasonableness/ acceptability of any differences between Farley and either Summer or Turkey Point. This is a documentation issue rather than a Criteria notebook.

technical issue since the comparison was apparently done. However, there is FT no basis in the documentation to determine whether the work to actually verify the reasonableness of the SCs was completed in accordance with the intent of the standard.

Add discussion to the system notebook that references Table B and, at least at a high level, explains how the comparison was done and what was done if differences were found. At least, provide a couple of examples to illustrate this process.

19 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 SY-A8-01 ESTABLISH the In the diesel generator model, the diesel Resolved This F&O is resolved.

boundaries of the generator, the output breakers, the fuel components required for oil transfer pumps, the sequence relays The modeling approach is valid system operation. MATCH and the Local Control Panel are all because:

the definitions used to modeled individually. However, Farley i) The modeled fuel oil establish the component uses NUREG/CR-6928 (Reference 14) transfer pumps are external failure data. as the source of their generic diesel fuel oil pumps to makeup day generator data and collects plant tanks which are not sufficient to specific data in accordance with the supply fuel oil to DGs for 24 6928 component boundaries. The hours mission time. The pumps DRA NUREC/CR-6928 (Reference 14) diesel generator component boundary explicitly includes the output breaker and the fuel oil system (without much definition)

Thus, the component boundaries as used in the Farley diesel generator system model do not match the component boundaries used for are required to makeup fuel oil from storage tank.

ii) DG Output circuit breaker, sequence relays and the Local Control Panel are modeled separately because thee of five Farley DGs are shared by two units. Even collecting the failure data. Furthermore, though explicit modeling of the the component boundaries used to circuit breaker is somewhat FT derive the generic common cause boundaries do not match the component boundaries used to develop the generic failure rates. For the most part, Farley has made the appropriate adjustments to match the two divergent data sets.

However, the generic common cause data for diesel generators had an event conservative, the proper dependency model is reflected in the model.

whose description was such that it could be interpreted as either involving fuel oil transfer pumps or not. The decision was made to include the event as a diesel failure because it would be conservative.

The component boundary definitions in the Systems and Data Analysis 20 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition Notebooks were not very detailed so this was difficult to identify.

Farley needs to adjust their data collection and quantification to collect and quantify the diesel generator system failure data consistent with how the system is modeled. Farley also needs to review their component boundary SY-A9-01 If a system model is DRA definitions to ensure that they are sufficiently detailed to identify exactly what is included within each component and that are consistent from the model to the system notebooks to the data analysis notebook to the common cause failure analysis.

The system model boundary is not Resolved This F&O is resolved.

developed in which a clearly defined between the notebook single failure of a super and the model. Example is room cooling The system notebooks were used to represent the PERFORM the FT component (or module) is collective impact of failures of several components, modularization process in a manner that avoids grouping events with for Emergency Core Cooling System (ECCS) system is model as part of the system but is listed as a dependent system to the ECCS. AFW discussion of boundary includes condensate tank and steam supply up to steam generators, but later in the notebook defines condensate and steam supply as reviewed and modified as needed to reflect the boundary of the system as shown in the model. The support system sections were reviewed and corrected as needed to reflect the support systems as modeled. Farley PRA System different recovery support systems. See also SY-A8-01 for Analysis Notebooks.

potential, events that are diesel boundary issues.

required by other systems, or events that have probabilities that are dependent on the scenario.

21 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SY-A23-01 DEVELOP system model The system model nomenclature did not Resolved This F&O is resolved.

nomenclature in a consistently use the fault tree guideline consistent manner to allow definitions in the naming convention. The naming conventions have model manipulation and to Examples include: guide has FW as been updated in the Farley represent the same feedwater system but model uses MF as Fault Tree Analysis Guidelines designator when a system designator, RF component type notebook. Specifically the component failure mode is identifier is not match the guide, room identifier FW was changed to used in multiple systems coolers are modeled with the system MF for Main Feedwater and the or trains.

DRA supporting. The room cooler system designator is the same as the ECCS pump.

Farley should review their naming convention and make sure it is applied consistently in all models.

component description for identifier RF was changed to Refrigeration Unit.

FT 22 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SY-B6-01 PERFORM engineering The room heatup calculations for the Resolved This F&O is resolved.

analyses to determine the Engineered Safety Features (ESF) need for support systems pump rooms and ESF electrical This is a documentation issue.

that are plant-specific and equipment rooms are excellent. But The references were corrected.

reflect the variability in the some calculation results are mismatched The model was checked for conditions present during with documents and references, the conservative room cooler the postulated accidents others are conservatively applied into failure modeling as a result of for which the system is fault tree model. Description of Ref.12 interpretation of the calculation required to function.

DRA and HVAC system notebook are mismatched with Ref.4. The calculations results show the temperature of the ESF equipment rooms during 30 days after loss of Heating, Ventilation and Air Conditioning (HVAC) condition. Some document errors occurred using 30-day calc. results.

results. The HVAC model for the Engineered Safety Features (ESF) pump rooms and ESF electrical equipment rooms were updated based on up-to-date room heatup calculations. Farley PRA System Analysis Notebooks.

If the calc. results for ESF pump rooms FT and electrical equipment rooms would be checked for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, temperature of some rooms will be lower than the limit.

If then, the system fault trees does not develop "room cooling failure" any more for those cases. Descriptions should be matched.

23 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition SY-C1-01 DOCUMENT the systems In section 6.1.7 of the system notebooks Resolved This F&O is resolved.

analysis in a manner that for AFW, CCW, Containment Cooling, facilitates PRA Containment isolation, Containment This is a documentation issue.

applications, upgrades, Spray, ECCS, IA, MS, SW incorrect The references were corrected.

and peer review. reference information to test and Farley PRA System Analysis maintenance is provided. Notebooks.

Farley needs to correct the references HR-D2-01 USE DETAILED ASSESSMENTS in theD FOR SIGNIFICANT HFES, RA quantification of pre-initiator HEPs. USE SCREENING VALUES BASED ON A SIMPLE for test and maintenance information.

Farley develops detailed restoration errors for three events and applies this probability to most of the remaining events without any specific evidence through procedures or tests that the events are similar enough that the same values should apply. The values for Resolved This F&O is resolved.

A revision to Table 8-2 of the HRA notebook has been incorporated providing a more detailed explanation of the approach used. The pre-MODEL, SUCH AS ASEP these restoration errors could be initiator approach relies on IN THE significantly over-estimated since the detailed THERP assessments QUANTIFICATION OF THE PREINITIATOR HEPS FOR NONSIGNIFICANT HUMAN FAILURE BASIC EVENTS. When bounding FT values are used, ENSURE they are based on limiting value applied is not shown to be directly applicable to the event analyzed.

Detailed analysis should only be applied to the event analyzed or to directly applicable events where procedures and actions are similar (SW pump trains with identical restoration type errors through similar procedures).

that are mapped to similar HFEs.

cases from models such as ASEP. Perform detailed analysis on all events to verify the applicability used or use screening values for those events not explicitly analyzed with a detailed analysis.

24 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition HR-D2-02 FOR SIGNIFICANT HFES, The screening probability used for Resolved USE DETAILED unanalyzed events is 1E-4. This is This F&O is resolved.

ASSESSMENTS in the significantly lower than the base quantification of pre- screening HEP from ASEP which is A revision to Table 8-2 of the initiator HEPs. USE median failure rate of 3E-2. Even if HRA notebook has been SCREENING VALUES credit is taken for a recovery factor such incorporated providing a more BASED ON A SIMPLE as post-maintenance testing or detailed explanation of the MODEL, SUCH AS ASEP independent verification, then the approach used. The pre-IN THE QUANTIFICATION OF THE PREINITIATOR HEPS FOR NONSIGNIFICANT D

HUMAN FAILURE BASIC RA EVENTS. When bounding values are used, ENSURE screening value would be approximately 8E-3. The screening values used are significantly below the screening values recommended in Technique for Human Error Rate Prediction (THERP) and Accident Sequence Evaluation Program (ASEP).

initiator approach relies on detailed THERP assessments that are mapped to similar HFEs.

they are based on limiting Review the Pre-accident HRA screening cases from models such values that are used and be consistent HR-G1-01 as ASEP.

PERFORM DETAILED ANALYSES FOR THE ESTIMATION OF HEPS FOR SIGNIFICANT HFES.

USE SCREENING VALUES FOR HEPS FOR NONSIGNIFICANT FT with ASEP as discussed in the SR.

The top HRA events in the QU notebook are not developed in the HRA notebook.

Example 1RTOPMANRTNSGH and OMG_A_2-------H. These events appear in several of the top 50 cutsets and are thus significant to the risk assessment Resolved This F&O is resolved.

Included the events in the HRA calculator (section 10.92 and 10.93) file using applicable values found in appropriate references (NUREG CR-5500 HUMAN FAILURE BASIC Develop HRAs for these events and and WCAP-15831).

EVENTS. include in the HRA calculation.

25 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition HR-G7-01 For multiple human The top HRA cutset combinations in the Resolved This F&O is resolved.

actions in the same QU notebook are not addressed in the accident sequence or cut HRA dependency analysis. These An HRA Dependency Analysis set, identified in events appear in several of the top 50 was conducted and accordance with cutsets and are thus significant to the incorporated into the Revision supporting requirement risk assessment 9 model quantification. This QU-C1, ASSESS the analysis has been incorporated degree of dependence, Explicitly evaluate the top HRA into the HRA notebook as and calculate a joint that reflects the dependence. ACCOUNT for the influence of success or failure in D

human error probability RA preceding human actions and system performance combinations in the dependency analysis.

Attachment C.

on the human event under consideration including (a)

FT time required to complete all actions in relation to the time available to perform the actions (b) factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.) (c) availability of resources (e.g.,

personnel) 26 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition HR-G7-02 For multiple human Attachment C to the HRA notebook Resolved This F&O is resolved.

actions in the same performs the dependency assessment, accident sequence or cut but the dependency factors are based An HRA Dependency Analysis set, identified in upon 2004 HRA values. The was conducted and accordance with multiplication factors in the rule file are incorporated into the Revision supporting requirement to be based upon current HRA. The 9 model quantification. This QU-C1, ASSESS the recovery rules seem to address analysis has been incorporated degree of dependence, dependence with factors greater than into the HRA notebook as and calculate a joint dependence. ACCOUNT for the influence of success or failure in D

human error probability that reflects the RA preceding human actions and system performance one and only then for 5 events. This is not consistent with the dependence methods.

Update the HRA dependence evaluation to be consistent with industry practices.

Attachment C.

on the human event under consideration including (a)

FT time required to complete all actions in relation to the time available to perform the actions (b) factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.) (c) availability of resources (e.g.,

personnel) 27 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition HR-I3-01 DOCUMENT the sources Assumptions are listed in the individual Resolved This F&O is resolved.

of model uncertainty and HRA analyses. However, some major related assumptions assumptions normally associated in an A document was created to associated with the human HRA analysis, such as default minimum address HRA Uncertainty for reliability analysis. values for pre- and post-accident HRAs, the Farley Revision 9 model. It are not included in the analysis. In can be found as Attachment F addition, uncertainty based on using the in the HRA notebook.

same HRA probability for all manual DRA valve misalignments is ripe for an uncertainty evaluation. Also the HRA calculation does not address the different types of uncertainty that is included in other Farley document packages. Review the EPRI report on HRA uncertainties and see if any will apply to Farley. Documentation of sources of uncertainty is required by the SR FT Include a source of uncertainty in the HRA calculation.

28 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition DA-C14-01 EXAMINE coincident Several of the data sets used in the Resolved This F&O is resolved.

unavailability due to Farley database are based on maintenance for redundant information that is getting dated. The The data were updated using equipment (both intrasys- period over which these data were more recent industry generic tem and intersystem) collected is 1984 through 2001, or data and plant specific THAT IS A RESULT OF A earlier. The affected data sets include experience data.

PLANNED, REPETITIVE Table 4 (simultaneous maintenance on ACTIVITY based on actual redundant equipment), offsite power plant experience.

CALCULATE coincident maintenance DRA unavailabilities that are a result of a planned, repetitive activity that reflect actual plant experience. Such recovery, and plant-specific data used for failure rates, probabilities, and unavailability. For RIR application, periodically updated plant specific data is required.

These data sets need to be updated using more recent information.

coincident maintenance unavailability can arise, for FT example, for plant systems that have installed spares (i.e., plant systems that have more redundancy than is addressed by tech specs).

29 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFPP-B2-02 DOCUMENT the process The IF notebook provides descriptions Resolved This F&O is resolved.

used to identify flood about flood areas within four (4) areas. For example, this buildings, such as auxiliary building, New text concerning documentation typically diesel building, service water intake screened/eliminated areas and includes (a) flood areas structure, and turbine building. There is buildings has been used in the analysis and no description about the other buildings. incorporated into the Section the reason for eliminating Even though they are not risk-significant, 3.1 of the Flooding notebook.

areas from further analysis the description about the reason why (b) any walkdowns D

performed in support of the plant partitioning RA those buildings are not analyzed is needed. The screened/ eliminated areas are not considered in the analysis.

Possible resolution is to add information about the screened/eliminated areas and buildings in terms of internal flooding analysis.

FT 30 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFPP-B2-03 DOCUMENT the process Even though Farley has areas that are Resolved This F&O is resolved.

used to identify flood common between both units the areas. For example, this documentation of how multi-unit impacts New text concerning multi-unit documentation typically were addressed could not be located. impacts has been incorporated includes (a) flood areas Discussions with the Farley PRA staff into the Section 3 and 12.5 of used in the analysis and did reveal that Farley had considered the Flooding notebook.

the reason for eliminating multi-unit effects, However, the areas from further analysis documentation of how Farley explicitly (b) any walkdowns D

performed in support of the plant partitioning RA considered the potential for multi-unit floods is not well presented.

The IF Notebook needs to be updated to address the potential for multi-unit floods or the propagation of a flood in one unit to the other unit via shared spaces.

Farley needs to explicitly describe how they dealt with the evaluation multiunit effects for areas where there shared FT spaces. The basis for any screening of such areas should be explicitly described in the text as well as in the screening table.

31 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFSN-A2-01 For each defined flood The flood analysis does discuss the Resolved This F&O is resolved.

area and each flood potential effect of: alarms, structure such source, IDENTIFY plant as curbs and sumps, drains, sump New text has been design features that have pumps, watertight doors; However any incorporated in Table 6-1 the ability to terminate or direct application of these factors was through 6-4, Tables 7-1 contain the flood hard to find. The factors most often through 7-4, Table 9-1, Section propagation. INCLUDE the explicitly credited was the credit for 12.3 of the Flooding notebook.

presence of (a) flood jacketed piping eliminating spray curbs, sumps (i.e.,

D alarms (b) flood dikes, physical structures that RA allow for the accumulation and retention of water) (c) drains (i.e., physical structures that can function as drains) (d) considerations and air/water tight doors stopping propagation.. The remarks column in table 7-1 does seem to reference hatches as propagation paths but it is not clear that impact of drains and curbs or the like were considered for propagation.

sump pumps, spray Farley should update the flood shields, water-tight doors documentation to provide more (e) blowout panels or manual operation capability FT dampers with automatic or information on plant features that can impact the propagation or retention for each flood scenario, especially anywhere that non-watertight doors, berms or curbs are credited 32 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFSN-A4-01 ESTIMATE the capacity of In the IF Notebook, there was extensive Resolved This F&O is resolved.

the drains and the amount discussion with respect to treatment of of water retained by drains, there was explicit evidence that New text has been sumps, berms, dikes, and drains were considered as propagation incorporated into the curbs. ACCOUNT for paths for several flood scenarios. appropriate sections of the these factors in estimating However, no explicit estimation of drain Internal Flooding Analysis flood volumes and SSC capacities could be found. This is a Notebook.

impacts from flooding. direct violation of SR.

IFSN-B3-01 DOCUMENT sources of related assumptions associated with the DRA model uncertainty and internal flood scenarios.

Farley should consider adding a table that explicitly includes drain capacities.

The IF Notebook did not seem to include assumptions related to the flood scenario selection in a coherent fashion nor did there seem to be any discussion concerning sources of uncertainty.

Resolved This F&O is resolved.

New text concerning uncertainty and assumptions has been incorporated into the appropriate sections of the Farley needs to include a section in the Internal Flooding Analysis FT IF Notebook to discuss the IF assumptions and sources of uncertainty.

A section on assumptions could be included in each section (such as was done for section 9 and 11) or a single section encompassing all tasks could be added Notebook.

33 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFEV-B3-01 Document sources of The Farley PRA flooding analysis Resolved This F&O is resolved.

model uncertainty and indicates that sources of uncertainty related assumptions were not documented because of the New text concerning associated with the low contribution to CDF and LERF from uncertainty and assumptions internal flood-induced flooding. Although this is true, this SR has been incorporated into the initiating events. requires that sources of model appropriate sections of the uncertainty and related assumptions Internal Flooding Analysis associated with the internal flood- Notebook.

DRA induced initiating events be documented.

Include a discussion of uncertainty and assumptions related to internal flood initiating events. This finding is related to other internal flooding SRs that discuss documentation of uncertainty.

FT 34 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFQU-A6-01 For all human failure HRA for flooding event was performed Resolved This F&O is resolved.

events in the internal flood but the base is different from internal scenarios, INCLUDE the event HRA. It seems that there is A plant-specific calculation following scenario-specific version mismatch. describes the HRA impacts on PSFs for methodology for flooding PRA control room and ex- Possible resolution is to update the HRA and flooding human failure control room actions as for flooding events like HRA for internal events were added to the HRA appropriate to the HRA events. Calculator database.

D methodology being used:

(a) additional workload and stress (above that for similar sequences not RA caused by internal floods)

(b) cue availability (c) effect of flood on mitigation, required response, timing, and recovery activities (e.g.,

FT accessibility restrictions, possibility of physical harm) (d) flooding-specific job aids and training (e.g.,

procedures, training exercises) 35 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFQU-A7-01 PERFORM internal flood Quantification of flooding event does not Resolved This F&O is resolved.

sequence quantification in perform uncertainty analysis and accordance with the dependency analysis. Section 10.1.7 An HRA Dependency Analysis applicable requirements explains the dependencies between was conducted and described in the human interactions, and Farley incorporated into the Revision quantification (QU). performed dependency analysis when 9 model quantification. This quantifying the flood CDF. However, analysis has been incorporated there is no description of calculation into the HRA notebook as DRA results about the dependencies.

Technical Items are missing.

Possible resolution is to perform and provide uncertainty analysis and dependency analysis, even though the flood risk is not significant.

Appendix C.

FT 36 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFQU-A11-01 CONDUCT walkdown(s) to Internal Flooding Analysis Notebook Resolved This F&O is resolved.

verify the accuracy of Appendix .A does not describe the information obtained from information related with human reliability Although qualitative screening plant information sources analyses and screening decisions. is documented in Table 6-1 to and to obtain or verify 6-4 of the Internal Flooding inputs to (a) engineering Possible resolution is to provide the notebook, the tables did not analyses (b) human room for include any human actions.

reliability analyses (c) 1) Operator mitigation action and Section 6 of the Internal screening decisions D

spray or other applicable impact assessments (d)

RA

2) Reason of screening decisions.

Supplemental Comments:

According to ASME Standard, IFQU-A11, human actions (and human reliability analysis) modeled for each flood area's quantification are verified via flood walk downs. Also, the reason of Flooding notebook lists the screening criteria which includes human mitigating actions as a criterion (criterion d.). However most of the flood locations in Tables 6-1 to 6-4 were qualitatively screened based on criterion a or b. None screening decision should be verified via were screened on criterion d, walk downs. which shows that although FT Proposed resolution : The walk down sheet for each flood area add two more sections as follows:

G. related human actions H. Screening Decision In case of screening, table 6-1 in the notebook would be a good reference. In human actions were considered as a screening criterion, there were no applicable areas in the Farley flooding PRA.

case of HRA, table 10-2 and 10-3 would be a good reference.

37 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition IFQU-B3-01 DOCUMENT sources of The Farley PRA flooding analysis Resolved This F&O is resolved.

model uncertainty and indicates that sources of uncertainty related assumptions were not documented because of the New text concerning associated with the low contribution to CDF and LERF from uncertainty and assumptions internal flood accident flooding. Although this is true, this SR has been incorporated into the sequences and requires that sources of model appropriate sections of the quantification. uncertainty and related assumptions Internal Flooding Analysis associated with the internal flood- Notebook.

QU-F1-01 DOCUMENT the model DRA induced initiating events be documented.

Include a discussion of uncertainty and assumptions related to internal flood initiating events. This finding is related to other internal flooding SR that discusses documentation of uncertainty.

The maintenance related mutually Resolved This F&O is resolved.

quantification in a manner exclusive events are stated to be based that facilitates PRA on Tech Spec disallowed maintenance Documentation reference has and peer review.

FT applications, upgrades, conditions. The mutually exclusive logic was based upon FNP-0-ACP-52.1 but was not referenced as the source of the mutually exclusive logic. The review of the QU notebook referenced the incorrect document the development of the mutually exclusive logic.

been updated in the Internal PRA Quantification Notebook.

Update the documentation to reflect the actual references.

38 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition QU-F4-01 DOCUMENT the The information regarding the Resolved This F&O is resolved.

characterization of the assumptions and sources of uncertainty sources of model is located in Appendix D of the Farley Added Appendix D to the uncertainty and related QU notebook. However, this appendix is Internal PRA Quantification assumptions. not referenced in the QU notebook, Notebook. Corrected neither is it included in the notebook's references to the Appendix in table of contents. The only reference to the Revision 9 Roadmap.

the appendix is in the Revision 9 DRA Roadmap and Quality Self-Assessment document, and in this document it is misidentified as Appendix A. References to this document are either nonexistent or incorrect. Even though the document contains a lot of good information, it is almost impossible to locate.

Correct the QU notebook table of contents to include Appendix D and its FT title. Add information to Section 2 that references the appendix. Correct the reference to the appendix in the Revision 9 Roadmap.

39 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition N/A (LE-C2) INCLUDE realistic The Farley PRA LERF model relies No Finding Although this SR was treatment of feasible largely on human error probabilities determined to be CC-I by the operator actions following taken from the WCAP-16341-P. peer review, no F&O was the onset of core damage Because the WCAP HEPs are generic made. The conservatism consistent with applicable rather than plant-specific, they were introduced by meeting this SR procedures, e.g., derived as conservative estimates. at CC-I level would not EOPs/SAMGs, significantly affect the proceduralized actions, or conclusions made based on guidance.

D Technical Support Center RA the Farley PRA results, including the calculation of RICT values.

The major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure FT concurrent with core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

40 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition N/A (LE-C9) JUSTIFY any credit given No credit is taken for either equipment No Finding Although this SR was for equipment survivability operation or human actions in adverse determined to be CC-I by the or human actions under environments. peer review, no F&O was adverse environments. made. The conservatism introduced by meeting this SR at CC-I level would not significantly affect the conclusions made based on DRA the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with FT core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

41 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition N/A (LE- JUSTIFY any credit given No credit was taken in the Farley PRA No Finding Although this SR was C11) for equipment survivability for equipment or operator actions determined to be CC-I by the or human actions that impacted by containment failure. The peer review, no F&O was could be impacted by WCAP-16341-P methodology made. The conservatism containment failure. conservatively does not credit introduced by meeting this SR containment sprays for fission product at CC-I level would not scrubbing or pressure suppression for significantly affect the the containment failure. conclusions made based on DRA the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with FT core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

42 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition N/A (LE- REVIEW significant The LERF frequency calculated in the No Finding Although this SR was C12) accident progression Farley PRA is so low that no review was determined to be CC-I by the sequences resulting in a performed to reduce LERF based on peer review, no F&O was large early release to engineering analysis to support made. The conservatism determine if engineering equipment operation or operator action introduced by meeting this SR analyses can support after containment failure. at CC-I level would not continued equipment significantly affect the operation or operator conclusions made based on or a combination D

actions after containment failure that could reduce LERF. USE conservative RA conservative and realistic treatment for non-significant accident progression sequences.

the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with FT core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

43 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O# Topic Finding Description Status Disposition MU-B4-01 PRA Upgrades shall There is no reference to a peer review Resolved This F&O is resolved.

receive a peer review and for upgrades. Did not find a section the peer review section of which addressed upgrades (not Relevant SNC Procedure was each respective part of the updates) to the PRA specifically revised to require a peer standard for those aspects involving changes to key PRA software. review following an upgrade of of the PRA that have been This is a direct violation of an SR. the PRA model.

upgraded.

Revise either NL-PRA-001 or NL-PRA-DRA 002 to explicitly require a peer review for PRA upgrades (i.e. methodology change or major software change etc.)

FT 44 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 4.0 Technical Adequacy of FNP Fire PRA Model NEI 06-09 requires that the PRA be reviewed to the guidance of Regulatory Guide 1.200, Rev 2 (Reference 3) for a PRA which meets Capability Category (CC) II for the supporting requirements of the American Society of Mechanical Engineers (ASME) fire events at power PRA standard. It also requires that deviations from these capability categories relative to the RICT program be justified and documented.

The FNP Fire PRA has undergone a RG 1.200, Revision 2 (Reference 3) Peer Review against the ASME PRA Supporting Requirements (SRs) by a team of knowledgeable industry (vendor and utility) personnel. The review (Reference 12) was conducted by the Westinghouse Owners Group in accordance with NEI 07-12 as endorsed by RG 1.200 Rev 2 (Reference 3). The conclusion of the review was that the FNP methodologies being used were appropriate and sufficient to satisfy the ASME/ANS PRA Standard RA-Sa-2009 (Reference 6). The review team also noted that NUREG/CR-6850 methodologies were applied correctly.

The summary of the peer review findings exhibited the following statistics for the evaluation of D

elements to the combined PRA Standard. For the FNP Fire PRA, 88% of the SRs were assessed at Capability Category II or higher, including 8% of the SRs being assessed at Capability Category III. The FNP Fire PRA had an additional 5% of the applicable SRs assessed at the Capability Category I level. The Fire PRA was found to not meet 7% of the applicable SRs.

RA The Westinghouse Peer Group concluded that the Farley Fire PRA is consistent with the ASME/ANS PRA Standard and supports risk-informed applications. As a result of the peer review and the fire risk evaluation process the FNP Fire PRA has undergone additional model refinements. These refinements were made consistent with the methodologies that were 4.1 FT reviewed during the FNP Peer Review.

This enclosure provides a detailed assessment of each of the findings identified by the Peer Review team.

RG 1.200 Peer Review for FNP Fire PRA Model against ASME PRA Standard Requirements The ASME/ANS RA-SA-2009 version of the PRA Standard (Reference 6) contains a total of 173 numbered supporting requirements (SRs) in 13 technical elements. The configuration control element has 10 additional SRs. Thus, a total of 183 SRs were assessed.

Among 183 SRs, 29 were determined to be not applicable to the FNP Fire PRA either due to the fact that the requirements were not applicable to the FNP approach or the technical element was not used for the FNP analysis (i.e., QLS and QNS). Of the 154 total applicable SRs, approximately 87% met Capability Category II or higher, as shown in Table E2-3.

Table E2-3. Summary of FNP Fire Events Capability Categories Capability  % of total No. of SRs  % of total SRs Category Met applicable SRs Met 100 54.6% 64.9%

45 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-3. Summary of FNP Fire Events Capability Categories Capability  % of total No. of SRs  % of total SRs Category Met applicable SRs Not Met 13 7.2% 8.4%

CC I 9 4.9% 5.8%

CC II 5 2.7% 3.3%

CC III 14 7.6% 9.2%

CC I/II 4 2.3% 2.6%

CC II/III 9 4.9% 5.8%

NA 29 15.8% -

NR 0 - -

Total 183 100.0% 100%

The peer review generated 31 Findings out of which 13 SRs were judged to be not met. These were PP-B2, PP-B3, PP-C3, PRM-B2, FSS-D7, FSS-D8, FSS-D11, FSS-F1, FQ-C1, FQ-D1, FQ-E1, FQ-F1, and UNC-A1. An additional 9 SRs met CC-I, but not CC-II. These were: CS-B1, FSS-B2, FSS-C1, FSS-C2, FSS-D3, FSS-E3, FSS-F2, FSS-G6, and FSS-H5. The Findings 4.2 D and resolutions associated with these SRs are described in Section 4.3. Thus, the FNP fire PRA meets the requirements of RG 1.200.

RA Resolution of Findings from RG 1.200 Fire PRA Peer Review Table E2-4 shows the details of the 31 Findings and the associated resolutions developed after the peer review.

FT 46 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition CS-B1-01 The Farley breaker The PRA components are not explicitly Resolved This F&O is resolved.

Coordination discussed in a coordination calculation.

documentation was Calculation SE-C051326701-002 is titled The Farley circuit analysis identified to be NSCA components; however, informal review calculation, SE-C051326701-002, incomplete based on has determined that PRA components are has been updated to address all the Farley Fire PRA addressed. The information to determine the coordination concerns. This components being status of coordination for PRA components update identified two panels that credited. consists of informal queries and were found to not be coordinated; DRA spreadsheets. Supporting Requirement CS-B1-01 Category II requires all buses credited in the Fire PRA to be analyzed for proper over current coordination and protection.

Revise calculation SE-C051326701-002 to formally validate that PRA buses are addressed for proper coordination and all other panels were dispositioned as acceptable. The two panels are N1R19L00504 and N2R19L00504. Calculation PRABC-F-11-003 (Cable Selection and Detailed Circuit Analysis) has been updated to address this coordination issue.

incorporate results into the Fire PRA model Based on these conclusions these as needed. two panels have been failed in FT every scenario for the Farley Fire PRA. Associated Circuits Analysis Common Power Supply and Common Enclosure calculation, SE-C051326701-002 has been updated to reflect this update. The Farley Component Selection Report, PRA-BC-F 002, has also been updated to reflect the inclusion of these panels to the UNL list.

CS-B1-02 The Farley breaker E-068 identifies cases where the cable Resolved This F&O is resolved.

Coordination lengths of electrical loads were credited to calculations use cable demonstrate selective coordination for the An analysis was completed that length as part of the Cable Spreading room. This assumption is reviewed the panels that credited 47 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition justification for proper only valid for the Appendix R fire where the cable length as part of the coordination. This is equipment and cables are assumed damaged justification for coordination. The not a justifiable for the entire fire area. Supporting entire function of these panels disposition for use in Requirement CS-B1-01 Category II requires was then failed for any fire that the Fire PRA. all buses credited in the Fire PRA to be impacted the cable within the analyzed for proper over current coordination identified length. Once the length and protection. requirement was met the function of that cable was the only function DRA Analyze impacted PRA buses for proper coordination and incorporate results into the Fire PRA model.

failed. A modification improves coordination for six additional 125VDC load distribution panels per unit. For further information on the modification of these panels see Plant Modifications Committed in Table S-2 of Attachment S of NFPA 805 submittal.

FQ-A3-01 Appendix L of A non-suppression probability of 3.04E-5 is Resolved This F&O is resolved.

been incorrectly applied to the Main Control Board scenarios in the Farley Fire PRA. The ignition frequencies have since been FT NUREG-CR/6850 had used for the Main Control Room (NSP-0401*

basic events). A review of the Scenario Development report, the Summary Report, and the MCR Report did not locate the justification of this probability. Based on discussion with the Farley team, the values were derived from NUREG/CR-6850, Attachment L. A review of that Attachment did The Farley MCR analysis has been updated to accurately apply the non-suppression factors as appropriate to the Main Control Board scenarios. The Farley Fire Scenario Report discusses the scenario development process for updated to accurately not support a NSP below 1E-4 under the best the Main Control Board and the apply Appendix L. of circumstances. A NSP of 2E-2 (similar to use of Appendix L in section other NSP events) would make MCR fire the 13.1.2 of PRA-BC-F-11-014.

highest contributor to plant risk.

48 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition Re-evaluate the NSP used for the Control Room and document the evaluation clearly in one of the reports.

FQ-C1-01 Possible combination A review of cutsets for different sequences Resolved This F&O is resolved.

events were missing found multiple HRA combinations that are not from the cutset results being replaced by a COMBO* event and do Every COMBO event is evaluated for the Fire PRA not appear to be evaluated for dependence. and incorporated in the fire PRA.

model. One such combination is 1OPMSO32-IH-F An updated dependency analysis DRA and OAR_B_1------H-F which has a combined failure probability of approximately 7E-5. A review of the HRA Calculator package supplied shows that no evaluation was performed for this combination of events.

Other HRA combinations could also be missing, particularly with new operator actions added for the fire scenarios. HRA was completed after the peer review findings were addressed in the model. The latest results of the dependency analysis captures all important combinations. This is documented in the Human Reliability Analysis for Fire Events, PRA-BC-F-11-016.

dependence could significantly increase cutsets since the rule file makes HRAs FQ-D1-01 The CCFP for Farley Fire PRA was much FT independent unless the events are replaced by an evaluated combination.

Review the FPRA cutsets without recovery (all events set to screening values) to ensure that all important combinations are evaluated.

In Section 3 of the Farley Nuclear Plant Summary Report, Farley reports a CDF of Resolved This F&O is resolved.

greater than what the 9.65E-05/year and a LERF of 1.92E-5/year. The Farley Fire PRA has FPIE number was. This yields a Conditional Containment Failure continued to evolve and be After continued Probability (CCFP) of 1.99E-01. For the FPIE refined throughout the analysis.

refinement the Fire PRA, the reported CDF was of the order of Currently the CCFP is at a much PRA CCFP has 3.5E-05/year and the reported LERF was of more reasonable value based on decreased to a more the order of 2E-07/year. This translates to a the final CDF and LERF results.

reasonable value as CCFP of about 4E-03. This is a significant The results and insights related to 49 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition compared with the difference, especially when considering that CDF and LERF can be found in FPIE. the leading contributor to LERF for the FPIE the Farley Summary Report PRA, SGTR, is not applicable for fire. This section 3 of PRA-BC-F-11-017.

yields inconsistent results.

The high fire-induced CCFP was While the current results may be correct, directly related to the human Farley needs to look at the contributors to error, OCI_A_1 ------H-F Operator LERF to explain the basis for the high CCFP fails to manually isolate DRA with respect to the FPIE PRA CCFP. Farley should look at sequences where the fire not only causes core damage but also directly affects containment integrity. Two likely candidates are sequences that lead to a new ISLOCA scenario and sequences that lead to containment isolation scenarios.

containment prior to core damage during a fire event) having a screening HEP of 1.0 in the model reviewed by the peer reviewers.

The HEP has been updated by performing a detailed HRA after the peer review and the updated HEP is now 1.20E-02.

With new HEP of 1.20E-02, the fire-induced conditional FT containment failure probability is estimated to be 0.024 from the fire CDF and LERF, 5.24E-5/yr and 1.26E-6/yr, respectively for Unit 1.

As presented in Table W-1, Attachment W of NFPA LAR dated September, 25 2012, internal events CDF and LERF for Unit 1 are 1.06E-5/yr and 1.24E-7/yr, respectively. These risks yield an internal events conditional containment failure 50 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition probability of 0.012, which is comparable to the fire-induced CCFP FQ-E1-01 The Farley Fire PRA The summary report lists and describes Resolved This F&O is resolved.

documentation did not significant contributors to core damage and accurately address LERF. The back references require The Farley Summary report the types of reviews consideration of analysis issues which are not includes additional details that were performed described in the report as having been done. describing the types of reviews cutset review sessions.

D during the scenario RA For example, the back references require a review the results of the PRA for modeling consistency, a review of results to determine that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results, a review of contributors for reasonableness and a review of the importance results for reasonableness.

that were completed on the Farley Fire PRA. The type of review and the detailed cutset reviews are described in section C.1 of Appendix C in the Summary Report.

Appendix F notes that these were accomplished and typically refers back to FT Appendix C. Appendix C does not describe these reviews as being accomplished, nor does it describe the results of the reviews. In addition, back Reference D5 requires a review of non-significant cutsets for reasonableness. Appendix F states that dominant cutsets were reviewed and those that were reduced in frequency to non-significance as a result of the review constitute the review of non-significant cutsets. This does not satisfy the requirement to review non-significant cutsets. Non-significant cutsets generated in the solution of the model need to be reviewed to confirm that 51 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition their frequency is not underestimated due to modeling errors.

Expand the discussion of model solution and review in the summary report to indicate that required review items have been accomplished.

FQ-F1-01 Level of detail The documentation of the FPRA results does Resolved This F&O is resolved.

describing the risk detail D significant scenarios was identified as not being sufficient in RA not adequately describe the top risk contributors such that it is clear why these scenarios, basic events, and human actions are dominant. Based on other findings (FQ-D1-01 and FQ-E1-01), it is not clear that the Farley team understands the bases for these top scenarios. Results presentation is important for PRA acceptability.

The Farley Summary report has been updated to reflect the insights by reviewing the top contributors for CDF and LERF.

This describes the fire induced impacts as well as the random failures. The resolution of this Understanding of the PRA results is finding is found in Appendix C of necessary for performing any RI application Farley Fire PRA Summary FSS-A2-01 FT Target set definition in Fire Zones (FZs) that do not have fire rated to support the plant.

Provide more detailed discussions of the fire impacts and results to represent a strong understanding of the fire scenarios.

FNP is missing the basis for not including targets outside the fire compartment for full room burnout scenarios. For full room Report.

Resolved This F&O is resolved.

A review of the full room burnout boundaries on all burnout scenarios, all targets in the fire scenarios was completed that sides as it relates to compartment are included. However, there is looked for open boundaries to the scenarios that are no documented basis for not including targets adjoining FZs and the possible classified as full room outside the fire compartment for full room interactions that could take place.

burnouts. burnout scenarios. If the compartment has For some particular fire areas a an opening to an adjacent compartment, it scenario was postulated that was not verified that targets in the adjacent 52 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition compartment would be outside of the ZOI of would fail all targets within the fire all the ignition sources in the compartment area.

analyzed for full room burnout. However, in most cases it was determined that there was no See F&O PP-B3-01 (F) for a possible ignition source near the open resolution. boundary that would impact targets in an adjoining FZ. The Farley Fire Scenario Report FSS-B2-01 The Main Control Room Abandonment DRA calculation identifies the potential for a An office workstation fire scenario is discussed in the documentation, but is not fully justified. The workstation fire scenario is potentially the most significant fire scenario includes discussion of the scenario development process for these specific cases in section 3.1.1 of PRA-BC-11-014.

Resolved This F&O is resolved.

The Farley Main Control Room Abandonment Calculation workstation fire but considered. includes the discussion of the does not describe the workstation fire in section B.8 as a detail.

FT fire type in significant Provide better documentation of how the workstation fire was modeled and the results of this fire scenario.

sensitivity to the analysis with the results shown in Table B-8.

NUREG/CR-6850 does not provide any basis for this type of fire from an ignition frequency standpoint. Therefore it is not included as one of the potential ignition sources in the base calculation. A review of the sensitivity analysis involving the workstation shows that the analysis is not sensitive to that type of fire given the design of the Main Control Room envelope.

53 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition FSS-C1-01 The Farley Fire PRA Two-point fire intensity model that Resolved This F&O is resolved.

does not employ the encompass low likelihood, but potentially risk use of a two point fire contributing, fire events were not used in all Although the finding still stands modeling treatment in cases. Fire scenarios were done with ignition and the SR is met at CC I, further the development of sources characterized with one fire intensity. resolution of this F&O will not the fire scenarios. impact the RICT calculations To reach Capability Category II, use a two- which are based on a risk delta.

point intensity model for all ignition sources. The development of fire scenarios DRA Utility Comment: The development of fire scenarios for the Farley Fire PRA did not identify any instances where further analysis resolution would be gained by the treatment as inferred by the requirements for CC II and CC III. The implications of retaining the CC I treatment in lieu of refining as described for for the Farley Fire PRA did not identify any instances where further analysis resolution would be gained by the treatment as inferred by the requirements for CC II and CC III. The implications of retaining the CC I treatment in lieu of refining as described for CC II or CC III is potentially a higher CC II or CC III is potentially a calculated CDF contribution. The CC I higher calculated CDF FT treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

Response: The SR stipulates that a two-contribution. The CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements point model is required for CC-II. As you are not considered necessary.

stated in your comment, Farley feels that the one-point model is conservative and justified.

This would be viewed as the proposed resolution, but the F&O stands.

FSS-C2-01 The Farley Fire PRA Ignition source intensity were characterized Resolved This F&O is resolved.

did not characterize such that fire is initiated at full peak intensity 54 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition the ignition source and ignition sources that are significant Although the finding still stands intensity for a time- contributors to fire risk were not characterized and the SR is met at CC I, further dependent growth rate using a realistic time-dependent fire growth resolution of this F&O will not in the scenario profile. Generic methods from the Hughes impact the RICT calculations development. Associates Generic Fire Modeling Treatments which are based on a risk delta.

were used to characterize ignition source The only readily available intensity. These generic methods did not reference for a time dependent incorporate fire growth curves. growth rate that could be DRA Characterize ignition sources that are significant contributors to fire risk using a realistic time-dependent fire growth profile.

Utility Comment: The only readily available reference for a time dependent growth rate that could be considered in the analysis is 12 considered in the analysis is 12 minutes as recommended in NUREG/CR-6850. The treatment would involve a t2 growth rate. If a particular source/ target interaction has a spacing where the target is at the critical damage spacing threshold, such a minutes as recommended in NUREG/CR- treatment may provide some 6850. The treatment would involve a t2 benefit as successful suppression FT growth rate. If a particular source/target interaction has a spacing where the target is at the critical damage spacing threshold, such a treatment may provide some benefit as successful suppression with that time period would prevent target damage. However, if the target is located well within the calculated damage distance, the corresponding time to with that time period would prevent target damage. However, if the target is located well within the calculated damage distance, the corresponding time to reaching the damage threshold is very short and effectively precludes any meaningful credit reaching the damage threshold is very short for suppression. In the case of the and effectively precludes any meaningful Farley Fire PRA, the majority of credit for suppression. In the case of the the target spacing for the Farley Fire PRA, the majority of the target dominant risk contributors is such spacing for the dominant risk contributors is that no meaningful credit for such that no meaningful credit for suppression is available. In other suppression is available. In other dominant dominant risk contributors, the 55 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition risk contributors, the scenario involves high scenario involves high energy energy arcing fault (HEAF) events were no arcing fault (HEAF) events were growth time is applicable. The implications of no growth time is applicable. The retaining the CC I treatment in lieu of refining implications of retaining the CC I as described for CC II/III is potentially a treatment in lieu of refining as slightly higher calculated CDF contribution. described for CC II/III is The CC I treatment inherently will not result in potentially a slightly higher under-estimation of fire risk. As such, the calculated CDF contribution. The DRA current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

Response: The Farley modeling was found to be consistent with CC-I but did not meet the requirements of CC-II. The comment CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative.

Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered provides the basis for stating that the existing necessary.

treatment is adequate. It does not provide FSS-D1-01 The treatment of Secondary FT evidence that a time-dependent heat release rate model was used.

The fire modeling tools selected for use are appropriate for evaluating the zone of combustibles was not influence associated with individual fixed and clearly defined in the transient ignition sources, but do not provide scenario development for estimating fire growth and damage documentation. behavior for fire scenarios involving ignition Resolved This F&O is resolved.

The Farley Scenario development notebook was updated to include additional details on how the treatment of secondary and fire spread on secondary combustibles. combustibles is dealt with during With the generic fire modeling treatment scenario development. Further selected for this fire PRA, there does not information regarding this finding appear to be a way to model fire growth on can be found in section 4.0 of secondary combustibles. Consequently, the Farley Fire PRA Scenario extent of fire development cannot be Development Notebook modeled.

56 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition Where secondary combustibles are located within the zone of influence, develop methods for estimating fire growth on secondary combustibles and the damage caused by this additional fire development.

FSS-D7-01 The Fire PRA credits SR FSS-D7 requires credited fire suppression Resolved This F&O is resolved.

the in cabinet CO2 systems to be installed and maintained in system installed at Farley. There was no documentation provided to support system.

DRA the availability of this accordance with applicable codes and standards, and the credited systems must be in fully operational state during plant operation. These requirements are not met, but fire suppression systems are still being credited. As noted in the Conclusions section of Document # 0005-0012-002-002-04 (Hughes Associates), "The other main Supporting documentation has been included in the Farley Fire Scenario report to further discuss the in cabinet CO2 suppression system and the associated test and inspection procedures that are credited in the Fire PRA. It has also been identified that the concern with the systems installed at FNP is system does require the periodic maintenance and subsequent modifications, such as mechanical FT corrective action. Firstly, the plant procedures for inspection, testing and maintenance (ITM) do not address a few key activities required by NFPA 12. Secondly, the prioritization of work orders sometimes results in extended impairments (e.g., observed CR / work request tags over two years old), which negatively affects the fire protection program equipment and detection upgrades, to be made to make the system operable as designed.

This is found in section 8.1.1 of Farley Fire PRA Scenario Development Notebook objective to maintain working systems."

Credit is being taken for fire suppression systems that do not meet the requirements of FSS-D7 for taking this credit.

Verify that credited fire suppression systems are installed and maintained in accordance 57 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition with applicable codes and standards and demonstrate that credited systems are in a fully operable state during plant operation.

FSS-D7-02 The non-suppression In Tables 13-1 through 13-12 the equation Resolved This F&O is resolved.

probability that was e^(-lambda*t) was used to calculate the non-originally used to suppression probability for MCR The application of the MCR calculate the MCR abandonment scenarios. The control room abandonment non suppression abandonment lambda value from Table P-2 was selected. probability has been re-evaluated frequency was unconservative based on Appendix P of NUREG-CR/6850.

D direction provided in RA The time, t, was obtained through the CFAST runs and plugged into the equation. In scenarios in which the time to abandonment was greater than 25 minutes a nominal NSP of 0 was selected. A NSP of 0 should not be assumed for these cases. Instead, it is suggested to run the CFAST cases longer than 25 minutes such that the analysis can using the floor value of 1.00E-03 for all bins that are determined to reach the abandonment threshold. The results of this review are identified in section 13 of Farley Fire PRA Scenario Development Notebook credit a larger time with no abandonment conditions reached (i.e. if the case is ran to FT 60 minutes with no abandonment conditions reached, it can be credited up to 60 minutes) and still use the e(-lambda*t) equation to calculate NSP.

Additionally, the MCR equipment rooms are normally unoccupied and NSP should be associated with the electrical equipment room vs. the control room. If the control room lambda is used, a basis should be developed why the control room lambda is more appropriate than the electrical cabinet lambda. If the control room lambda basis has been justified, then a sensitivity analysis should be performed using the lambda of 58 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition electrical fires. This calculation can be non-conservative.

FSS-D8-01 The Farley Fire PRA Note 8 associated with SR FSS-D8 suggests Resolved This F&O is resolved.

does not look at the consideration of the time available to time available for a suppress a fire prior to target damage and The Fire PRA was first developed suppression system to specific features of physical analysis units without credit for suppression or successfully suppress and fire scenarios under analysis that might detection, the target set for a a fire before target impact suppression system activation and given scenario was based on the damage.

DRA coverage. Such consideration is not documented. Credit is taken for automatic fire suppression in some scenarios without consideration of the factors required under this SR.

Perform an analysis that considers the time available to suppress a fire prior to target ignition source type. Further in the analysis credit for the existing detection and suppression, and in some cases plant modifications, systems were credited. For these cases where the credit was taken the target set was not changed based on the time to suppression damage and the specific features of the or distance to target. Instead a PAUs and fire scenarios under analysis to conservative approach was taken FT determine what impact they have on suppression system activation and coverage.

to leave the original target set included in the Fire PRA along with the failure rate of the suppression system, therefore not requiring a review of damage time vs. suppression time. This is found in section 8.0 of Farley Fire PRA Scenario Development Notebook.

FSS-E3-01 The Farley Supporting requirement E3 asks to provide a Resolved This F&O is resolved.

documentation did not mean value of, and statistical representation address the of, the uncertainty intervals for the Although the finding still stands uncertainty related to parameters used for fire modeling the fire and the SR is met at CC I, further the use of fire scenarios. Farley performed fire size and resolution of this F&O will not heat release rate selection in accordance with impact the RICT calculations as 59 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition modeling for the fire NUREG/CR-6850 and/or applicable FAQs. the F&O pertains to a scenarios. However, the methods for developing the documentation issue. The statistical representation of the uncertainty documentation has been updated intervals and mean values currently do not to include discussions related to exist. However, this is not reported in the the uncertainty for fire modeling.

documentation. See Table D-1 of the Farley Fire PRA Summary report. The In the documentation, explain that it is associated SR was dispositioned DRA understood that methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist.

Utility Comment: This specific F&O was issued against a technical element and the indicated resolution involves a documentation as CC I which is judged to be sufficient given the two concerns noted.

clarification. This documentation clarification will be implemented.

FSS-F1-01 The exposed structural steel evaluation was not originally performed as part of the Farley Fire PRA.

FTSection 2.11 of the FNP Summary Report (FNP_Summary_Report_final.pdf) claims that, "The Structural Steel Evaluation performed to evaluate the potential for fire to impact structural steel capacity which could impact fire compartment boundaries is documented in the FNP Fire PRA Report PRA-BC-F-11-014, Rev. 0, Fire Scenarios Resolved This F&O is resolved.

A review and analysis was completed of the structures at Farley for both units to determine the amount of exposed structure steel that is susceptible to fire damage and ultimately leading to Report." This documentation was not found in a building collapse. The analysis the referenced report. concluded that there is a potential for this scenario to occur in the Include in the Fire Scenarios report the Turbine Building. This scenario structural steel evaluation identified in final has been added and is accounted Summary Report and update self- for in the total plant risk and delta assessment. risk calculations. This is found in 60 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition section 10.5 of Farley Fire PRA Scenario Development Notebook.

FSS-G6-01 The Farley Fire PRA The Multi-compartment analysis identifies Resolved This F&O is resolved.

MCA analysis was several areas where further evaluation is incomplete at the time required. This evaluation has not been The Farley Fire PRA MCA of review with many completed to either screen the zone or analysis has been completed with open items. develop a fire scenario based on multi- all scenarios being evaluated. The compartment fire. A screening of the multi- HGL/MCA report has been DRA compartment scenarios were done, those that were screened out were not included in the quantification. The multi-compartment scenarios flagged for further evaluation are in Table 3-1 of the Multi-Compartment Analysis.

Further evaluation is still being worked on, so these scenarios have not been included in quantification. Given the current CDF, the updated to show the final results for the analysis. This is found in Attachment B of PRA-BC-11-015.

MCA could increase risk above 1E-4/yr.

FSS-H1-01 Non-Fire PRA targets were removed from the database leading to inconsistencies between the scenario FT Complete the MCA to either quantify the PAUs where a fire could spread to an adjacent PAUs or screen the PAUs for MCA For fire scenarios considered during the peer review walkdown, the nature and characteristics of the damage target set were different in three different sets provided for review, including the computer printout of the Resolved This F&O is resolved.

The scenario development database has been re-populated with all target set information, development sheets fire scenario summary and two sets of targets specifically modeled in the and what was walkdown notes. One consistent set of Fire PRA and those that are not.

identified in the field. documentation should be maintained in a The scenario printout sheets retrievable format. found in Appendix A of the Fire scenario development report Include all relevant target sets in the contain all targets identified during computer-based documentation and handle the walk down phase regardless 61 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition by disposition those targets that are not risk of the relationship to Fire PRA significant for a particular scenario. components. This is found in Appendix A of Farley Fire PRA Scenario Development Notebook.

FSS-H5-01 The Farley The generic fire modeling tool referenced in Resolved This F&O is resolved.

documentation did not the Fire Scenario Report, Reference 6 address the (Hughes generic treatment) is used for Although the finding still stands uncertainty related to generic treatment of ignition sources as an and the SR is met at CC I, further the use of fire scenarios.

D modeling for the fire RA approach to bound many scenarios, but its use does not provide uncertainty treatment on a fire scenario basis.

Provide uncertainty evaluations at least generically for those scenarios that use the generic treatment tools and on a case by case basis for the sources that use additional resolution of this F&O will not impact the RICT calculations as the F&O pertains to a documentation issue. The documentation has been updated to include discussions related to the uncertainty for fire modeling in response to F&O FSS-E3-01.

detailed fire modeling to further describe the See Table D-1 of the Farley Fire scenarios used. PRA Summary report.

FT Utility Comment: This specific F&O is inconsistent with F&O FSS-E3-01. The indicated resolution for FSS-E3-01 states in part that the analysis documentation should be enhanced to note that methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist. However, F&O FSS-H5-01 then asks to undertake evaluations to address uncertainty. This latter F&O should be revised so that it is consistent with FSS-E3-01.

62 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition Response: The F&Os address the specific SR requirements. The response to F&O FSS-E3-01 may be used to justify the treatment of uncertainty for FSS but the F&O documents compliance with the standard and as such remains.

IGN-A7-02 Newly installed During the walkdown - ignition sources Resolved This F&O is resolved.

potential Ignition (specifically electrical cabinets) were found in sources were scenario development.

D identified in the field as part of the original RA the plant that is not listed on the list of ignition sources for the particular PAU. Specific that were not included examples include N1R1L0001 in the cable spreading room and N1R15A002X and N1R5A003X in the switchgear room. A walkdown and/or review of plant modification is necessary to ensure the plant FPRA reflects the as built as operated configuration.

The Farley Fire PRA has been in development for some time. The ignition source walk down and scenario development were some of the first tasks that were completed as part of this analysis.

A qualitative review of the panels identified during the peer review This issue may be due to new plant walkdown showed no significant equipment that was added after the initial change in the plant CDF. This is FT ignition frequency walkdown - nevertheless the fire PRA should be reconciled to include these new ignition sources.

based on the fire zones these panels were located in and the level of scenario development already included in these fire zones. The panels are located in a part of the room that already contains detailed scenarios and the introduction of the new sources are not expected to change the target set of adjoin scenarios.

Section 3.5 of the Summary Report, provides steps that will be taken to account for changes in the plant design that have 63 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition occurred since the initial Fire PRA development.

IGN-A7-04 The yard transformers Bins 27-29 have not been filled. Large Yard Resolved This F&O is resolved.

had been incorrectly Transformers have been incorrectly binned in binned during the Bin 23 (indoor transformers). It is clearly The Farley Fire PRA task 6 has Task 6 development stated in been updated to accurately and should be moved NUREG/CR-6850 that large yard represent the transformers to their appropriate transformers are not part of this count. As a located in the yard to their bins.

DRA result each large outdoor transformers (MT, UAT, SuT) should be binned in both Bin 27 (Yard Transformer - Catastrophic) and Bin 28 (Yard Transformer - Non Catastrophic).

Additionally, Bin 29, Transformer Yard -

Others, should also be filled.

Since Bin 23 may have been misinterpreted, applicable bins and have been removed from bin 23. The frequency per component has been updated accordingly and used for the applicable scenarios.

See Appendix C of Plant Partitioning and Fire Ignition Frequency for Farley Fire PRA, it is suggested that indoor transformers PRA-BC-F-11-009.

typically associated with essential lighting, IGN-A7-05 The Farley scenario development did not the frequency split FT etc. be looked at for applicability in the FPRA if not already evaluated. Indoor transformers over 45kVA should be included in the count for this bin.

During the walkdown of the Bravo 4160 Switchgear room, it was observed that the accurately account for Foxtrot Switchgear was split between 2 PAUs. The switchgear had a count of 15 Resolved This F&O is resolved.

The Farley Fire PRA has been updated to accurately correct the between the two fire vertical sections. PAU 335 had a count of 8 scenario development to account zones as it was switchgear vertical sections and PAU 343 for the ignition source split identified in the field. had a count of 8 vertical sections. This is a between the two fire zones of the clear example of inadequate PAU boundary. SWGR room. The ignition source count of the SWGRs has not been Recommend that the PAU such that the changed to reflect the accurate Foxtrot switchgear is contained in one PAU number of cubicles. This change 64 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition and the count of the entire switchgear should would result in a non-significant be 15 vertical sections. In cases where impact to the total plant ignition ignition sources have been split between frequency based on the total PAUs the count should be verified correct. count for Bin 15. The ignition frequency for the scenarios related to the SWGRs are accurately represented. These updates can be found in the IGN-A9-01 frequency development had D

The transient factors in the ignition RA identified fire zones PAU 2321 (Sample Panel Room) has a transient fire frequency of zero. Similar to the first page of Appendix B, a storage factor of low or 1 should be chosen such that 2321 has a non-zero transient fire frequency. Right Farley Scenario report, Appendix A, PRA-BC-F 014.

Resolved This F&O is resolved.

The transient ignition frequency allocation has been re-visited for the Farley Fire PRA based on this that had a 0 factor now 2321 has a non-zero ignition frequency finding. The appropriate changes which led to a due to a small number of cable in the area have been made to accurately frequency of 0.

FT filling Bins 11 and 12.

A non-zero transient factor should be filled in.

reflect the transient ignitions sources located within each fire zone. These updates were made in Farley Plant Partitioning and Ignition Source Task 1 and 6 report, PRA-BC-F-11-003, and carried into the ignition source calculation for the scenario development, PRA-BC-F-11-014.

PP-B3-01 The Farley Fire PRA SNOC has not provided sufficient evidence Resolved This F&O is resolved.

did not contain that Fire Zone PAUs were evaluated for fire sufficient information resistance capabilities of barriers, nor was The Farley scenario development on scenario there sufficient evidence that credited spatial report has been updated to development with separations were analyzed. Specific provide more details on the respect to the examples are cited in PRA-BC-F-11-001, scenario development based on 65 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition crediting of fire Section 2.2, for PAUs that use "natural the ignition source and target barriers. divisions." The document cites that the lack of identification process. This can be fire barriers between these PAUs will be found in the Farley Scenario evaluated during the MCA. However, the Development report, PRA-BC-F-MCA analysis appears to only discuss hot 11-014, section 3.1.1. The impact layer issues, and does not consider whether on the Hot Gas Layer and Multi-a fire propagates outside of the PAU or if Compartment Analysis has also there is a zone of influence and target been revisited to assure that the DRA damage outside of the PAU. Another example of where spatial separation is credited is Tool Room 0441.

Full room burnout scenarios are developed and quantified, but without sufficient evidence that fire barriers or spatial separation issues have been evaluated. It appears that specific boundaries of the rooms have been adequately represented in the calculation of the volumes.

PAUs are screened from having multi-compartment impacts without consideration FT of fire propagation or ZOI impact across spatial divisions.

SNOC has presented a plan to resolve the Fire Zone PAU vs. Fire Area PAU issue.

Implementation of this plan is sufficient to address the issues identified in PPB2 and PP-B3. In the plan, Fire Areas will be treated as PAUs. Particularly, SNOC staff have acknowledged that for "full burn" and "base case" fire scenarios, they will review and document the capabilities of barriers and the appropriateness of credited spatial separations, and will not inappropriately credit 66 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition barriers or spatial separations for fire scenarios. The plan includes the following:

1. Those APs that have one or more boundaries that are not physical features or are not rated fire barriers will be identified and a requirement will be added DRA to clarify that this must be recognized in the development of fire scenarios. There will be confirmation that the results of the above have been observed and documented.

2. Enhance the documentation to acknowledge the crediting of non-rated physical boundaries and provide a basis recognizing that the justification will rely on physical observations during plant FT walkdowns or through equivalent means as well as general construction methods (masonry block wall, concrete walls, etc.).

3. Address the nature and consequence of anticipated fire events for all APs for which explicit fire scenarios are not developed (base cases) and confirm that the results are appropriate given the boundaries for the AP.

4. Confirm that bounding room burn-out cases are not used for any APs that are not fully bounded by physical fire barriers, and that there is a justification for crediting those physical barriers.

67 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition

5. Confirm that the resulting analysis does not change (reduce) the level of resolution associated with the existing fire scenarios developed to support the requirements of SRs associated with FSS.

Modify the hot gas layer and multi-compartment analysis (MCA) so that any PP-C3-01 The Farley Fire PRA did not contain DRA sufficient information on scenario development with unnecessary conservatism caused by using a smaller volume artificially caused by an assumed AP boundary are removed.

Plant personnel have given verbal assurance that plant walkdowns have been performed to confirm the plant partitioning boundaries. It is reasonable to presume that the fire protection engineer would perform this walkdown task.

Resolved This F&O is resolved.

The Farley Task 1 and 6 report identifies the ignition sources identified in each fire zone. The respect to the In addition, walkdowns were performed to results of the walkdowns are input identification of fire support the Fire PRA ignition frequency task. into a database that contains the barriers.

FTFurthermore, some notes were found as further evidence that some walkdowns were performed.

However, documentation of the plant partitioning walkdown is not readily available for peer review. SR PP-C3 requires documentation of key or unique features of the partitioning elements for each physical necessary information related to Task 1 and 6. This database is considered to be the controlled copy of the results of these tasks.

These results are found in Appendix D of report PRA-BC-F-11-009. Section 3.1.1 of the Farley Scenario Report, PRA-BC-analysis unit. SR PP-B7 requires a F-11-014, describes the process confirmatory walkdown of partitioning of identifying applicable scenarios elements. based on the ignition source, surrounding targets and fire Include Plant Partitioning walkdown sheets as barriers.

part of PRA secondary documentation, and refer to the walkdown sheets in PRA-BC-F-68 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition 11-001, Farley Fire PRA Tasks 1 & 6, Plant Partitioning and Fire Ignition Frequency. In particular, fire barriers and spatial separations that are credited in fire scenarios should be validated. When where no prior documentation can be found, new walkdowns may be required.

PP-C3-02 The Farley Fire PRA did not contain development with respect to the D

sufficient information on scenario RA documentation of fire barriers.

Fire Zones are identified as Fire PRA plant analysis units in PRA-BC-F-11-00. Fire PRA staff have expressed that the Fire Areas, not Fire Zones, should be assessed as the PAUs.

However, the Fire Zone PAU form the basis for initial PAU ignition frequency, whole room burns, and initial screening in later PRA analysis Fire Zones as PAUs are used Resolved This F&O is resolved.

The Farley Fire PRA documentation has been updated to be consistent in the naming convention throughout the analysis concerning the use of PAU and fire zone. The rooms at consistently and extensively in the FPRA Farley are considered fire zones, documentation. There is a disconnect while the fire areas are FT between the PAUs defined in PRA-BC-F 00 and SNOC staff's statements of what constitutes a PAU. This adversely affected the review of the Plant Partitioning technical element. SNOC desires to call the entities that are currently described as Fire Zone PAUs as Administrative Partition, and to treat Fire considered PAUs. The Task 1 and 6report, Plant Partitioning and Ignition Frequency PRA-BC-F 009, Cable selection and Detailed Circuit Analysis PRABC-F 003, and the Farley Scenario report contain this clarification.

Areas as PAUs.

F&O PP-B3-01 identifies an acceptable plan to address the technical issues around the definition of PAUs, that Fire Areas, not Fire Zones, form the basis for PAUs. Fire Zones and similar entities will be identified as 69 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition "Administrative Partitions" (AP). Since the term "Physical Analysis Unit" or PAU is extensively in Fire PRA documentation to describe Fire Zone PAUs, all Fire PRA documents should be reviewed and revised to call these compartments Administrative Partition.

Furthermore, the term "Administrative PRM-B2-01 events finding had D

The Farley internal only been partially RA addressed in respect Partition" (AP) should be defined in the PP documentation and the APs descriptions (formally, Fire Zone PAUs), should be retained.

Internal Events PRA peer review exceptions and deficiencies have only partially been dispositioned. Table 1 of the Fire Model document (PRA-BC-F-11-004_V0a) lists Resolved This F&O is resolved.

Table 1 of Fire PRA logic Development, PRA-BC-F-11-004 to the impact on the some of the internal events findings, but not has been updated to address all Fire PRA. all. All findings included in the internal events internal events PRA findings and FT peer review must be included and disposed in the PRM notebook. Disposition of findings could not be verified. Discussion with Southern Company personnel indicated that some of the findings had not been addressed.

Expand Table 1 of the Fire Model document to include all findings. Describe the impact of their impacts on the fire PRA.

the finding on the fire PRA. For those that impact model elements applicable to the fire analysis, describe the resolution in sufficient detail to allow a reviewer to conclude the finding has been dispositioned.

PRM-C1-01 The RCP shutdown The new RCP shutdown seals are included in Resolved This F&O is resolved.

seals were not the fault tree model but are not described in 70 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition adequately discussed Appendix B. Appendix B should be revised to Fire PRA has been developed in the documentation describe these new seals and their impact on based on internal events PRA for the Fire PRA RCP seal failure flow rate. The Fire PRA model having model of RCP model development. modeling pertaining to RCP seal failure is not shutdown seal. Section 2.0, adequately described in PRA-BC-F-11-004. Appendix B of Fire PRA logic Development, PRA-BC-F-11-004 Revise Appendix B to describe the new has been updated to add RCP shutdown seals and their impact. shutdown seal modeling.

UNC-A1-01 D

The Farley fire PRA provided Train A and B CDF results but did not define total plant CDF. The parametric should be more RA uncertainty analysis specific in scope and Farley presents the CDF results in Section 3.0 of the Summary Report. The way the results are presented are as an annualize CDF for Train A operating and an annualize CDF for Train B operating and both are called total plant CDF. There is no discussion as to what these two CDF values meant or a value for the "true" plant CDF. In Appendix D of the Resolved This F&O is resolved.

Appendix D of the Farley Summary report has been updated with a revised parametric uncertainty analysis for both CDF and LERF for Train A and B individually. The quality of the use a greater Summary Report, Farley presents the results analysis was improved by sampling size. of their parametric uncertainty analysis for applying the Monte Carlo method FT CDF. Although not documented, this appears to be for CDF related to Train A Operating only. The parametric uncertainty analysis was performed using the Latin Hypercube method with only 1000 samples. The resulting curve was not well behaved and the calculated mean is well below the point estimate in Section 3.

with 50,000 samples. The resulting curves are well behaved and the calculated means show minimal difference when compared to the point estimates.

Discussion of how the total plant CDF/ LERF is calculated is also provided in the Summary Report.

This describes how the Train A As a start, Farley needs to define what the and Train B results are averaged two results, annualize CDF for Train A together to obtain the total plant operating and an annualize CDF for Train B CDF/LERF.

operating, mean and a single total Plant CDF needs to be presented. This will probably be the average of the original two values. For the 71 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O # Topic Finding Description Status Disposition uncertainty analysis, Farley needs to document what is covered by the analysis, Train A results, Train B results or both. Farley did run an uncertainty case using 10,000 samples and the results seemed to be better behaved. Farley is running an uncertainty case with 50,000 samples which is consistent with their FPIE PRA process. The results of UNC-A1-02 The Farley DRA this analysis should be presented in Appendix D in the Summary Report instead of the current analysis.

Farley did quantify the fire-related LERF for documentation did not Unit 1 but failed to meet the requirements adequately address the review of LERF scenarios in the from LE-F2 and LE-F3 from Section 2 which require that "REVIEW contributors for reasonableness (e.g., to assure excessive Resolved This F&O is resolved.

The Farley Summary report has been updated to reflect the insights by reviewing the top analysis to show that conservatisms have not skewed the results, contributors for LERF. This the appropriate level of plant-specificity is appropriate for describes the fire induced impacts reviews had been completed.

FT significant contributors, etc.)" and "IDENTIFY and characterize the LERF sources of model uncertainty and related assumptions in a manner consistent with the applicable requirements of Tables 2-2.7-2(d) and 2-2.7-2(e)." As discussed in F&O FQ-D1-01, the calculated LERF and CCFP indicate that there some potential issues with the LERF as well as the random failures.

The resolution of this finding is found in Appendix C of Farley Fire PRA Summary Report.

calculation.

See F&O FQ-D1-01 (F) and perform the reasonableness reviews after requantifying.

72 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 5.0 General Conclusions Regarding PRA Capability The information provided in this enclosure demonstrates that the FNP at-power internal events PRA model (including flooding) and the fire PRA model conform to the standard at CC-II which satisfies the guidance of RG 1.200, Revision 2. In addition, the FNP PRA model complies with all requirements for technical adequacy of the baseline PRA as defined in NEI 06-09 (Reference

1) as clarified by the NRC final safety evaluation of this report (Reference 2).

The FNP internal events PRA model (including flooding) and the FNP fire PRA model technical capability evaluations described above provide a robust basis for concluding that the PRA models are suitable for use in supporting the License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines".

6.0 References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines",

D Revision 0-A, October 2012, (ADAMS Accession No. ML12286A322.

2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical RA Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'

dated May 17, 2007 (ADAMS Accession No. ML071200238

3. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", Revision 2, March 2009.

4. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of 2007.

FT Probabilistic Risk Assessment Results for Risk-Informed Activities", Revision 1, January

5. Regulatory Guide 1.200, An Approach for Determining Technical Adequacy of PRA Results for Risk-Informed Activities, For Trial Use, USNRC, February 2004.

6. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

7. ASME RA-Sc-2007, ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications", Addenda to ASME RA-S-2002, ASME, New York, NY, August 31, 2007.

8. ASME RA-SB-2005, Addenda to ASME RA-S-2002 Standard for PRA for Nuclear power Plant Applications, American Society of Mechanical Engineers, New York, NY, December 2005.

9. ASME RA-Sa-2003, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, April 2002 and Addenda to Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers 2003.

10. NEI-00-02, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, 2000.

73 to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

11. LTR-RAM-II-10-015, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Farley Nuclear Power Plant Probabilistic Risk Assessment, May 2010.

12. LTR-RAM-II-12-007, Fire PRA Peer Review of the Farley Nuclear Plant Fire Probabilistic Risk Assessment Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard, March 2012.

13. NEI 05-04, Process for Performing PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Revision 2, September 2008.

14. NUREG/CR-6928 / INL/EXT-06-11119, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, February 2007.

DRA FT 74

Farley Nuclear Plant - Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines DRA Enclosure 3 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Model FT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table of Contents Section Page Introduction .................................................................................................................................. 3 Scope .......................................................................................................................................... 3 Technical Approach ..................................................................................................................... 4 References .................................................................................................................................. 8 Attachment 1: Seismic Bounding Analysis .................................................................................. 9 Estimate Bounding CDF ................................................................................................... 9 Evaluate Potential Risk Increases Due to Out of Service Equipment .............................. 10 D

Evaluate Bounding LERF Contribution ........................................................................... 10 Conclusion ..................................................................................................................... 11 RA References ..................................................................................................................... 11 Attachment 2: Evaluation of External Event Challenges and IPEEE Update Results ................ 13 Conclusions .................................................................................................................... 25 FT References ..................................................................................................................... 25 E3-2 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Introduction Topical Report NEI 06-09, Revision 0-A (Reference 1), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference 2), requires that the License Amendment Request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on their insignificance to the calculation of configuration risk as well as discuss conservative or bounding analyses applied to the configuration risk calculation.

This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources. This enclosure also provides the Farley Nuclear Plant (FNP) specific results of the application of the generic methodology and the disposition of impacts on the FNP Risk Informed Completion Time (RICT) Program. to this enclosure presents the plant-specific bounding analysis of seismic risk to FNP. Attachment 2 to this enclosure presents the justification for excluding analyses of other external hazards from the FNP PRA.

Scope D

Topical Report NEI 06-09, Revision 0-A (Reference 1) and the associated Pressurized Water Reactor (PWR) Owners Group (PWROG) guidance (Reference 3) do not provide a specific list RA of hazards to be considered in a RICT Program. However, non-mandatory Appendix 6-A in the ASME/ANS PRA Standard (Reference 4) provides a guide for identification of most of the possible external events for a plant site. This information was reviewed for the Farley site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The data in the UFSAR (Reference 7) regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well FT as present and projected industrial activities (e.g., increases in the number of flights, construction of new industrial facilities) in the vicinity of the plant were also reviewed for this purpose. No new site-specific and plant-unique external hazards were identified through this review and associated plant visit.

Table E3.1 Minimum Scope of External Hazards to be considered

• Seismic Events

• Accidental Aircraft Impact

• External Flooding including Intense Local Precipitation

• Extreme Winds and Tornadoes (including generated missiles)

• Turbine Generated Missiles

• External Fires

• Accidents from Nearby Facilities

• Release of Chemicals Stored at the Site

• Transportation Accidents

• Pipeline Accidents (e.g., natural gas)

E3-3 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models The scope of this enclosure is consideration of the above hazards for FNP. Seismic events in particular are considered in Attachment 1, and the other listed external hazards are considered in Attachment 2.

Technical Approach The guidance contained in NEI 06-09 states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCOs) selected to be part of the RICT Program. The process includes the ability to address external hazards by 1) Screening the hazard based on a low frequency of occurrence, 2) Bounding the potential impact and including it in the decision-making or 3) Developing a PRA model to be used in the RMAT/RICT calculation.

The overall process for addressing external hazards is shown in Figure E3.1, below, where D

each hazard identified in Table E3.1, above, is addressed individually.

The process considers two aspects of the external hazard contribution to risk. The first is the contribution from the occurrence of beyond design basis conditions, e.g., winds greater than RA design, seismic events greater than design-basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant. The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power, etc.

While the plant design basis assures that the safety related equipment necessary to respond FT to these challenges are protected, the occurrence of these conditions nevertheless cause a demand on these systems that in and of itself presents a risk.

Step 1 - Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. As noted in Regulatory Guide 1.200 (Reference 8), the fundamental criteria that have been recognized for screening-out events are the following: an event can be screened out if either (1) it meets the criteria in the NRCs 1975 Standard Review Plan (SRP) or a later revision (Reference 5); or (2) if it can be shown using a demonstrably conservative analysis that the mean value of conditional core damage probability is less than 10-1, given the occurrence of the design-basis-hazard event; or (3) if it can be shown using a demonstrably conservative analysis that the CDF is less than 1E-06 per year. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. Sometimes, the bounding CCDP is conservatively assumed to be 1.0. For FNP, however, bounding CDF values are estimated in Attachments 1 and 2, without the estimation of CCDP.

If the bounding CDF for the hazard can be shown to be less than 1E-6/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program. The basis for this is as follows:

E3-4 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models

• The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-5.

• The maximum time interval allowed for this RICT is 30 days.

• If the maximum CDF contribution from a hazard is <1E-6/yr, then the maximum ICDP from the hazard is <1E-7 (1E-6/yr

• 30 days/365 days/yr).

• Thus, the bounding ICDP contribution from the hazard is shown to be less than 1%

of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

DRA FT Figure E3.1 Process for Addressing External Hazards in RICT Program E3-5 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using this approach, some external hazards can cause a plant challenge, even for hazard severities that are less than the design basis limit. These considerations are addressed in Step 3 of the process.

There is one other important consideration for screened hazards that must be addressed within the RICT Program. This consideration relates to maintaining the boundary conditions of the base risk analysis. The screening process described above assumes that the capability of the plant to withstand the hazard is consistent with the design assumptions. In some cases, plant activities can change this assumption. Some examples are shown below:

• Removal of a toxic gas monitor from service on the control room heating, ventilation and air conditioning (HVAC) system can impact the ability of the plant systems and operators to respond to a toxic gas release. For FNP, the Control Room Emergency Filtration/Pressurization System is excluded from the RICT Program; therefore, this D

boundary condition is not applicable.

Removal of a tornado missile or flood barrier from service in order to support a maintenance activity can degrade the capability of the plant to respond to such hazards, RA if the removal of the barrier reduces the protection of equipment that is expected to be available. That is, if the barrier only protects equipment that is considered out of service under the RICT Program, there is no need to address this further, but if other equipment that is intended to be available could be impacted, the basis for the screening of the hazard becomes invalid. For FNP, as a precondition to entering a RICT, plant procedures assure that if the design basis assumptions applicable to a hazard are FT temporarily not applicable (for example, barrier degradation), which may increase the likelihood of a plant challenge from loss of equipment that is not considered out of service within the RICT Program, appropriate compensatory measures are implemented to accomplish the following:

o o

Compensate for loss of protection; or An incremental CDF/Large Early Release Frequency (LERF) equal to the applicable hazard frequency for all impacted equipment will be added to the incremental CDF/LERF resulting from the unavailability of structures, systems, and components (SSCs) attributed to the LCO Condition for which a RICT is calculated.

Step 2 - Hazard Analysis There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-6/yr. Such hazards are generally those with relatively larger frequencies of beyond design basis conditions, such as seismic events. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard. The basic approach to computing a bounding CDF is as follows:

E3-6 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Estimate Bounding CDF This approach is described in Attachment 1 of this Enclosure for the seismic hazard.

Evaluate Potential Risk Increases Due to Out of Service Equipment Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out of service equipment. For FNP, as discussed in Attachment 1, the only beyond design basis hazard that could not be screened out is the seismic hazard, and as demonstrated in Attachment 1, with the approach used the change in risk with equipment out of service cannot be higher than the bounding seismic CDF (SCDF).

Evaluate Bounding LERF Contribution The RICT Program requires addressing both core damage and large early release risk.

D When a comprehensive PRA does not exist, the LERF considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner RA or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as described in Attachment 1 of this Enclosure.

Step 3 - Risks from Hazard Challenges FT Steps 1 and 2 address the direct risks from damage to the facility from external hazards.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using Steps 1 and 2 without a full PRA, there are risks that may be unaccounted for. These risks are related to the fact that some external hazards can cause a plant challenge, even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events can cause extended loss of offsite power conditions below design basis levels. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms.

The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or they are not significant to risk. to this enclosure provides an analysis using Steps 1 and 2 for the FNP site with respect to the beyond design basis seismic hazard. Attachment 2 to this enclosure provides an analysis of the representative external hazards for the FNP site, as discussed in Step 3.

E3-7 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models References

1. Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk- Managed Technical Specifications (RMTS)

Guidelines, Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322.

2. ML071200238, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), Letter from Jennifer M.

Golder (NRR) to Biff Bradley (NEI), May 17, 2007.

3. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk Informed Completion Time and Risk Managed Action Time for RITSTF Initiative 4B, August 2010.

4. American Society of Mechanical Engineers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic D

Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.

RA

5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975.

6. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

7. Joseph M. Farley Nuclear Plant Units 1 and 2 UFSAR, Rev 28 December 2017 FT

8. Regulatory Guide 1.200, An Approach For Determining The Technical Adequacy Of Probabilistic Risk Assessment Results For Risk-Informed Activities, Revision 2, U.S.

Nuclear Regulatory Commission, March 2009 E3-8 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Attachment 1: Seismic Bounding Analysis The purpose of this attachment is to present the analysis that bounds the potential seismic impact and include it in the decision-making process (Step 2 from Figure E3.1), as a seismic PRA is not available for FNP. The process for analyzing an unscreened external hazard without the use of a full PRA involves the following three steps:

1. Estimate Bounding CDF

2. Evaluate Potential Risk Increases Due to Out of Service Equipment

3. Evaluate Bounding LERF Contribution D

Estimate Bounding CDF RA A seismic margin assessment (SMA) was developed for the FNP Individual Plant Examination for External Events (IPEEE) (Reference A.1-1). Thus, there is not a current estimate of seismic core damage frequency (SCDF), so an alternative approach is taken to develop an SCDF estimate. This approach uses the current FNP seismic hazard curve and a limiting seismic capacity of a component whose seismic failure would lead directly to core damage as identified in the SMA. In this approach, a plant level high confidence of low probability of failure (HCLPF) seismic capacity corresponding to the limiting HCLPF component is used to determine the FT failure probabilities as a function of seismic hazard level, and these are convolved with the seismic hazard curve. This is a commonly used approach to estimate SCDF when a seismic PRA is not available. This approach is consistent with approaches that have been used in other regulatory applications (e.g., Reference A.1-4).

The seismic hazard for the FNP site was evaluated in 2013 (Reference A.1-2) and provided to NRC (Reference A.1-3). The FNP IPEEE (Reference A.1-1) was a limited scope seismic margins assessment performed relative to a review level earthquake (RLE) of 0.1g PGA (peak ground acceleration), and established that the corresponding HCLPF for equipment required for response to the RLE is a HCLPF of 0.1g referenced to peak ground acceleration (PGA),

which corresponds to a spectral frequency of 100 Hz. The HCLPF can also be scaled to other spectral frequencies, based on the reference level earthquake used in the SMA. The PGA is generally used as the convolution acceleration for most seismic PRAs, including other SPRAs performed by SNC. However, because this seismic risk estimation is based on the overall plant-level HCLPF, the controlling seismic failures would be unknown. Based on judgment from the recent seismic walkdowns, the seismic risk for FNP could be sensitive to the natural frequency of the service water pond dike/dam, or to electrical cabinets and equipment.

The natural frequencies of these items range from about 2.2 Hz to 8 Hz. Therefore, the FNP plant level fragility is estimated for the PGA (100Hz) and for the 2.5, 5 and 10 Hz spectral hazard curves. That is, four convolutions hazard frequency and HCLPF are performed, one for each spectral frequency. The average of these four results is then used to estimate the seismic risk. Note that the HCLPF is judged to be very conservative for FNP based on the following:

E3-9 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models

• Detailed seismic walkdowns of the FNP structures and equipment have recently been performed for a future seismic PRA. The results of these walkdowns show that virtually all of the equipment reviewed has much higher seismic capacity than 0.1g.

• Other Westinghouse PWRs with equipment similar to FNP have HCLPFs closer to 0.3g.

Therefore, it is judged that there is significant conservatism in using the IPEEE HCLPF of 0.1g for the estimation of the FNP plant seismic fragility.

Calculation of the SCDF in this manner also requires definition of uncertainty parameters for seismic capacity. The uncertainty parameter for seismic capacity is represented by a combined beta factor (c) of 0.4. This is a commonly-accepted approximation, and is consistent with the value used in other regulatory applications (e.g., Reference A.1-4). Using the above inputs, the total estimated FNP SCDF is determined to be 4.51E-6 (Reference A.1-7).

Therefore, a RICT bounding value of 4.51E-6 will be used as the estimate of SCDF (ICDFseismic) for the LAR submittal RICT calculations.

D Evaluate Potential Risk Increases Due to Out of Service Equipment RA The approach taken in the computation of SCDF in Reference A.1-5 assumes that the SCDF can be based on the likelihood that a single seismic-induced failure leads to core damage. This approach is bounding and implicitly relies on the assumption that seismic-induced failures of equipment show a high degree of correlation (i.e., if one SSC fails, all similar SSCs will also fail). This assumption is conservative, but direct use of this assumption in evaluating the risk increase from out of service equipment could lead to an underestimation of the change in risk.

FT However, if one were to assume no correlation at all in the seismic failures, then the seismic risk would be lower than the risk predicted by a fully correlated model, but the change in risk using the un-correlated model with a redundant piece of important equipment out of service would be equivalent to the level predicted by the correlated model.

If the industry accepted approach (Reference A.1-5) of correlation is assumed, the conditional core damage frequency given a seismic event will remain unaltered whether equipment is out of service or not. Thus, the risk increase due to out of service equipment cannot be greater than the total SCDF estimated by the bounding method used in Reference A.1-5. That is, for the FNP site, the delta SCDF from equipment out of service cannot be greater than 4.51E-6/yr.

Evaluate Bounding LERF Contribution A review of plant specific and generic information on LERF contributors for internal events and seismic events was performed. For internal events, LERF is typically associated with the Interfacing System Loss of Coolant Accidents (ISLOCAs), Steam Generator Tube Ruptures (SGTR), and failures of containment isolation. Based on several recent PWR SPRAs, the tubes of the steam generators are judged to not be vulnerable to seismic events based on their ductile materials. Also, ISLOCA has not been found to be a significant contributor to LERF for SPRAs. That is, the usual failures leading to ISLOCA are failures of valve and check valve internals. For seismic events, valves are found to have high seismic capacity, so these failure modes are not contributors to seismic LERF. However, failure of containment isolation has been identified by SPRAs as a contributor to seismic LERF.

E3-10 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Seismic PRAs have generally found that structural failures and failure of containment isolation are the significant contributors to seismic LERF. At FNP, the Category I structures have high seismic capacity based on the initial work for the future SPRA. Therefore, seismic failure of containment isolation is judged to be the most significant contributor to SLERF.

While seismic failures of containment isolation have some degree of correlation with seismic CDF failures, a large majority of the potential failures, such as valves, would be significantly uncorrelated with the dominant seismic CDF failures. Therefore, the seismic fragility for containment isolation failure (which is based on the same conservative HCLPF for CDF) can be convolved with the seismic CDF fragility in order to estimate the seismic LERF. That is, the SLERF is estimated by the convolution of the seismic hazard with the core damage fragility and the LERF fragility, for each of the four spectral frequencies noted in the SCDF discussion, and averaged over the resulting values. Using the above inputs, the total estimated FNP SLERF is determined to be 2.07E-6 (Reference A.1-7).

Therefore, a RICT penalty of 2.07E-6 will be used as the bounding estimate of SLERF D

(ILERFseismic) for the LAR submittal RICT calculations.

Conclusion RA The above analysis provides the technical basis for addressing the seismic-induced core damage risk for FNP by reducing the ICDP/ILERP criteria to account for a bounding estimate of the configuration risks due to seismic events.

The RICT and RMAT calculations are based on the technical basis provided above.

FT The actual RICT and RMAT calculations performed by the CRMP tool are based on adding an incremental 4.51E-6/year and 2.07E-6/year seismic contribution to the configuration-specific delta CDF/delta LERF attributed to internal and fire events contributions. Thus, any change in risk due to the seismic contribution from the un-modelled seismic scenarios is accounted for by adding a permanent seismic contribution of 4.51E-6/2.07E-6 to the CRMP logic model that is used to quantify instantaneous CDF/LERF whenever a RICT is in effect. This method ensures that an incremental seismic CDF/LERF equal to the bounding SCDF/SLERF is added to internal and fire events incremental CDF/LERF contribution for every RICT occurrence.

The ICDP/ILERP acceptance criteria of 1E-5/1E-6 are used within the CRMP framework to calculate the resulting RICT and RMAT based on the total configuration-specific delta CDF/LERF accounting for internal events, fire and seismic CDF/LERF contributions.

References A.1-1. Alabama Power Company, Farley Nuclear Plant, Units 1 and 2, Individual Plant Examination of External Events, June 1995.

A.1-2. Lettis Consultants International (LCI), Inc., Farley Seismic Hazard and Screening Report, LCI Project 1041, Rev. 1, October 30, 2013.

E3-11 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models A.1-3 Alabama Power Company, Joseph M. Farley Nuclear Plant - Units 1 and 2 Seismic Hazard and Screening Report for CEUS Sites, NL-14-0342, March 31, 2014.

A.1-4. Generic Issue 199, Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, IN2010-18, September 2, 2010.

A.1-5. Staff Report, Implications of Updated Probabilistic Seismic Hazard Estimates In Central And Eastern United States On Existing Plants, Safety/Risk Assessment, ML100270639, August 2010.

A.1-6. Southern Nuclear Co., FNP Level 1 and 2 PRA Model Revision 9 - at power, internal events, Calculation No. PRA-BC-F-14-001 Farley IE Model Rev 9 Ver 3, January 9, 2014.

A.1-7 Southern Nuclear Co., Seismic Risk Evaluation based on IPEEE and EPRI 2014 Farley Seismic Hazard, PRA-BC-F-17-002, September 28, 2017.

DRA FT E3-12 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Attachment 2: Evaluation of External Event Challenges and IPEEE Update Results As shown in Figure E3.1, there are three parts to the process for addressing external hazards for the RICT Program. Step 2 of the process addresses beyond design basis hazards that were not screened out in Step 1. As shown in Enclosure 3 Attachment 1, a bounding analysis approach was used to address the impact of seismic risk on RICT Program calculations. As such, the primary purpose of this attachment is to address Step 3 of the process from Figure E3.1.

As described in this enclosure, the incremental risk associated with challenges to the facility that do not exceed the design capacity must be accounted for. This attachment also provides results of the hazard screening performed as part of Step 1 of the process from Figure E3.1.

Seismic is the only hazard that was not screened out from Step 2 in Step 1.

Step 1 Hazard Screening Except Seismic Events D

The FNP IPEEE for Units 1 and 2 (Reference. A.2-1) provides an assessment of the vulnerability of the site to these hazards. The FNP IPEEE external hazard screening evaluation was updated to support this LAR. The updated evaluation of other external RA hazards for FNP Units 1 and 2 (Reference A.2-2) provides an assessment of the vulnerability of the site to these hazards. In general, the FNP site screened these external hazards based on Table 10-1 of NUREG/CR-2300, PRA Procedures Guide (Reference A.2-13), and performed a bounding evaluation (Reference A.2-2) for those hazards not subject to screening (aircraft impact, extreme winds and tornadoes, external flooding including intense local precipitation, industrial and military facility accidents, pipeline accidents, FT transportation accidents, and turbine-generated missiles). The bounding evaluation determined that the bounding CDF for beyond design basis conditions is less than 1E-6 per year. Table E3.A2.1 presents the results of the updated IPEEE analysis.

This screening and bounding evaluation assures that safety related equipment is not affected from beyond design basis events other than seismically induced impacts, which are evaluated in Attachment 1 of this Enclosure.

Step 2 Risks from Hazard Challenges Except Seismic Events Table E3.A2.1 reviews the bases for the evaluation of these hazards, identifies any challenges posed, and identifies any additional treatment of these challenges, if required.

The conclusions of the assessment, as documented in Table E3.A2.1, assures that the hazard either does not present a design-basis challenge to FNP, or is adequately addressed in the PRA.

E3-13 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Seismic Events Seismic events treated using a bounding Seismically induced loss of Addressed as part of internal approach with change to RICT Program offsite power (LOSP) is a events treatment of LOSP.

criteria (see Attachment 1 to this enclosure). challenge within the design basis.

Accidental Aircraft There are no airports within 10 miles of the Aircraft impact induced LOSP is Projected air traffic does not pose a Impacts plant. There are no military facilities or a potential challenge within the credible challenge to FNP.

military training routes close to the plant. design basis.

conclusion.

D Aircraft hazard is not a design basis hazard event for the plant and the UFSAR (Reference A.2-3) using the most recent data confirms this RA As a result, beyond design basis challenges from accidental aircraft impacts are screened out. (Reference A.2-2)

The likelihood of damage causing a LOSP is judged to be sufficiently small that it will not significantly impact the RICT Program calculations and it can be excluded from RICT Program evaluation.

Avalanche Topography is such that no avalanche is Impact of cascade of snow or The effect of an avalanche does not possible as plant is not located near large rock would be damage to the pose a credible risk to FNP.

Biological Event prevalent.

FT mountains where snow avalanches are The accumulation or deposition of vegetation or organisms (e.g. zebra mussels, clams, fish) on an intake structure or internal to a system that uses an intake structure would not occur as the Chattahoochee River is not the Ultimate Heat Sink (UHS) for FNP. The Service exterior structure There are no challenges presented to the FNP site from biological events.

Excluded from RICT Program evaluation.

Water Storage Pond provides this service.

As this is slow to develop, there would be adequate warning for these events.

Coastal Erosion FNP is a riverine site located inland. There are no challenges Excluded from RICT Program presented to the FNP site from evaluation.

coastal erosion.

Drought Drought is a slowly developing hazard. The There are no challenges Excluded from RICT Program plant location (riverine site with upstream presented to the FNP site from evaluation.

dams: Walter F. George Dam and coastal erosion.

Columbia Lock and Dam; and downstream to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program dam, Jim Woodruff Dam) precludes impact on FNP.

External Flooding The external flooding hazard at the site Weather induced Loss of Offsite The combined effects of river was recently updated as a result of the Power (LOSP) is a potential flooding will not challenge the post-Fukushima 50.54(f) Request for challenge, e.g., Flood induced plant due to the VBS and site Information. The flood hazard reevaluation loss of Emergency AC power, grade. LIP will be addressed by report (FHRR) was submitted to NRC for Aux. Feedwater (TDAFW several modifications as a result review on October 20, 2015 (Reference Pump), Low Pressure/Decay of the Mitigating Strategies D

A.2-4). The NRC concluded in (Reference A.2-5) that the reevaluated flood hazards information in (Reference A.2-4) is suitable for the assessment of mitigating strategies RA (i.e., defines the mitigating strategies flood hazard information described in guidance documents currently being finalized by the industry and NRC staff) for Farley. Further, the NRC staff has concluded that the Heat Removal pumps, and High Pressure/Makeup Pumps.

Assessment (MSA) in response to NRC Order EA-12-049, "Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (ADAMS Accession No. ML12054A735).

These modifications include building protection curbs around several key doors to keep flood reevaluated flood hazard information is a waters from entering the building suitable input for other assessments housing Key SSCs and FLEX FT associated with Near-Term Task Force Recommendation 2.1 "Flooding."

The results in (Reference A.2-4) indicate that the frequency of a local intense precipitation (LIP) event capable of producing flood magnitudes reported in the FHRR is estimated to be well below 10-6/yr.

The second mechanism evaluated in the equipment. Therefore, FLEX will be able to cope with the reevaluated flood hazard, and the modifications will provide protection for Key SSCs to maintain Key Safety Functions (KSFs) throughout the flooding event. Given the extremely low FHRR is combined events river flooding likelihood of an LIP event and the that is primarily caused by a probable ability of FLEX to cope with the maximum precipitation (PMP) event and reevaluated flood hazard, the risk wind-wave action. However, this from an LIP event is sufficiently mechanism is estimated to produce a low enough to not warrant further maximum flood elevation that will not top analysis.

the vehicle barrier system (VBS) surrounding the site. Although wind-wave action may produce sloshing over the VBS, the volume expected due to sloshing will to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program not challenge site grade or any plant SSCs.

Extreme Winds FNP has been designed for extreme Loss of offsite power from Weather-related LOSP and and Tornados winds and tornado loadings that are extreme winds & tornados is a recovery are included in data (including substantially higher than the design basis potential challenge within the used for internal events PRA generated events presently required. Most of the design basis. (Reference A.2-6). No further missiles) safety related structures, systems and analysis required.

D components (SSCs) are protected from tornado missiles using barriers with thicknesses exceeding the current requirements based on recent tornado RA hazard analysis. Detailed tornado missile risk analysis has shown that the frequency of missile damage to target groups is less than 7x10-7 per year per unit, which is less than the screening The site is currently evaluating tornado missiles in response to RIS 15-06. Tornado missile protection (TMP) vulnerabilities are in the process of being evaluated for risk impact.

Results of the TMP evaluation will be reflected in the extreme winds and tornados screening evaluation.

criterion of 1E-6 per year (Reference A.2-2). On that basis, beyond design basis Fog FT challenges from extreme winds &

tornados are screened out.

Water droplets suspended in the atmosphere at or near the Earths surface that limit visibility affect the frequency of occurrence of other hazards (e.g. highway accidents, aircraft landing and take-off accidents) and is indirectly considered.

There are no challenges presented to the FNP site from fog.

Excluded from RICT Program evaluation.

Fog has a rare occurrence in the site region. Section 2.3.2.2 of UFSAR states that visibility of less than 1/4 mile occurs less than 1.3 percent of the time.

Frost Snow and Ice govern this risk. There are no challenges Excluded from RICT Program presented to the FNP site evaluation.

from frost.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Hail Showery precipitation in the form of irregular There are no challenges Excluded from RICT Program pellets or balls of ice may occur. presented to the FNP site evaluation.

from hail.

Hail may occur but there are no openings in the walls or roofs of safety related buildings through which hail may enter and damage essential equipment. Tornado missile protection features, structural walls and roods High Summer Temperature D

are adequate to withstand the impact of hail.

The highest recorded temperature at Dothan Airport was 108°F. The HVAC systems are RA designed to maintain prescribed building temperatures during outside temperature variations between 20°F and 95°F. Even if the maximum temperature exceeds the design limits for HVAC systems, such exceedance There are no challenges presented to the FNP site from high summer temperature.

Excluded from RICT Program evaluation.

lasts only for a brief period and, given the thermal inertia of the concrete structures where High Tide, Lake Level or River Stage Hurricane have any impact.

FT safety-related equipment are located, will not This event is of negligible impact on plant. The plant location (riverine with upstream and downstream dams) preclude impact on plant due to this hazard. See External Flooding discussion for more information.

FNP is not on the coast and hurricane wind effects are bounded by extreme winds and There are no challenges presented to the FNP site from high tide, lake level, or river stage.

See extreme winds and tornados.

Excluded from RICT Program evaluation.

See extreme winds and tornados.

tornados assessment.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Ice Cover Accumulation of frozen water on bodies of There are no challenges Excluded from RICT Program water (e.g. rivers) or on structures, systems presented to the FNP site evaluation.

and components. from ice cover.

Icing does not normally occur on the Chattahoochee River at FNP. The only incidence of icing occurred in 1961 along the banks in slack water areas. No record of the D

river being iced over at this location has been found. Therefore, there would be no interference with the flow of water into the river water intake due to ice. Even if the surface did RA become frozen there would be no interference with withdrawal of water by the river water intake due to depth of water in the river (UFSAR Section 2.4.7).

Turbine- The probabilistic analysis performed for failures Loss of offsite power from The likelihood of damage causing a Generated of turbines in Units 1 & 2 shows the probability turbine missiles is a potential LOSP is judged to be sufficiently Missiles FT of turbine missile damage is less than the NRC accepted value (per RG 1.115, Reference A.2-

12) of 1x10-7 per year. To further reduce the probability of turbine failure, FNP has adopted a rigorous maintenance program.

Therefore, given the worst case probability of turbine missile damage of 1E-7 the bounding CDF assuming a CCDP of 1.0 is less than challenge within the design basis.

small that it will not significantly impact the RICT Program calculations and it can be excluded from RICT Program evaluation.

1E-6 per year. (Reference A.2-2)

Beyond design basis challenges from turbine-generated missiles are screened out.

Internal Fires FNP Internal Fire model addresses risk from Internal Fire impacts are Internal Fire impacts are evaluated internal fires. evaluated in the internal Fire in the internal Fire PRA.

PRA.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Internal FNP Internal events and internal flooding Internal Flooding impacts are Internal Flooding impacts are Flooding model addresses risk from internal flooding evaluated in the internal evaluated in the internal flooding events. flooding PRA. PRA.

Landslide FNPs location prevents landslides from There are no challenges Excluded from RICT Program Lightning D

occurring as there are no steep hills.

Lightning strikes are not uncommon in nuclear plant experience. They can result in losses of RA off-site power or surges in instrumentation output if grounding is not fully effective. The latter events often lead to reactor trips.

This was considered in plant design.

presented to the FNP site from landslide.

There are no challenges presented to the FNP site from lightning.

evaluation.

Excluded from RICT Program evaluation.

Low Lake A decrease in the water level of the lake or There are no challenges Excluded from RICT Program Level or river does not impact FNP. presented to the FNP site evaluation.

River Stage FT A decrease in the water level of the lake or river does not impact FNP as FNP does not rely on Chattahoochee River for the UHS since the storage pond provides the necessary UHS requirements.

from low lake level or river stage.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Low Winter The lowest recorded temperature at Dothan There are no challenges Excluded from RICT Program Temperature Airport was 5°F; the plant design basis is 17°F. presented to the FNP site evaluation.

The HVAC systems are designed to maintain from low winter temperature.

prescribed building temperatures during outside temperature variations between 20°F and 95°F. Even if the minimum temperature exceeds the design limits for HVAC systems, such exceedance lasts only for a brief period Meteorite or Satellite Impact D

and, given the thermal inertia of the concrete structures where safety-related equipment are located, will not have any impact. Therefore, the temperatures inside the plant buildings are RA expected to be higher than 17°F.

A meteoroid or artificial satellite that releases energy due to its disintegration in the atmosphere above the Earths surface, direct There are no challenges presented to the FNP site from meteorite or satellite Excluded from RICT Program evaluation.

impact with the Earths surface, or a impact.

combination of these effects. This hazard is of Forest or Range Fires FT negligible likelihood of impact to the site (very low event probability).

Fires at nearby facilities, onsite chemical storage, nearby transportation routes, or pipelines are addressed within those external hazard categories. For forest fires, UFSAR Sec 2.3.6 (Reference A.2-3) states that wooded areas are sufficiently far from the plant There are no challenges presented to the FNP site from forest fires.

Excluded from RICT Program evaluation.

structures that brush and forest fires do not present a hazard. (Reference A.2-2)

Industrial or Military No military bases or firing ranges, oil There are no challenges Excluded from RICT Program Facility Accident pipelines, or tank farms are located within a presented to the FNP site evaluation.

10-mile radius of the plant site. Therefore, from accidents at nearby the hazards from industrial and military facilities.

facility accidents are screened out from FNP PRA. (Reference A.2-2) to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Release of Chemicals stored near FNP have been There are no challenges Excluded from RICT Program Chemicals in Onsite evaluated annually since the OL issuance presented to the FNP site from evaluation.

Storage (Reference A.2-2). Procedures are in place to chemicals stored onsite.

assess the impact of any new chemical procured for plant operations on control room habitability based on the toxicity limits given in RG 1.78 (Reference A.2-7). Based on the evaluations reported in the UFSAR (Reference River Diversion D

A.2-3) on storage and handling of toxic chemicals near the site, this hazard group does not pose a credible threat to FNP Units 1

& 2. (Reference A.2-2)

RA UFSAR Section 2.4.9 states that the river upstream from the site does not have sufficiently high banks to cause a potential diversion of the river and bypass of the There are no challenges presented to the FNP site from river diversion.

Excluded from RICT Program evaluation.

intake structure. With Lake Seminole varying between el 76 ft MSL and 78 ft MSL, Sand or Dust Storm FT a temporary blockage of the river upstream from FNP would not seriously affect the quantity of water available to the river water intake. Even if the river was temporarily blocked, cooling water could be obtained from the storage pond.

A strong wind storm with airborne particles of sand and dust is not relevant for this region.

There are no challenges presented to the FNP site from sand or dust storms Excluded from RICT Program evaluation.

Seiche This is an oscillation of the surface of a There are no challenges Excluded from RICT Program landlocked body of water that can vary in presented to the FNP site from evaluation.

period from minutes to several hours; seiche.

however, there is no large body of water close to the site for this event.

Snow The 100 year snow load is estimated as 10 There are no challenges Excluded from RICT Program psf. The design basis roof live load for presented to the FNP site from evaluation.

seismic Category I structures is at least 20 snow.

psf.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Soil Shrink-Swell The relative change in volume of the soil as There are no challenges Excluded from RICT Program Consolidation a result of the type of soil and the amount of presented to the FNP site from evaluation.

moisture. This is slow to develop and soil shrink-swell consolidation.

procedures are in place to monitor differential settlement (UFSAR Section 2B.7.3.1)

Storm Surge FNP is located inland and is not affected by There are no challenges Excluded from RICT Program storm surge. presented to the FNP site from evaluation.

Toxic Gas Transportation accident D

Toxic gas is covered under release of chemicals in onsite storage, industrial or RA military facility accident, and transportation Analysis of postulated accidents on nearby storm surge.

Toxic gas is covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident There are no challenges Toxic gas is covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident Excluded from RICT Program Accidents transportation routes has shown (Reference presented to the FNP site from evaluation.

A.2-2) that they do not pose a credible threat transportation accidents.

Pipeline Accidents (e.g., natural gas)

A.2-8).

FT to FNP since these routes are farther than the safe distances specified in RG 1.78 (Reference A.2-7) and RG 1.91 (Reference A 6-in gas pipeline passes about 2.5 miles east of the main plant building. This is a grade B pipe with a nominal wall thickness of 0.188 in. and an average depth of 30 in. It carries Loss of offsite power from blast pressure damage to SSCs from pipeline accidents is a potential challenge within the design Based on the UFSAR evaluation, the pipeline does not pose a challenge to FNP.

12 million cubic feet per day. In Section basis. As a result, the likelihood of damage 2.2.3.2 of the UFSAR (Reference A.2-3), it is causing a LOSP is judged to be stated that an explosion or fire following a sufficiently small that it will not break of this pipe would not be hazardous for significantly impact the RICT FNP. Therefore, the hazard posed by pipeline Program calculations and it can be accidents is screened out from the FNP PRA. excluded from RICT Program (Reference A.2-2) evaluation.

Beyond design basis challenges from pipeline accidents screened out.

to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Tsunami FNP is located inland is not exposed to the There are no challenges Excluded from RICT Program Tsunami threat presented to the FNP site from evaluation.

tsunamis.

Volcanic Activity Not applicable to the site because of location There are no challenges Excluded from RICT Program (no active or dormant volcanoes located near presented to the FNP site from evaluation.

plant site) volcanic activity.

Waves FNP is located inland and is not affected by There are no challenges Excluded from RICT Program any wave activity. presented to the FNP site from evaluation.

DRA waves.

FT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Step 3 Seismic-Induced LOSP Challenges For the FNP site, the only incremental risk associated with challenges to the facility that do not exceed the design capacity, which is not already addressed, is the seismically-induced LOSP. The methodology for computing the seismically-induced LOSP frequency is simply a convolution of the mean seismic hazard curve and the offsite power fragility. The Farley seismic hazard curve is the re-evaluated hazard submitted to NRC (Reference A.2-9) in response to the 50.54(f) request regarding Recommendation 2.1 of the NRC Fukushima Near Term Task Force.

Table E3.A2.2 provides the mean seismic hazard, represented by a series of discrete seismic hazard intervals from just below the FNP operating basis earthquake to significantly above the safe shutdown earthquake, and the LOSP failure probability for each seismic interval based on the fragility of offsite power, represented by failure of ceramic insulators in the offsite power switchyard. The failure probabilities are based on the fragility data from Table 4B-1 of the RASP Handbook (Reference A.2-10):

DMedian Offsite Power Capacity = 0.3g PGA, R = 0.3, U = 0.45 RA Given the mean frequency and failure probability for each seismic interval, it is straightforward to compute the estimated frequency of seismically induced loss of offsite power for the FNP site by taking the product of the interval frequency and the offsite power failure probability. As shown in Table E3.A2.2, the total seismic LOSP frequency is the sum of interval frequencies, or approximately 5E-6/yr.

Table E3.A2.2 FT Seismic LOSP Frequency Based on FNP Seismic Hazard and RASP Seismic Interval (g)

Handbook Fragility Data (Reference A.2-10)

Represent ative Acceler-ation (g)

Interval Frequency

(/yr)

Offsite Power Failure Prob.

Weighted Average LOSP freq 0.05 - 0.1 0.07 1.13E-04 3.77E-03 4.26E-07 0.1 - 0.3 0.17 2.11E-05 1.55E-01 3.27E-06 0.3 - 0.5 0.39 9.35E-07 6.82E-01 6.37E-07 0.5 - 0.7 0.59 1.80E-07 8.95E-01 1.61E-07 0.7 - 0.9 0.79 5.56E-08 9.64E-01 5.36E-08 0.9 - 1.1 0.99 2.25E-08 9.87E-01 2.22E-08 1.1 - 1.3 1.20 1.31E-08 9.95E-01 1.30E-08 1.3 - 1.5 1.40 2.39E-09 9.98E-01 2.38E-09

>1.5 2.12 6.40E-09 1.00E+00 6.40E-09 Total Seismic LOSP Frequency = 4.59E-06 The internal events PRA relies on the loss of offsite power data in Reference A.2-11. Based on the FNP internal events PRA (Reference A.2-4), the total LOSP frequency is approximately 2E-2/yr. from plant-centered, grid-related, and weather-related causes. Applying the non-recovery E3-24 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models probability at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to each of these causes of LOSP results in a frequency of unrecovered loss of offsite power of 1.5E-3/yr. that is already included in the internal events PRA.

The seismically-induced (unrecoverable) LOSP frequency (5E-6/yr) is therefore less than 1% of the total unrecovered LOSP frequency. This frequency is judged to be a sufficiently small fraction that it will not significantly impact the RICT Program calculations and it can be omitted.

Conclusions Based on this analysis of external hazards for FNP Units 1 and 2, no additional external hazards need to be added to the existing PRA model. The evaluation concluded that the hazards either do not present a design-basis challenge to FNP, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.

References A.2-1.

A.2-2.

A.2-3 D

Alabama Power Company, Farley Nuclear Plant, Units 1 and 2, Individual Plant Examination of External Events, June 1995.

RA Joseph M. Farley Nuclear Plant Units 1 and 2, Evaluation of Other External Hazards, Southern Nuclear PRA Report, Revision 0, December 31, 2013.

Joseph M. Farley Nuclear Plant Units 1 and 2 UFSAR, Rev 28 December 2017 A.2-4. Joseph M. Farley Nuclear Power Plant - Units 1 & 2 Flood Hazard Reevaluation A.2-5 FT Report (FHRR), Version 1.0, NRC Docket No. 50-348 & 50-364, October 20, 2015 NRC ADAMS Accession No. ML15343A418 - Joseph M. Farley Nuclear Plant, Units 1 and 2 - Interim Staff Response to Reevaluated Flood Hazards Submitted in Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation (TAC No. MF7039 and MF7040), December 10, 2015 A.2-6 FNP Level 1 and 2 PRA Model Revision 9 - at power, internal events, PRA-BC-F-14-001 Farley IE Model Rev 9 Ver 3, January 28, 2014.

A.2-7 Regulatory Guide 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room during a Postulated Hazardous Chemical Release, U.S. Nuclear Regulatory Commission, Revision 1, 2001 A.2-8 Regulatory Guide 1.91, Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants, U.S. Nuclear Regulatory Commission, Revision 1, February 1978 A.2-9 Alabama Power Company, Joseph M. Farley Nuclear Plant - Units 1 and 2 Seismic Hazard and Screening Report for CEUS Sites, NL-14-0342, March 31, 2014.

A.2-10 Risk Assessment of Operational Events Handbook, Volume 2 - External Events, Revision 1.01, U.S. Nuclear Regulatory Commission, January 2008.

E3-25 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models A.2-11 Losses of Off-Site Power at U.S. Nuclear Power Plants - Through 2001, Final Report, EPRI TR-1002987, Electric Power Research Institute, April 2002.

A.2-12 Regulatory Guide 1.115, Protection Against Turbine Missiles, U.S. Nuclear Regulatory Commission, Revision 2, January 2012.

A.2-13 ANS-IPEEE-NRC, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments of Nuclear Power Plants, Report NUREG/CR-2300, 1983.

DRA FT E3-26

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 4 Base CDF and LERF DRA FT Table of Contents to NL-18-0039 Baseline CDF and LERF 1.0 Introduction .............................................................................................................. 4 2.0 References ............................................................................................................... 4 DRA FT E4-3

Enclosure 4 to NL-18-0039 Baseline CDF and LERF 1.0 Introduction The purpose of this enclosure is to demonstrate that the total Core Damage Frequency (CDF) and total Large Early Release Frequency (LERF) are below the limits established in Regulatory Guide (RG) 1.174 (Reference 1), which are 1E-4/year for CDF and 1E-5/year for LERF. These limits allow for the risk metrics of NEI 06-09 (Reference 2) to be applied to the Farley Nuclear Plant (FNP) Risk Informed Completion Time (RICT) Program.

Table E4.1 reflects the Unit 1 and Unit 2 CDF and LERF values that resulted from a quantification of the baseline internal events (including internal flooding and an evaluation of the contribution from a loss of service water (SW) dam event) (References 4 and 5) and fire Probabilistic Risk Assessment (PRA) average annual models (Reference 3). Table E4.1 also includes the seismic CDF/LERF values described in Enclosure 3. Other external hazards, as discussed in Enclosure 3, are below accepted screening criteria and therefore do not contribute significantly to the totals. The values for the internal events and fire PRAs represent the average of Train A and Train B plant configuration alignments CDF/LERF results for each unit.

Table E4.1 Source Internal Events PRA D Total Baseline Average Annual CDF/ LERF Farley Unit 1 RABaseline CDF/year 8.90E-06 Baseline LERF/year 9.76E-08 Source Internal Events PRA Farley Unit 2 Baseline CDF/year 8.76E-06 Baseline LERF/year 7.93E-08 Fire PRA 8.35E-05 4.21E-06 Fire PRA 7.89E-05 4.51E-06 Seismic 4.51E-06 2.07E-06 Seismic 4.51E-06 2.07E-06 Loss of SW Dam Other External Events TOTAL UNIT 1 FT 3.49E-07 N/A 9.73E-05 4.53E-09 N/A 6.38E-06 Loss of SW Dam Other External Events TOTAL UNIT 2 3.49E-07 N/A 9.25E-05 4.53E-09 N/A 6.66E-06 As demonstrated in Table E4.1, the total CDF and total LERF for each unit are within the limits set forth in RG 1.174, which permit small changes in risk that may occur during entries into the RICT Program. Therefore, the FNP RICT Program is consistent with NEI 06-09 guidance.

The values shown in Table E4.1 are a snap shot in time (Reference 3) and are subject to change based on the on-record PRA models that support the RICT Program. The RICT Program will monitor these values to ensure that annual average CDF and LERF are reasonably within RG 1.174 limits of 1E-04 and 1E-05 as a condition of program implementation requirement. Enclosure 9 provides additional information on the RICT Program monitoring process.

2.0 References

1. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing basis, May 2011 (ADAMS Accession No. ML090410014).

E4-4 to NL-18-0039 Baseline CDF and LERF

2. NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

3. Farley Fire PRA Summary Report , Revision 1, F-RIE-FIREPRA-U00-014

4. SNC Calculation PRA-BC-F-18-002, "Farley FPIE Asymmetric Cooling Provisional Update," Revision 1.

5. SNC Calculation F-RIR-ILRT-U00-002, "Farley Nuclear Plant Service Pond Dam Failure Evaluation," Revision 1 DRA FT E4-5

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 5 DRA Probabilistic Risk Assessment (PRA) Model Update Process FT to NL-18-0039 PRA Model Update Process Table of Contents 1.0 Introduction............................................................................................................ 2 2.0 PRA Model Update Process .................................................................................. 2 2.1 Internal and Fire Events PRA Maintenance and Update ........................... 2 2.2 Review of Plant Changes for Incorporation into the PRA Model ................ 2 3.0 References ............................................................................................................ 3 DRA FT E5-1 to NL-18-0039 PRA Model Update Process 1.0 Introduction The administrative controls applicable to the Probabilistic Risk Assessment (PRA) models used to support the Risk Informed Completion Time (RICT) Program ensure that these models reflect the as-built, as-operated plant. Plant changes, including physical modifications and procedure or operating practice changes, are reviewed prior to implementation to determine if they could impact the PRA models. If so, the process then determines the quantitative significance of the change and, if appropriate, implements the PRA model change concurrently with the plant change. If the change is not quantitatively significant, the PRA model change is prioritized for implementation at a routine model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Routine updates are performed, as a minimum, every two fuel cycles. If a quantitatively significant change cannot be implemented in the PRA model such that it could adversely affect RICT calculations, alternatives including bounding analyses or restrictions on the use of the RICT program are put in place until the PRA model can be changed.

2.0 PRA Model Update Process 2.1 D

Internal and Fire Events PRA Maintenance and Update The Southern Nuclear Operating Company (SNC) risk management process ensures that the RA applicable PRA model reflects the as-built and as-operated plant for each of the Farley Nuclear Plant (FNP) units, as required by Regulatory Guide 1.200 (Reference 2). The process delineates the responsibilities and guidelines for updating the full power internal events and internal fire PRA models at all operating SNC sites, and it includes both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential impact areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified FT in the model, industry operational experience) and assessing the risk impact of unincorporated changes. The process also provides for controlling the model and associated electronic files.

The SNC PRA update process procedures include a requirement to maintain the total CDF and LERF mean values from all quantified sources documented in the LAR, including impact of changes to fire ignition frequency updates, within the RG 1.174 risk acceptance guidelines of 1E-4/yr. (CDF) and 1E-5/yr. (LERF) (Reference 3).

2.2 Review of Plant Changes for Incorporation into the PRA Model

1. Plant Changes (including both physical modifications to the facility and changes to procedures or operating practices) are reviewed as follows:

a. Modifications to the physical plant are reviewed for changes to maintain the PRA consistent with the as-designed plant. The review of design changes, e.g., Design Change Packages (DCP), Minor Design Changes (MDC), etc., is performed on an on-going basis. All design changes expected to impact or result in a need to change the baseline PRA model are identified in the PRA change log.

b. Modifications to plant procedures, Technical Specifications, and other licensing documents are reviewed to maintain the PRA consistent with the as-operated plant.

E5-2 to NL-18-0039 PRA Model Update Process The review is performed on an on-going basis. Licensing Document Change Requests (LDCR) expected to significantly impact or change the baseline PRA model are identified in the PRA model change log.

c. Reliability data, unavailability data, initiating events frequency data, human reliability data, and other such PRA inputs are reviewed at least every two fuel cycles to maintain the PRA consistent with the as-operated plant.

2. If a quantitatively significant change to the PRA model is identified, it is accounted for in the model prior to the implementation of that plant change, including a physical modification, a procedure change, or other changes as noted in Item (1).

3. Following the data review performed at least every two fuel cycles, the PRA is reviewed to account for cumulative changes identified by the analysis.

4. If PRA model errors are discovered, they are reviewed to determine the quantitative impact on PRA results. Errors that result in quantitatively significant changes to the PRA model are corrected as soon as possible. Other errors are corrected on a completion D

schedule that is determined based on their priority.

5. When a PRA model change is required but cannot be immediately implemented for a RA quantitatively significant plant change or model error, the process calls for either one of the following actions:

a. Alternative analyses to conservatively bound the expected risk impacts of changes on the model are performed. In such a case, these alternative analyses become part of 3.0 FT the RICT Program calculation process until the plant changes are incorporated into the PRA model. The use of such bounding analyses is consistent with NEI 06-09 (Reference 1).

b. Appropriate administrative restrictions on the use of the RICT Program for extended CTs are put in place until the model changes are completed.

References

1. NEI 06-09, Risk-Informed Technical Specifications Initiative 4B: Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, US Nuclear Regulatory Commission, Revision 2, March 2009.

3. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific changes to the Licensing Basis, May 2011 (ADAMS Accession No. ML12321A054)

E5-3

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 6 Attributes of the Configuration Risk Management Program (CRMP) Model DRA FT to NL-12-1344 Attributes of the CRMP Model Table of Contents

1.0 INTRODUCTION

.................................................................................................. 3 2.0 PROCESS ............................................................................................................ 3 3.0 ADMINISTRATIVE CONTROLS........................................................................... 5 4.0 QUALITY REQUIREMENTS ................................................................................ 9 5.0 TRAINING AND QUALIFICATION ....................................................................... 9

6.0 REFERENCES

................................................................................................... 11 DRA FT E6-2 to NL-12-1344 Attributes of the CRMP Model 1.0 Introduction This enclosure describes the process for adapting the peer-reviewed baseline Probabilistic Risk Assessment (PRA) models for use in the Configuration Risk Management Program (CRMP) software to support the Risk Informed Completion Time (RICT) Program. Farley Nuclear Plant (FNP) intends to employ a CRMP software tool which provides for real time recalculation of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for configuration risk. The baseline PRA models are separate internal events (including internal flooding) and internal fires models, which calculate average annual risk. The CRMP model used in the RICT Program must integrate results for all modeled hazard groups and determine CDF and LERF for actual plant conditions which exist at the time. The process employed to adapt the baseline models for CRMP use is demonstrated 1) to preserve the CDF and LERF quantitative results, 2) to maintain the quality of the peer-reviewed PRA models and 3) to correctly accommodate changes in risk as required due to time-of-year, time-of-cycle and configuration-specific considerations as required. As indicated in Enclosure 1, the representative RICT values reported in Enclosure 1 are calculated using separate zero-maintenance annual average PRA models which include the internal events (including internal flooding) PRA model, internal fire events PRA model that reflect NFPA-805 implemented plant modifications, seismic bounding delta CDF/LERF values, and main control room (MCR) abandonment bounding delta D

CDF/LERF values. The CRMP model that reflects the as-built and as-operated plant condition including credit for NFPA-805 modifications will be developed prior to implementation of the RICT Program. Quality controls and training programs applicable for the CRMP tool are also discussed in this enclosure. The MCR abandonment bounding delta CDF/LERF values are RA subject to replacement either with updated values as the model is updated or optionally reflected as a logic change within the Internal Fire PRA model. The Seismic bounding delta CDF/LERF values are subject to replacement with updated values as the model is updated.

2.0 Process FT The baseline PRA models for internal events (including internal flooding) and internal fires are peer-reviewed models, updated to incorporate resolution of relevant peer review findings and to incorporate plant changes that reflect the as-built and as-operated plant. These models will then be modified using the following process to create a single top CRMP model, which also includes changes needed to facilitate configuration-specific risk calculations.

Each step in the process is documented using, as required, separate reports or calculations, which provide for necessary reviews and approvals of the changes being applied. The significant steps of the process are described below:

Step 1: This step represents the model for internal events and internal flooding which was subjected to the peer review process.

Step 2: This step represents the model for internal fires which was subjected to the peer review process.

Step 3: This step represents the modification of the internal events and internal flooding model to resolve peer review findings determined to be relevant to the use of the models in the RICT Program, as well as updates to address plant changes.

E6-3 to NL-12-1344 Attributes of the CRMP Model Step 4: This step represents the modification of the internal fires model to resolve peer review findings determined to be relevant to the use of the models in the RICT Program, as well as updates to address plant changes.

Step 5: This step makes changes to the internal events (including internal flooding) and fire PRA models to include systems, structures, and components (SSCs) that are in the scope of the RICT Program but which are not part of the baseline PRA models. An evaluation of the RICT Program scope against the baseline PRA model scope is performed to identify SSCs which are not part of the baseline model and which need to be included to support configuration risk evaluations for LCOs in the scope of the RICT Program. It is expected that future revisions to the baseline PRA model will incorporate those SSCs that support configuration risk evaluations for the RICT program.

The changes being made to the existing baseline PRA models do not involve new methods; as such there is no need for any focused scope peer review. The associated LCOs are described in Enclosure 1.

Step 6: This step integrates the two baseline PRA models, following steps 4 and 5, into a D

single top fault tree model for calculation of CDF and LERF. The single top model is capable of evaluating the fire scenarios along with the internal events initiators and then combining the numerical results for use in the CRMP. At this step, the single top RA risk model calculates the total average annual CDF and LERF from internal events, internal floods, and internal fires.

Also at this step, the results obtained from the integrated model are validated against the baseline model results to ensure the single-top model is properly calculating CDF and LERF. The single top model accommodates such comparisons because it permits FT quantification of all initiating events, or a selection of initiating events, which facilitates comparisons to the two baseline PRA models.

At the completion of step 6, the two PRA baseline models are integrated, and the single top model is verified to provide quantitative results consistent with the two baseline models.

Step 7: This step optimizes, if required, the single top model to improve quantification time and is an intermediate step towards the next step.

At the conclusion of step 7, the quantified results from the optimized model are benchmarked to ensure the optimization process did not significantly alter the numerical results from the baseline PRA models.

Step 8: This step changes the model logic to account for variations in system success criteria based on the time of year or the time in the operating cycle as required. It also accounts for other specific changes needed to properly account for configuration-specific issues as required, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle. The CRMP model used for the RICT Program is required to either conservatively model these variations or include the capability to account for the variations.

E6-4 to NL-12-1344 Attributes of the CRMP Model The types of changes implemented in the CRMP model are described in Table E6.2.

Some specific examples of equipment alignment possibilities are shown (e.g., status of PORV block valves) but a number of other system alignments, such as high head charging and nuclear service water trains that are not shown but would be reflected in the CRMP model based on the configuration-specific equipment alignments in effect at the time of a RICT calculation.

Table E6.2 Changes Made During Translation to CRMP Model Description Basis for Change Seismic Bounding Seismic risk is not included in the baseline PRA models. As justified in Risk Enclosure 3 of this LAR, bounding seismic CDF and LERF values are calculated and included in the FNP baseline risk of the CRMP model.

Plant Availability The baseline PRA models account for the time the reactor operates at (PAV) Event power by using a plant availability factor. This is appropriate for determining the average annual (time based) risk, but the factor is not Maintenance DRA applicable to configuration-specific risk calculated for the RICT Program. Therefore, the probability of the PAV event is set to 1.0 in the CRMP model. This change is necessary to adjust the modeled initiating event frequencies from a per year to per reactor year basis for use in the CRMP.

Maintenance events in the baseline PRA models have probabilities Event Probabilities based on the fraction of the year the equipment is unavailable. For the CRMP model, the actual configuration of equipment is known, so the maintenance event probabilities are set to 0. When components are in Primary Pressure Relief Control Interval for Anticipated FT maintenance, these events (or equivalent events) are set to 1.

The events CRMP CRMP FNP core design reflected in the baseline PRA model for ATWT uses interval values to reflect impact of core life, whereas the model model must reflect configuration-specific risk. Therefore the is configured to select an interval value corresponding to Transient Without the time in core life. The CRMP model will allow user input to select Trip (ATWT)

Events the appropriate time in life configuration applicable for RICT Program calculations.

The success criteria in the baseline PRA for primary pressure relief during ATWT is based on average values for the period of time a PORV block valve is closed. The CRMP model must reflect PORV Block Valve configuration-specific risk. Therefore the CRMP model is configured to Configuration select a value of either zero or 1.0 for closure of the PORV block valves. The CRMP model will allow user input to select the appropriate configuration applicable for RICT Program calculations.

3.0 Administrative Controls Departmental procedures and their sub-tier instructions and guidelines provide high level guidance and requirements for creating and maintaining the CRMP model for implementing the RICT Program at FNP. The procedures collectively implement the following requirements of E6-5 to NL-12-1344 Attributes of the CRMP Model NEI 06-09, Revision 0-A (Reference 1), consistent with RG 1.177 (Reference 2) guidance, for the CRMP model:

A process for evaluation and disposition of proposed facility changes shall be established for items impacting the CRMP model (Section 2.3.4, Item 7.2).

The CRMP model shall accurately reflect the as-built, as-operated plant consistent with RG 1.200 guidance for PRA capability category II (Section 2.3.5, Item 9 and Section 4.1).

The CRMP model shall be updated to reflect the as-built and as-operated plant on a periodic basis not to exceed two refueling cycles (Section 2.3.5, Item 9.1).

Common cause treatment, as applied in the CRMP model, shall be consistent with the PRA model and Risk Managed Technical Specification (RMTS) guidance. If a component is out-of-service for planned maintenance, there is no justification for changing the common cause failure (CCF) factors. If an emergent failure occurs, the "extent of condition" evaluation performed by Operations either addresses the situation or provides assurance that a CCF is not occurring, so no changes in CCF modeling are D

necessary. However, optionally if an extent of condition evaluation cannot establish with a high degree of confidence that there is no common cause failure mechanism, the probability that the redundant component is failed from a common cause failure RA mechanism will be modified numerically, consistent with the guidance in RG 1.177 while calculating the RICT. If, for either option, it is determined that a common cause failure mechanism exists, the redundant SSC will be declared inoperable and cannot be considered available for PRA functional. The previously mentioned set of procedures/instructions ensures that basic events for CCF of multiple components will not be changed within the CRMP model by excluding (removing) them from the tag FT table (Section 2.3.4, Item 6). Specifically, the treatment of CCF in the CRM Tool will be as described below:

o Planned Configurations:

For planned configurations the RICT calculations will be performed consistent with NEI 06-09, Section 3.3.6, Common Cause Failure Consideration, guidance on the treatment of CCF, as follows:

For all RICT assessments of planned configurations, the treatment of common cause failures in the quantitative CRM Tools may be performed by considering only the removal of the planned equipment and not adjusting common cause failure terms.

This approach will result in slightly shorter completion times than if RICTs were calculated using the RG 1.77 approach (i.e., it is conservative), and it will prevent deviation from the NRCs approach of NEI 06-09.

E6-6 to NL-12-1344 Attributes of the CRMP Model o Emergent Configurations For emergent configurations, the RICT program will abide by NEI 06-09, Section 3.3.6, Common cause Failure Consideration guidance on the treatment of CCF, as follows:

For RICT assessments involving unplanned or emergent conditions, the potential for common cause failure is considered during the operability determination process.

This assessment is more accurately described as an extent of condition assessment.

In addition to a determination of operability on the affected component, the operator should make a judgement with regard to whether the operability of similar or redundant components might be affected.

The components are considered functional in the PRA unless the operability evaluations determines otherwise.

An extent of condition evaluation together with an operability evaluation will provide D

an assessment of the vulnerability of the operable redundant components to any common cause failure potential. The RICT determination process for an emergent configuration will be consistent with the following guidance provided in the NRC SER RA for NEI 06-09:

Emergent Failures. During the time when a RICT is in effect and risk is being assessed and managed, it is possible that emergent failures of SSCs may occur, and these must be assessed to determine the impact on the RICT. If a failed component is one of two or more redundant components in separate trains of a system, then FT there is potential for a common cause failure mechanism. Licensees must continue to assess the remaining redundant components to determine there is reasonable assurance of their continued operability, and this is not changed by implementation of the RMTS. If a licensee concludes that the redundant components remain operable, then these components are functional for purposes of the RICT. However, the licensee is required to consider and implement additional risk management actions (RMAs), due to the potential for increased risks from common cause failure of similar equipment. The staff interprets TR NEI 06-09, Revision 0, as requiring consideration of such RMAs whenever the redundant components are considered to remain operable, but the licensee has not completed the extent of condition evaluations In keeping with the above NRC guidance, if it is determined that redundant components remain operable, these components are considered PRA functional for purpose of RICT determinations. However, FNP will consider and implement additional RMAs, due to the potential for increased risks from common cause failure of similar equipment, whenever the redundant components are considered to remain operable but an extent of condition evaluation has not yet been completed. The consideration and implementation of additional RMAs, according to the NRC SER on NEI 06-09, is considered to be consistent with the guidance of RG 1.177 regarding the treatment of increased risks from common cause failures.

E6-7 to NL-12-1344 Attributes of the CRMP Model TS Loss of Function Conditions (LOF) A RICT is allowed to be calculated during a TS LOF Condition if at least one train in a two train system is PRA functional (for more than two train systems, the number of trains that are required to be PRA functionality is described in Enclosure 1, Table E1-1). However, the following additional constraints shall be applied to the criteria for "PRA Functional".

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality during a Technical Specifications loss of function condition where a RICT is applied.

3. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

4. If a TS LOF is due to CCF vulnerability of the redundant train(s) and does not impact the PRA functionality of the redundant train(s), a RICT can only be established if the inoperability of the initial TS Condition is considered PRA Functional.

Criteria shall exist to require CRMP model updates concurrent with implementation of facility

D changes that significantly impact RICT calculations (Section 2.3.5, Item 9.2).

Initiating event models in the CRMP shall accurately include external conditions and effects RA of out-of-service equipment (Section 2.3.5, Item 1).

The impacts of out-of-service equipment shall be properly reflected in the CRMP model initiating event models, as well as system response models. For example, if a certain component being declared inoperable and placed in a maintenance status is modeled in the PRA, the entry of that equipment status into the CRMP model must accommodate risk

Item 1).

FT quantification to include both initiating event and system response impact (Section 4.2, The CRMP model fault trees shall be traceable to the PRA (Section 2.3.5, Item 3).

Changes to the CRMP model and data shall correctly reflect configuration-specific risk (Section 4.2, Item 3).

In order for human recovery actions as modeled in the PRA to be credited in the RICT Program, such actions shall be performed via approved station procedures with the implementing personnel trained in their performance (Section 4.2, Item 4).

The baseline PRA models assess average annual risk. However, some risk is not consistent throughout the year, and the CRMP tool needs to properly assess change in risk for the existing plant configuration. The departmental procedure process requires that time averaging features of the baseline PRA shall be excluded from the CRMP model (specific items discussed in Table E6.2) (Section 2.3.4, Item 5).

Benchmarking of the CRMP model against the baseline PRA is performed and documented to demonstrate consistency (Section 2.3.5., Item 3).

E6-8 to NL-12-1344 Attributes of the CRMP Model 4.0 Quality Requirements Southern Nuclear Operating Company (SNC) employs a multi-faceted approach to establishing and maintaining the quality of the PRA models, including the CRMP models, for all operating SNC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process (described in Enclosure 5) and the use of self-assessments and independent peer reviews (described in Enclosure 2). The information provided in Enclosure 2 demonstrates that the FNP at-power internal events PRA model (including internal flooding) and internal fire PRA comply with RG 1.200, Revision 2 (Reference 3), requirements. This information provides a robust basis for concluding that the PRA is of sufficient quality for use in risk-informed licensing actions.

For maintenance of an existing CRMP model, changes made to the baseline PRA model in translation to the CRMP model, and changes made to the CRMP configuration files, are controlled and documented by departmental procedures. Those procedures specify an acceptance test to be performed after every CRMP model update. This testing verifies proper translation of the baseline PRA models and acceptance of all changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components included in CRMP to the correct basic events in the CRMP model.

D Prior to the implementation of the RICT Program, results of the acceptance testing for the integrated single top model, including fire (Step 6), the optimized single top model if developed RA (Step 7), and the CRMP model, which is used for configuration specific calculations (Step 8) are compared with the model produced in Step 5 to ascertain fidelity of the CRMP model. The results are documented in the model development reports and/or calculations.

The model development reports will discuss the results and justify variations in the CDF and LERF results. The primary variations in the CDF and LERF results typically stem from using FT average maintenance models in Step 5 and zero-maintenance models in Step 8.

5.0 Training and Qualification The training for personnel developing the CRMP model used to support RICT Program implementation is developed based on SNC procedures as described in Enclosure 8. The qualification of personnel developing and using the CRMP model is controlled by SNC qualification and training programs based on the Institute of Nuclear Power Operation (INPO)

Accreditation (ACAD) requirements. SNC fleet-wide procedures establish the responsibilities and requirements for the training and qualification of personnel who perform engineering activities. The following discussion provides an overview of general accountabilities and aspects of FNP training programs applicable to plant staff involved with the CRMP tool development and use.

The Southern Nuclear Fleet Operations Training Manager is accountable for the performance and use of Training procedures. Site Functional Area Managers are responsible for the following:

Governance and oversight of any site-specific sub-tiered instructions, guidelines, and forms and the overall administration of and performance of the continuing training program E6-9 to NL-12-1344 Attributes of the CRMP Model Conducting courses to support the training and qualification of individuals in the engineering population.

Ensuring that training and qualification records are processed in accordance with procedures.

The SNC Training Manager is responsible for conducting courses to support the training and qualification of individuals in the Engineering population and for processing Training and Qualification records in accordance with SNC fleet-wide procedures and applicable site procedures.

The Engineering Fleet Training Program Committee (TPC) is composed of the four Engineering TPC Chairs, one Training Manager, and the Vice President of Engineering. This group is responsible individually and collectively to drive training program performance to levels of excellence and leverage training to drive station performance to levels of excellence. They are responsible for ensuring:

Training program performance issues are identified and resolved

planning.

D Student performance shortfalls (in training and in-plant) are identified and resolved Training is a core business and addresses needs through annual, biennial and long-range RA Overall training program health remains strong and meet station needs, and provides workers the knowledge and skills necessary for job performance.

Approving position-specific qualifications that are designated for common fleet Engineering FT duties and activities.

FNP Site and Corporate Department Managers with personnel performing Job Performance Requirements (JPRs) that are covered by the Training program are responsible for the following:

Ensuring that individuals are evaluated for inclusion in, or exclusion from, the Engineering Training program population based on their job assignment.

Ensuring that personnel in their department complete qualifications and training in accordance with procedural requirements.

Maintaining and reviewing the qualification requirements in the Learning Management System (LMS).

Administering the Engineering Training Population Determination Form for Supervisors who perform engineering activities independently or who perform the Final Technical Review of engineering activities. This applies regardless of inclusion in or exclusion from the Engineer population.

E6-10 to NL-12-1344 Attributes of the CRMP Model Ensuring that only qualified individuals perform engineering activities independently or perform the Final Technical Review of engineering activities. This applies to individuals regardless of inclusion in or exclusion from the Engineer population.

Designating one or more individuals as Department Training Coordinator(s) to ensure effective use of LMS.

Designating personnel to be Technical Mentors.

Participating in Engineering Training Committees, which oversee the Engineering Support Personnel Accredited Training Program.

Coordinating the scheduling of assignments Each Supervisor with personnel performing JPRs covered by the Training program is responsible for the following:

Checking employee qualifications prior to assigning work, to ensure that the assigned

D personnel are qualified for the work being assigned Ensuring items and qualifications are assigned, as needed, to assigned personnel RA Participating in Engineering Training Committees, which oversee the Engineering Support Personnel Accredited Training Program.

Personnel performing Engineering JPRs that are covered by the training program are responsible for the following:

population.

FT Verifying they are qualified in the Learning Management System (LMS) prior to independently performing the work, whether or not they are in the accredited program Ensuring that completion of qualifications and training is done in accordance with procedural requirements.

As stated above, the qualification of personnel developing and using the CRMP model is controlled by the SNC qualification and training programs, which are based on INPO ACAD requirements.

6.0 References

1. NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

2. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications, August 1998 (Adams Accession No. ML003740176).

3. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

E6-11

Farley Nuclear Plant - Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines DRA Enclosure 7 Key Assumptions and Sources of Uncertainty FT to NL- NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table of Contents Introduction ..................................................................................................................................... 3 Assessment of Internal Events PRA Epistemic Uncertainty Impacts .............................................. 3 Assessment of Translation Uncertainty Impacts ............................................................................. 5 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts .......................................... 16 References .................................................................................................................................... 25 DRA FT E72 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Introduction The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program. Topical Report NEI 06-09 (Reference 1), Section 2.3.4, item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties. The baseline internal events (including internal flooding) PRA and fire PRA (FPRA) models document assumptions and sources of uncertainty and these were reviewed during the model peer reviews.

The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT Program.

The epistemic uncertainty analysis approach described below applies to the internal events PRA, and any epistemic uncertainty impacts that are unique to FPRA are also addressed. In addition, Topical Report NEI 06-09 requires that the uncertainty be addressed in RICT Program Configuration Risk Management Program (CRMP) tools by consideration of the translation from the D

PRA model to the CRMP tool. The CRMP model, is discussed in Enclosure 6. It consists of separate zero-maintenance annual average PRA models which include the internal events (including internal flooding) PRA model, internal fire events PRA model that reflects NFPA 805 RA plant modifications, seismic bounding delta CDF/LERF values, and also main control room abandonment bounding delta CDF/LERF values that are calculated separately from the fire PRA model when a TS inoperable SSC needed for remote shutdown, consistent with plant operating procedures, is determined not to be PRA functional. The main control room abandonment bounding delta CDF/LERF option will no longer be used after its contribution is fully integrated into the fire PRA model. The CRMP model that reflects the as-built and as-operated plant condition FT including credit for NFPA 805 modifications will be developed prior to implementation of the RICT Program. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the CRMP tool during RICT Program calculations.

Assessment of Internal Events PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty for RICT Program application, the internal events baseline PRA model uncertainty report was developed, based on the guidance in NUREG-1855 (Reference 2). As described in NUREG-1855, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the Farley Nuclear Plant (FNP) baseline PRA model aleatory uncertainty analysis as part of the baseline model development and quantification (Reference 3).

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. The assumptions are defined consistent with the definition provided in NUREG-1855. Plant-specific assumptions made for each of the FNP internal events PRA technical elements are collected from each portion of the PRA model development and quantification and evaluated for the base PRA.

E73 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty The evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. The Electric Power Research Institute (EPRI) compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (EPRI 1016737, Reference 5) and an evaluation of each generic source of modeling uncertainty was performed (Reference 4).

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the TSTF-505 application, based on the results of the internal events PRA and fire PRA peer reviews.

Based on following the methodology in Reference 5 for a review of sources of uncertainty, the potential sources of uncertainty and impact of these items on RICT program implementation are discussed in Table E7.1 relative to the need for consideration as key sources of uncertainty for the RICT application that might warrant treatment through additional RMAs. Note that RMAs will be D

developed when appropriate using insights from the PRA model results specific to the configuration.

RA Based on the evaluation summarized in Table E7.1, none of the evaluated sources represents a key source of uncertainty for the RICT application.

Although not addressed in Table E7.1 through review of the base model, the RICT process addresses possible uncertainty in the reliability of SSCs considered to be PRA Functional. In cases where SSC degradation may be the cause of inoperabilities, PRA Functionality determinations are FT performed consistent with the following NEI 06-09 guidance:

The PRA function may be considered in cases that involve SSC inoperabilities which, while degraded, do not involve a potential for further degrading component performance. In most cases, degrading SSCs may not be considered to be PRA functional while inoperable. For example, a pump which fails its surveillance test for required discharge pressure is declared inoperable. It cannot be considered functional for calculation of a RICT, since the cause of the degradation may be unknown, further degradation may occur, and since the safety margin established by the pump's operability requirements may no longer be met. As a counter example, a valve with a degrading stroke time may be considered PRA functional if the stroke time is not relevant to the performance of the safety function of the valve; for example, if the valve is required to close and is secured in the closed position."

As a result, the failure probability need not be increased depending on the failure mechanism causing the degraded condition. The SSC's nominal reliability remains applicable and consistent with the definition of PRA functionality in NEI 06-09 0-A, process requirement number 11.1.2 (i.e.,

further degradation that could impact PRA functionality is not expected during the RICT). Given an inoperable condition caused by a degraded condition, the FNP RlCT Program allows only two choices to be made in the CRM Tool:

Either a "PRA non-functional" or "PRA functional" condition to represent the TS degraded condition.

E74 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty o If the inoperability is evaluated as a "PRA non-functional" condition, CRM Tool will treat the SSC as failed, or o If the inoperability is evaluated as a "PRA functional" condition, CRM Tool will treat the SSC with the nominal base-case failure probability.

The rationale for using the nominal reliability for a PRA functional SSC includes the determination that the base case PRA results are still applicable, the degraded condition has been demonstrated to meet the PRA success criteria, and the SSC is considered fully available. No additional uncertainty or sensitivity analysis is planned to be performed during a RICT entry, which is consistent with the expectations of NEI 06-09 and the NRC SER on NEI 06-09.

The baseline PRA does not include seasonal variations from hazards but there are certain initiating events that can be affected by seasonal variations (e.g., loss of offsite power). The assumptions involve applying the generic industry frequency for the loss of offsite power event developed in NUREG/CR-6890 (Reference 14). The RICT Program will include a qualitative consideration of weather events as part of the RMA decision process when LCO 3.8.1 CTs are extended to address D

this source of uncertainty.

Assessment of Translation Uncertainty Impacts RA Modification of the baseline PRA models is required to create the CRMP model used for RICT Program calculations. These modifications, described in Enclosure 6, may introduce new sources of model translation uncertainty. Table E7.2 provides a description of the model changes and dispositions of whether any of the model changes made represent possible new sources of model uncertainty that must be addressed.

FT E75 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Loss Of Offsite Power (LOSP) frequency and fail to LCOs for which The LOSP frequency and fail to recover offsite power D

recover offsite power probabilities RA LOSP scenarios have an effect on the RICT probabilities are based on available industry data.

The overall approach for the LOSP frequency and fail to recover probabilities utilized is consistent with industry practice.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations. However, the RICT Program will include a qualitative consideration of weather events as part of the RMA decision process when LCO 3.8.1 CTs FT Reactor coolant pump (RCP) seal LOCA modeling in the RICT program are extended to address this source of uncertainty.

Potentially all LCOs The plant has been modified to install the RCP shutdown seals developed by Westinghouse to reduce the likelihood of RCP seal leakage beyond normal values. The shutdown seal is modeled consistent with WCAP-17100 (Reference 8).

Consequential RCP Seal failure as a result of loss of seal cooling is treated through the fault tree structure.

Because a consensus industry seal LOCA model endorsed by the NRC is used, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E76 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Failure of core cooling following containment failure is LCOs for which A combination of generic and plant-specific analyses not explicitly modeled loss of containment are used to evaluate the impact of containment failure heat removal on ECCS recirculation. Failure of ECCS recirculation DRA scenarios have an effect on the RICT as a consequence of containment overpressure or isolation failure is not modeled. Since the Farley design basis does not credit containment overpressure in the RHR pump NPSH analysis, and the Farley PRA requires operable cooling through the RHR heat exchangers or containment fan coolers for success of ECCS recirculation, the loss of NPSH due to steam release from an unisolated containment is considered unlikely.

FT Therefore, this is not a key source of uncertainty and will not be an issue for RICT calculations.

E77 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions The diesel generator switchgear room coolers are not LCOs for which the Room heat up calculations performed for the diesel included in the PRA model availability of on- generator switchgear rooms shows that the realistic site ac power have equipment operability temperature limit appropriate DRA an effect on the RICT for the switchgear rooms was not exceeded after 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> loss of ventilation (Reference 16)

This may represent a source of model uncertainty because the TS equipment operability limit is lower than the realistic operability limit. The contribution of room cooling failures to DG switchgear failure will not be an issue for delta risk applications, i.e., including the room coolers in the model would affect the baseline and RICT configuration in the same manner FT and not significantly impact the delta risk calculations.

Further, the modeling is conservative for RICT in the sense that if the DG or DG switchgear were declared inoperable due to room cooling issues, a PRA functionality determination could not be made without appropriately including the room coolers and associated support equipment, and any necessary operator actions into the model. Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E78 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Credit for battery life out to two hours based on LCOs for which the The two hour battery life assumes procedurally-conservative FSAR analysis without explicit availability of on- directed load shedding has not been implemented.

representation of or credit for successful load shedding site ac power have Without recovery of DC power at two hours, DRA an effect on the RICT equipment requiring DC power (e.g., turbine-driven AFW pump (TDAFW)) is assumed unavailable after battery depletion. However, realistically assessing battery life involves other uncertainties and is complex.

Although this may represent a source of model uncertainty, it is unlikely to be an issue for delta risk applications, since the DC supply to the TDAFW pump has a four-hour rating and manual action could be FT taken to maintain the steam admission valves open beyond 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (Reference 15). Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E79 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions The use of a single value in the PRA model for Potentially all LCOs There is not a consistent method for the treatment of unrecoverable failure due to sump screen plugging for in the RICT ECCS sump performance. Unrecoverable failure of all sequences. program recirculation due to sump screen plugging is included DRA in the model for each sump intake based on NUREG/CR- 4550 (Reference 9). Although this may represent a moderate source of model uncertainty, it is not an issue for delta risk applications since sump screen plugging is not TS-specific so that the assumption affects both the baseline and RICT calculations equally.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT all sequences except ATWS. FT program calculations.

Assumption that failure of pressure relief (if required) is Potentially all LCOs For transients other than ATWS, there is significant negligible and can be ignored in the success criteria for in the RICT redundancy in RCS pressure relief capability, such that the likelihood of pressure relief failure is small and is unlikely to be an issue for delta risk applications.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E710 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Treatment of thermally-induced SGTR, and no credit for LCOs for which the During high-pressure core damage scenarios, a "race" RCS depressurization by induced hot leg or surge line LERF results may occurs to determine where the RCS will first fail. While failure and subsequent in-vessel injection. have some effect the reactor vessel will eventually fail as the molten DRA on the RICT core degrades the lower vessel head, failures may also occur in the steam generator tubes (discussed below) or in the hot leg or surge line of the reactor coolant system. For high- pressure, station-blackout-like scenarios which tend to occur on this branch, the likelihood of hot leg failure is very high. Pressure induced and thermally induced SGTR are modeled as separate events in the Level 2 event tree. If an induced SGTR does not occur then hot leg/surge line failure is evaluated in the event tree. The approach FT used is consistent with industry practice, in accordance with WCAP-16341-P (Reference 10).

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E711 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Interfacing Systems LOCA (ISLOCA) frequencies Potentially all LCOs A detailed ISLOCA analyses was performed that in the RICT involved screening of potential ISLOCA pathways, program calculation of the frequency of failure of the high DRA pressure/low pressure interface of each unscreened interfacing system, and calculation of the probability of piping or component failure in the interfacing system as a result of the exposure to high pressure.

Calculations were performed to assess the failure frequency of each scenario based on its specific configuration. These calculations are based on NSAC-154 (Reference 11) and NUREG/CR-5102 (Reference

12) with modifications as appropriate to represent differences in the Farley configuration. The impacts of FT overpressure on each of the above ISLOCA scenario pathways were evaluated using the guidelines of NUREG/CR-5862 (Reference 13).

The approach for the ISLOCA frequency determination applies state-of-the art methods.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E712 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Treatment of flow diversion paths Potentially all LCOs In the PRA model, diverted flow paths in fluid systems in the RICT are removed if the cross-sectional area of the program diversion path is less than ten percent of the cross-DRA sectional area of the main process flow path, and potential flow diversion paths that are greater than one third (1/3) the diameter of the main flow path should be further evaluated. This approach does not explicitly treat pressure effects of flow diversions from high pressure to low pressure, and no supporting thermal hydraulic analyses are performed to assess the validity of this assumption for these cases.

This should not be an important source of model FT uncertainty in most applications, particularly delta-risk applications, since the flow diversion assumptions are not TS-specific, and the assumption affects both the baseline and RICT calculations equally. Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

E713 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty TS LCOs Model Sensitivity and Disposition and Assumptions Human Error Probabilities (HEPs): Uncertainties Potentially all LCOs The FNP PRA model is based on industry consensus associated with the assumptions and method of in the RICT modeling approaches for its HEP calculations, so this calculation of HEPs for the Human Reliability Analysis program is not considered a significant source of epistemic (HRA) may introduce uncertainty.

D Detailed evaluations of HEPs are performed for the risk RA significant human failure events (HFEs) using industry consensus methods. Mean values are used for the modeled HEPs. Uncertainty associated with the mean values can have an impact on CDF and LERF results.

uncertainty.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

Refer to Enclosure 10 for additional discussion on risk management actions (RMAs).

FT E714 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.2 Assessment of Translation Uncertainty Impacts EOOS or Similar Part of Model Affected Impact on Model Disposition CRMP Model Model logic structure optimized Event trees, one-top The restructured model is logically Since the restructured model if required to increase solution model structure, equivalent and produces results produces comparable numerical speed. inserted fire initiating comparable to the baseline PRA results, this is not a source of events logic model uncertainty.

Analysis Assumptions: None support RICT Program risk assessment calculations as FNP does not include a seismic PRA.

D Incorporation of seismic bias to Calculation of RICT and RMAT within EOOS or RA similar CRMP model The addition of a bounding impact for seismic events has no impact on baseline PRA or CRMP model since it is added as an additional delta risk contribution. Impact is reflected in calculation of RICT Since this is a bounding approach for addressing seismic risk in the RICT Program, it is not a source of uncertainty, and RICT Program calculations are not impacted, so no mandatory RMAs are required.

Analysis Assumptions: A and RMAT. The use of bounding approach is conservative value for seismic acceptable per NEI 06-09 delta CDF is applicable.

Set plant availability (PAV) basic event to 1.0.

Analysis Assumptions: None FT Basic event PAV Since the CRMP model evaluates specific configurations during at-power conditions, the use of a PAV factor less than 1.0 guidance.

This change is consistent with CRMP tool practice; therefore this change does not represent a source of uncertainty, and RICT is not appropriate. This change Program calculations are not allows the CRMP model to impacted, so no mandatory RMAs produce accurate results for are required.

specific at-power configuration.

E715 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Assessment of Supplementary Fire PRA (FPRA) Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the FNP FPRA (Reference 6). The FNP FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA and because the state of knowledge in these elements continues to evolve. The Farley FPRA was developed using consensus methods outlined in NUREG/CR-6850 (Reference 7) and interpretations of technical approaches as required by NRC for approval of the NFPA-805 application. Enclosure 2 provides a detailed discussion of the Peer Review F&Os and the resolutions.

FNP used guidance provided in NUREG-1855 (Reference 2) to address uncertainties associated with FPRA for the RICT Program application. As stated in Section 1.5 of NUREG-1855:

Although the guidance does not currently address all sources of uncertainty, the guidance provided on the process for their identification and characterization and for how to factor the results into the decision making is generic and is independent of the specific source.

Consequently, the process is applicable for other sources such as internal fire, external D

events, and low power and shutdown.

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It defines:

RA A source of model uncertainty is one that is related to an issue in which no consensus approach or model exists and where the choice of approach or model is known to have an effect on the PRA (e.g., introduction of a new basic event, changes to basic event probabilities, change in success criterion and introduction of a new initiating event).

FT NUREG-1855 defines consensus model as:

A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRC has utilized or accepted for the specific risk-informed application for which it is proposed.

The potential sources of model uncertainty in the FPRA model were characterized for the 16 tasks identified by NUREG/CR-6850. This framework was used to organize the assessment of baseline FPRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations. Table E7.3 outlines sources of uncertainties by task and their disposition.

The results of this assessment concluded that no sensitivity analyses were needed.

E716 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 1 Analysis This task establishes the overall spatial scope of the The methodology for the Analysis Boundary boundary and analysis and provides a framework for organizing the and Partitioning task does not introduce any partitioning data for the analysis. The partitioning features epistemic uncertainties that would require credited are required to satisfy established industry sensitivity treatment. Therefore, RICT Program standards. calculations are not impacted, and no mandatory RMAs are required.

2 Component This task involves the selection of components to be In the context of the FPRA, the uncertainty that is Selection D

treated in the analysis in the context of initiating events and mitigation. The potential sources of uncertainty include those inherent in the internal RA events PRA model as that model provides the foundation for the FPRA.

unique to the analysis is related to initiating event identification. However, that impact is minimized though use of the PWROG Generic MSO list and the process used to identify and assess potential MSOs.

The methodology for the Component Selection task does not introduce any epistemic uncertainties that would require sensitivity 3 Cable Selection FT The selection of cables to be considered in the analysis is identified using industry guidance documents. Some systems are not credited in the FPRA and are therefore treated as being failed everywhere. The overall process is essentially the treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

The methodology for the Cable Selection task does not introduce any epistemic uncertainties that would require sensitivity treatment.

Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are same as that used to perform the analyses to required.

demonstrate compliance with 10 CFR 50.48.

E717 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 4 Qualitative Qualitative screening was not performed; however, In the event a structure (location) which could Screening some structures (locations) were eliminated from the result in a plant trip was incorrectly excluded, its global analysis boundary and ignition sources contribution to CDF would be small (with a CCDP deemed to have no impact on the FPRA (based on commensurate with base risk). Such a location industry guidance and criteria) were excluded from would have a negligible risk contribution to the the quantification based on qualitative screening overall FPRA.

criteria. The only criterion subject to uncertainty is the D

potential for plant trip. However, such locations RA expected to have a low risk contribution.

Based on the discussion of sources of would not contain any features (equipment or cables) uncertainty and the discussion above, it is identified in the prior two tasks and consequently are concluded that the methodology for the Qualitative Screening task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

5 Fire-Induced A reactor trip is assumed as the initiating event for all The identified source of uncertainty could result Risk Model FT quantification. The FPRA does not consider any special initiators (like loss of Service Water or Instrument Air) and does not consider turbine in a limited number of fire scenarios.

in the over-estimation of fire risk. In general, the FPRA development process has reviewed all significant fire initiating events and performed trip/MSIV closure events even though they may occur supplemental assessments to address this possible source of uncertainty.

Based on the discussion of sources of uncertainty and the discussion above, it is concluded that the methodology for the Fire-Induced Risk Model task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

E718 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 6 Fire Ignition Fire ignition frequency is an area with inherent Based on the discussion of sources of Frequency uncertainty. Part of this uncertainty arises due to the uncertainty, it is concluded that the methodology counting and related partitioning methodology. for the Fire Ignition Frequency task does not However, the resulting frequency is not particularly introduce any epistemic uncertainties that would sensitive to changes in ignition source counts. The require sensitivity treatment. Therefore, RICT primary source of uncertainty for this task is Program calculations are not impacted, and no associated with the industry generic frequency values mandatory RMAs are required.

7 Quantitative Screening D

used for the FPRA. This is because there is no specific treatment for variability among plants along with some significant conservatism in defining the RA frequencies, and their associated heat release rates.

Other than screening out potentially risk significant The Farley FPRA development did not screen scenarios (ignition sources), this task is not a source out any fire initiating events based on low of uncertainty. CDF/LERF contribution.

The methodology for the Quantitative Screening 8 Scoping Fire Modeling FT The framework of NUREG/CR-6850 includes two tasks related to fire scenario development. These two tasks are 8 and 11. The discussion of uncertainty for task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

See Task 11 discussion.

both tasks is provided in the discussion for Task 11.

E719 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 9 Detailed Circuit The circuit analysis is performed using standard Circuit analysis was performed as part of the Failure Analysis electrical engineering principles. However, the deterministic post fire safe shutdown analysis.

behavior of electrical insulation properties and the Refinements in the application of the circuit response of electrical circuits to fire induced failures analysis results to the FPRA were performed on is a potential source of uncertainty. This uncertainty a case-by-case basis where the scenario risk is associated with the dynamics of fire and the quantification was large enough to warrant inability to ascertain the relative timing of circuit further detailed analysis. The uncertainty D

failures. The analysis methodology assumes failures (conservatism) which may remain in the FPRA is would occur in the worst possible configuration, or if multiple circuits are involved, at whatever relative RA timing is required to cause a bounding worst-case outcome. This results in a skewing of the risk estimates such that they are over-estimated.

associated with scenarios that do not contribute significantly to the overall fire risk.

The methodology for the Detailed Circuit Failure Analysis task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory FT RMAs are required.

E720 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 10 Circuit Failure One of the failure modes for a circuit (cable) given fire Uncertainty in the circuit failure mode likelihood Mode Likelihood induced failure is a hot short. A conditional analysis could lead to assumed failures of Analysis probability is assigned using industry guidance such related components and related system as that published in NUREG/CR-6850. The functions. This would generate conservative uncertainty associated with the applied conditional results and that would typically be acceptable for failure probabilities poses competing considerations. most applications. Furthermore, a consensus On the one hand, a failure probability for spurious modeling approach is used for Circuit Failure D

operation could be applied based solely on cable scope without consideration of less direct fire affects (e.g., a 0.3 failure likelihood applied to the spurious RA operation of a motor-operated valve (MOV) without consideration of the fire- induced generation of spurious signal to close or open the MOV). The analysis has biased the treatment such that it is Mode Likelihood Analysis.

Circuit failure mode likelihood analysis was generally limited to those components where spurious operation could not be caused by the generation of a spurious signal. This approach limited the introduction of non-conservative assumed the spurious signal will always drive the uncertainties. For the simple cases, the valve in the unsafe direction. In addition, for those potential exists for assuming a failure likelihood FT valves that might have multiple desired functions -

consideration of spurious closure and consideration state is treated with a logical TRUE rather than the complement of the spurious probability. For those greater than 0 in some areas where the cables capable of causing spurious operation are not of failure to open on demand, the non-spurious failure located. Additional refinement to this approach was performed, as necessary, on risk significant scenarios. So the application of circuit failure valves that only have an active function, the potential probabilities is considered to have minimal for a spurious signal to drive the valve in the desired impact on the results.

direction is ignored.

The methodology for the Circuit Failure Mode The treatment results in skewing of the results such Likelihood Analysis task does not introduce any that the resulting risk is over-estimated. epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

E721 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 11 Detailed Fire The application of fire modeling technology is used in Consensus modeling approach is used for the Modeling the FPRA to translate a fire initiating event into a set Detailed Fire Modeling. Detailed fire modeling was of consequences (fire induced failures). The performed only on those scenarios which performance of the analysis requires a number of key otherwise would have been notable risk input parameters. These input parameters include contributors and only where removal of the heat release rate (HRR) for the fire, the growth conservatism in the generic fire modeling solution rate, the damage threshold for the targets, and the was likely to provide benefit either via a smaller D

response of plant staff (detection, fire control, and fire zone of influence or to credit automatic suppression).

RA The fire modeling methodology itself is largely empirical in some respects and consequently is another source of uncertainty. For a given set of input parameters, the fire modeling results suppression. Fire modeling was used to evaluate the time to abandonment for control room fire scenarios for a range of fire heat release rates.

The analysis methodology conservatism is primarily associated with conservatism in the heat release rates specified in NUREG/CR-6850.

(temperatures as a function of distance from the fire) A review of the generic fire modeling treatment are characterized as having some distribution summary zone of influence data indicates that the FT (aleatory uncertainty). The epistemic uncertainty arises from the selection of the input parameters (specifically the HRR and growth rate) and how the parameters are related to the fire initiating event.

While industry guidance is available, that guidance is derived from laboratory tests and may not necessarily be representative of randomly occurring events.

reduction in zone of influence is possible for smaller fires, through additional refinement of fire scenarios can be pursued using multi-point analysis of the heat release rates as opposed to the use of a bounding fire, is not significant. The potential for this slightly reduced zone of influence to reduce the consequences associated with the smaller fire is very small. Without a reduction in The fire modeling results using these input consequences a multi-point treatment of the heat parameters are used to identify a zone of influence release rate curves would have no impact on (ZOI) for the fire and cables/equipment within that results. The methodology for the Detailed Fire ZOI are assumed to be damaged. In general, the Modeling task does not introduce any epistemic guidance provided for the treatment of fires is uncertainties that would require sensitivity conservative and the application of that guidance treatment. Therefore, RICT Program calculations retains that conservatism. The resulting risk are not impacted, and no mandatory RMAs are estimates are also conservative. required.

E722 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 12 Post-Fire There are relatively few HFEs of high importance in The human error probabilities were calculated Human the FPRA model. Conservative human error using the EPRI HRAC and included the Reliability probability (HEP) adjustments were made to the consideration of loss of necessary cues due to Analysis nominal HEP values used in the FPIE model then fire. The impact of any remaining uncertainties is revisited to address unique fire considerations. Given expected to be small.

the methodology used, the impact of any remaining uncertainties is expected to be small. The methodology for the Post-Fire Human 13 Seismic-Fire Interactions DRA Since this is a qualitative evaluation, there is no quantitative impact with respect to the uncertainty of Reliability Analysis task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

The qualitative assessment of seismic induced fires should not be a source of model uncertainty Assessment this task. as it is not expected to provide changes to the quantified FPRA model.

FT The methodology for the Seismic- Fire Interactions Assessment task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

E723 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task # Description Sources of Uncertainty Disposition 14 Fire Risk As the culmination of other tasks, most of the The selected truncation was confirmed to be Quantification uncertainty associated with quantification has already consistent with the requirements of the PRA been addressed. The other source of uncertainty is Standard.

the selection of the truncation limit. However, the selected truncation limit is several orders of The methodology for the Fire Risk Quantification magnitude below the typical CDF value calculated, task does not introduce any epistemic and is consistent with the requirements of the PRA uncertainties that would require sensitivity 15 Uncertainty and Sensitivity Analyses D

Standard.

RA This task does not introduce any new uncertainties.

This task is intended to address how the fire risk assessment could be impacted by the various sources of uncertainty.

treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

This task does not introduce any new uncertainties. This task is intended to address how the fire risk assessment could be impacted by the various sources of uncertainty.

The methodology for the Uncertainty and 16 FPRA Documentation FT Sensitivity Analyses task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

This task does not introduce any new uncertainties to This task does not introduce any new the fire risk. uncertainties to the fire risk as it outlines documentation requirements.

The methodology for the FPRA documentation task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

E724 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty As noted above, the FNP FPRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC for approval of the NFPA-805 application. Therefore, consistent with NUREG-1855 guidance, FPRA modeling does not introduce any epistemic uncertainties that would require sensitivity treatment to the RICT Program risk assessment calculations.

References

1. Topical Report NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Revision 0-A, November 2006.

2. NUREG-1855, Guidance on the treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report, March 2009.

3. Farley Nuclear Plant Units 1 and 2 Internal Events PRA Model: Revision 9 Version 3, D

PRA-BC-F-14-001, January 9, 2014

4. Appendix D to F-RIE-IEIF-U00-013, Characterizing the Sources of Model Uncertainty RA for Farley Nuclear Plant, September 2011.

5. TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, Electric Power Research Institute, Final Report, December 2008.

6. Farley Nuclear Plant Unit 1 Fire Probabilistic Risk Assessment Summary Report:

Revision 5, PRA-BC-F-11-017, August 2014.

FT

7. EPRI/NRC-RES, Fire PRA Methodology for Nuclear Power Facilities, EPRI1011089-NUREG/CR-6850, August 2005.

8. WCAP-1700-NP, PRA Model for the Westinghouse Shut Down Seal, Revision 1, Non-proprietary, Westinghouse Electric Company, January 2010.

9. NUREG/CR-4550, Analysis of Core Damage Frequency From Internal Events:

Methodology Guidelines, Revision 1, Sandia National Laboratory for U.S. NRC, 1989

10. WCAP-16341-P, Revision 0, Simplified Level 2 Modeling Guidelines, Westinghouse Electric Company, November 2005.

11. NSAC-154, ISLOCA Evaluation Guidelines, ERIN Engineering and Research, Inc.

(prepared for Electric Power Research Institute), September 1991.

12. NUREG/CR-5102, Interfacing Systems LOCA: Pressurized Water Reactors, Brookhaven National Laboratory for U.S. NRC, February 1989.

13. NUREG/CR-5862, Screening Methods for Developing Internal Pressure Capacities for Components in Systems Interfacing with Nuclear Power Plant Reactor Coolant Systems, U.S. NRC, May 1992.

E725 to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

14. NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants,"

U.S. NRC, December 2005

15. Joseph M. Farley Nuclear Plant Units 1 and 2, Accident Sequence Notebook PRA Model Revision 9, Version 1.2, September 2010.

16. NAI-1551-006, Revision 1, Farley Nuclear Plant Units 1 and 2 Auxiliary and Control Building GOTHIC Room Heat-up Analysis PRA cases, August 2014.

DRA FT E726

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 8 Program Implementation DRA FT to NL-18-0039 Program Implementation Table of Contents

1.0 INTRODUCTION

.................................................................................................. 3 2.0 RICT PROGRAM PROCEDURES ....................................................................... 3 2.1 On-Line Configuration Risk Management Program ................................... 4 2.2 Risk Management Actions for the Risk Informed Completion Time Program ..................................................................................................... 4 2.3 Calculation of RMAT and RICT for the RICT Program:.............................. 5 2.4 PRA Functionality Determination ............................................................... 6 2.5 Recording LCOs ........................................................................................ 7 3.0 RICT PROGRAM TRAINING................................................................................ 8 3.1 Level 1 Training ......................................................................................... 9 3.2 Level 2 Training ......................................................................................... 9 4.0 3.3 D

Level 3 Training ......................................................................................... 9 REFERENCES ................................................................................................... 10 RA FT E8-2 to NL-18-0039 Program Implementation 1.0 Introduction This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk Informed Completion Time (RICT) Program including training of the personnel required for implementation of the RICT Program. Several procedures and processes are detailed in Enclosures 5, 9, and 10; those discussions are not repeated as part of this enclosure. Those topics include Probabilistic Risk Assessment (PRA) Maintenance and Update process (Enclosure 5), Cumulative Risk Assessment and Performance Monitoring Program (Enclosure 9), and Risk Management Actions (Enclosure 10).

2.0 RICT Program Procedures The procedures discussed below were developed for implementing the RICT Program for the SNC fleet, and are currently in effect for Vogtle Electric Generating Plant. They will be adopted for use in implementing the FNP RICT program. They provide guidance to the appropriate SNC personnel on the following topics:

• On-Line Configuration Risk Management Program (CRMP, Reference 2):

This procedure provides requirements for Implementation of the RICT program while in Modes 1 & 2. In addition, it provides requirements for D

outlining planning and scheduling strategies to minimize risk (in terms of core damage frequency (CDF, ICDP) and large early release frequency (LERF,ILERP)), and meeting requirements necessary for maintaining and RA retaining a chronological history of configuration changes and their risk impacts (in terms of CDF,ICDP,LERF, and ILERP) throughout the operating cycle

• Risk Management Actions (RMAs) for the RICT Program (Reference 3):

This instruction provides requirements for development and implementation FT of RMAs for the RICT program.

Calculation of RMAT and RICT for the RICT Program (Reference 4):

This procedure provides detailed requirements and limitations of the RICT Program at Southern Nuclear Company. It includes the calculation of RICT and RISK MANAGEMENT ACTION TIMES (RMAT). This procedure is applicable to sites that have an approved license amendment to use the RICT Program.

• PRA Functionality Determination (Reference 5):

This procedure provides requirements for determining whether structures, systems and components (SSCs) that are declared inoperable can be considered PRA FUNCTIONAL in RICT calculations.

• Recording Limiting Conditions for Operation (Reference 6):

This procedure provides instructions to the control room operator for using the interface between the control room electronic narrative log and CRMP.

E8-3 to NL-18-0039 Program Implementation The procedures discussed above may be revised or supplemented by other procedures, as deemed necessary to implement the RICT Program effectively at FNP Units 1 and 2. They are described in more detail below.

2.1 On-Line Configuration Risk Management Program This procedure (Reference 2) describes, in general terms, the CRMP, as it pertains to the RICT Program as well as parts of the 10 CFR 50.65(a)(4) program. It is the parent procedure for both these programs.

With respect to the RICT Program, this procedure has the following attributes:

• Identifies the plant management individual with the authority to approve entry into the RICT Program.

• Details the plant conditions under which the RICT Program is applicable.

• Acts as the overarching guidance for the SNC risk assessment and risk management procedures.

• Contains important definitions for the RICT Program.

• Details many of the requirements, per NEI 06-09 Revision 0-A (Reference 1), for the D

RICT Program.

Identifies departmental and position responsibilities within the RICT program.

Outlines the requirement to identify and implement Risk Management Actions (RMAs) when the RMAT is exceeded or is anticipated to be exceeded.

RA Describes the necessary attributes for the SNC CRMP tool.

The above guidance is consistent with NEI-06-09 (Reference 1).

The CRMP procedure is maintained as a SNC procedure. It is managed by the Fleet Work Control Manager and is under the ownership of Fleet Work Management (FWM). The ownership FT of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.2 Risk Management Actions for the Risk Informed Completion Time Program This procedure (Reference 3) describes the risk assessment and management processes for the SNC fleet of nuclear plants. It provides general guidelines for the risk assessment and management of maintenance activities, both planned and emergent. This procedure is a sub-tier procedure to the On-Line CRMP, described above.

Risk Management Actions are targeted toward RMA candidates in order to manage and control increases in CDF/LERF attributed to internal events, fire events, and other hazards modeled in CRMP which include the following:

• Identify RMA candidates which identify SSCs, initiating events and fire zone considered important for a given plant configuration when a RICT is implemented.

• Develop RMAs using RMA candidates and develop additional RMAs, as appropriate.

• Communicate RMAs to Operations, Fire Protection personnel, and other affected departments to facilitate RMA planning and RMA implementation.

E8-4 to NL-18-0039 Program Implementation

• Implement RMAs for conditions which require RMA implementation as required prior reaching RMAT.

• Document implementation of RMAs in the Control Room Narrative Log. The time of actual implementation and removal of RMAs should be documented. This may be accomplished in multiple log entries.

The risk management procedure also indicates that while the Outage and Scheduling department is responsible for the planning, scheduling and assessing planned maintenance items, the site Operations department is primarily responsible for the evaluation of emergent work for the RICT Program. This evaluation includes the risk assessments and the calculation of the RMATs and RICTs.

The Risk Management Actions program guidance is maintained as a SNC procedure. It is primarily utilized by the Outage and Scheduling and Operations Departments under the ownership of Fleet Work Management. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.3 D

Calculation of RMAT and RICT for the RICT Program:

This procedure (Reference 4) provides requirements and limitations of the RICT program at RA SNC. It includes the guidance necessary for the calculation of RMATs and RICTs for the RICT Program. It provides the steps necessary to perform the automated calculation using the CRMP tool, as well as providing the necessary steps for a manual calculation.

For planned maintenance, personnel from the Outage and Scheduling department will calculate the RICT Program values. For emergent work, the calculation will be performed by the FT Operations department. If plant conditions demand that the Operations department is unable to perform the calculations, this responsibility is delegated to the Outage and Scheduling department personnel. However, entry into a Technical Specification Limiting Condition for Operation (LCO) Action statement is the responsibility of the licensed operators; this is also true for the RICT Program. Consequently, even though Outage and Scheduling may calculate a RICT in anticipation of some future entry into the RICT Program, the actual RICT will be put into place by the control room staff. In other words, the on-shift licensed operators and shift management will be generating the paperwork necessary for entry into the RICT Program, just as they do for entry into an LCO Action statement. Additionally, the Plant Manager is responsible for approving entry into the RICT Program and approving changes to RICT Maintenance States.

The RMAT and the RICT risk levels are referenced to the Core Damage Frequency (CDF) and the Large Early Release Frequency (LERF) associated with the zero-maintenance state. The actual calculation evaluates the Incremental CDF (ICDF) and the Incremental LERF (ILERF) to determine the RMAT and RICT values. The evaluation is performed using the single top internal events PRA model, Fire PRA model, a bounding seismic analysis, and a bounding control room abandonment fire analysis that will be used until detailed fire modeling has been completed for these scenarios and is incorporated into the CRMP model.

The procedure contains the following guidance, restrictions and limitations, which are based on, and consistent with, NEI 06-09 (Reference 1):

E8-5 to NL-18-0039 Program Implementation

• Prohibitions from entering the RICT Program voluntarily during a TS Loss of Function (LOF) Condition or when all trains or subsystems of equipment required by the TS LCO would be inoperable, unless PRA functionality has been established.

• Guidance on the use of RMAs, including the conditions under which they may be credited in calculations.

• Conditions under which a RICT Program may not be used.

• States that a RICT may not go beyond the 30 day back stop limit.

• States that a RICT may not go beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for a Loss of Function (LOF) Condition.

• Guidance on plant configuration changes, for example, the procedure requires recalculating the RICT and RMAT within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of the change.

• Conditions for exiting the RICT Program.

The above procedural guidance is maintained in a SNC procedure, as well as in the FNP Technical Specifications. As already mentioned, the calculation of RICT Program values are the responsibility of the Operations department (emergent conditions) and the Outage and Scheduling group (planned conditions). The procedure is managed by Fleet Work Management (FWM) and is under the direction of the FWM Manager. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be 2.4 D revised to note that it is also applicable to FNP Units 1 and 2.

RA PRA Functionality Determination This procedure (Reference 5) provides requirements for determining whether structures, systems and components (SSCs) that are declared inoperable can be considered PRA functional in RICT calculations. This procedure lists three specific conditions under which an inoperable SSC is considered PRA Functional, based NEI 06-09 guidance (Reference 1).

They are as follows:

FT

1) Condition 1: If the SSC is declared inoperable due to degraded performance parameters and the PRA success criteria are met, then the component may be considered PRA functional, subject to the following:

• The degraded condition must be identified, and there is a reasonable expectation that additional degradation will not occur during the RICT.

• For example, a valve fails its in-service testing stroke time acceptance criteria, but the response time of the valve is not relevant to the ability of the valve to provide its mitigation function as required in the PRA; therefore, the valve may be considered PRA functional.

2) Condition 2: If the condition causing the inoperability impacts one or more functions modeled in CRMP, and the inoperable SSC is still capable of supporting one or more functions modeled in CRMP, then the unaffected function(s) may be considered PRA functional.

• For example, a valve is inoperable but secured in the closed position. Supported functions of the valve listed in a FNP RICT System Guideline require the valve to open and close. The condition can be addressed in CRMP by failing functions which require an open valve, but the valve may be considered PRA functional for functions which require a closed valve.

E8-6 to NL-18-0039 Program Implementation

3) Condition 3: If the condition causing the inoperability impacts only function(s) that are not modeled in CRMP and the FNP RICT System Guideline states the affected function(s) has no risk impact, then the SSC may be considered PRA functional.

• For example, a pump backup start feature is inoperable and the feature is not credited in the PRA model (assumed failed); the RICT calculation may assume availability of the associated pump since the risk of the nonfunctional backup start feature is part of the baseline risk.

If the RICT program determines an SSC is not PRA Functional, the SSC will be treated as failed for the RICT calculation.

The following additional conditions are applicable when a PRA Functionality evaluation is performed when a RICT is applied to a TS LOF Condition:

1) One train is required to be PRA Functional.

2) Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the Technical Specifications safety function, i.e., alternative SSCs D

cannot replace the SSCs covered by the TSs.

3) Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality during a Technical Specifications loss of RA function condition where a RICT is applied.

4) A 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> RICT backstop applies.

5) A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of function if a PRA Functionality determination that reflects the plant FT configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria When a situation arises requiring a PRA Functional assessment, site Operations department will perform the assessment and determine whether or not a specific SSC may be considered PRA Functional. RIE personnel will support the Operations personnel on an as-needed basis during the PRA Functional assessment. If the Technical Specification Front Stop will be exceeded in less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the formal evaluation will be performed as soon as possible.

The above guidance is maintained in SNC procedures. It is used primarily by Operations and RIE personnel with Operations personnel having the primary responsibility for making PRA Functionality determinations. The procedure is managed by the Administrative department and is under the direction of the FWM Manager. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.5 Recording LCOs This procedure (Reference 6) provides the Operations department with the guidance for maintaining Control Room Operator narrative logs and LCO logs as well as other control room documentation. It will be revised to address the RICT Program in a manner consistent with the E8-7 to NL-18-0039 Program Implementation existing equivalent guidance for Vogtle Units 1 and 2 (Reference 7) prior to implementation of the RICT program at FNP. The Recording LCOs procedure provides the guidance necessary for the operation of the interface tool between the operator narrative log and LCO log with the CRMP monitor.

A software interface facilitates updating CRMP when the Control Room Operators remove (or return) a component to service that affects the risk profile. The procedure provides the steps for the Operators to perform when updating their electronic narrative log and LCO log to ensure the updated status is adequately transferred to CRMP. A RICT can still be entered, managed and exited by manually entering equipment service status and LCO conditions into CRMP at the discretion of the user if the automated interfaces are unavailable, or if the user elects to not use the automatic interface capability. The Control Room Operators and the Shift Supervisor have responsibility for maintaining their respective logs. Information entry for the narrative log and LCO log (or the CRMP interface) is primarily the responsibility of the Control Room Operator at-the-controls.

The above procedural guidance is maintained as a FNP Operations departmental procedure. It is used by the FNP Operations department, and Operations management is responsible for its content and maintenance. The ownership of this procedure is subject to change if deemed appropriate.

3.0 DRA RICT Program Training The scope of the training for the RICT Program will include training on rules for the new TS program, CRMP modifications, TS Actions included in the program, and procedures. This training will be conducted for SNC site and corporate personnel. The personnel that will require training are as follows:

Site Personnel Licensed) FT

• Operations Site Functional Area Manager

• Operations Personnel (Licensed and Non-

• Operations Training

• Outage & Scheduling Site Functional Area Manager Corporate Personnel

• Operations Corporate Functional Area Manager

• Outage & Scheduling Corporate Functional Area Manager

• Nuclear Licensing Corporate Functional Area Manager and Site Functional Area

• Outage & Scheduling Personnel Manager

• Work Week Managers

• Nuclear Licensing Personnel

• Nuclear Licensing Site Personnel

• Risk Informed Engineering Management

• Selected Maintenance Personnel

• Selected Risk Informed Engineering

• Site Engineering Personnel

• Risk Informed Engineering Site Risk

• Other Management Analyst and Backups

• Other Management Training will be carried out in accordance with SNC training procedures and processes (e.g.,

Reference 8). These procedures were written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training. SNC has developed three levels of training for implementation of the RICT Program at Vogtle Units 1 and 2, and these will be adopted for E8-8 to NL-18-0039 Program Implementation training for implementation of the RICT Program at FNP once the FNP RICT program is approved. They are described below:

3.1 Level 1 Training This is the most detailed training. It is intended for the individuals who will be directly involved in the implementation of the RICT Program. This level of training includes the following attributes:

• Specific training on the revised Technical Specifications

• New Record Keeping Requirements

• Case Studies

• Hands-on time with the CRMP monitor o Calculating a RMAT and RICT

• Identifying appropriate Risk Management Actions (RMA)

• Determining PRA Functionality

• Common Cause Failure Considerations 3.2 D

Level 2 Training This training is geared towards Supervisors, Managers, and individual contributors who need to understand the RICT Program. It is significantly more detailed than Level 3 Training (described below), but it is different from Level 1 Training in that hands-on time with the CRMP monitor and RA Case Studies are not included. The concepts of the RICT Program will be taught, but this group of personnel will not be qualified to perform the tasks of the Control Room Operators or the Work Week Managers.

3.3 Level 3 Training FT This training will be intended for the remaining personnel who should have an awareness of the RICT Program. These employees need basic knowledge of RICT Program requirements and procedures, but they do not need working knowledge of these requirements and procedures.

This training will cover RICT Program concepts that are important to disseminate throughout the organization.

All of the above training will be conducted within the procedural guidance set forth in SNCs Training and Qualification procedures (e.g., References 9 and 10).

E8-9 to NL-18-0039 Program Implementation 4.0 References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322)

2. Southern Nuclear Company NMP-GM-031, On-Line Configuration Risk Management Program

3. Southern Nuclear Company NMP-GM-031-003, Risk Management Actions for 10 CFR 50.65(a)(4) and the Risk Informed Completion Time Program, Version 4.0, October 2017.

4. Southern Nuclear Company NMP-GM-031-002, Calculation of RMAT and RICT for the RICT Program, Version 2.0, October 2017.

5. Southern Nuclear Company NMP-GM-031-004, PRA Functionality Determination, Version 2.0, October 2017.

D

6. Farley Nuclear Plant FNP-0-SOP-0.13, Recording Limiting Conditions for Operation, Version 34, May 2017

7. Vogtle Electric Generating Plant Units 1 and 2, 10008-C, Recording Limiting RA Conditions for Operation, Version 31, October 2017

8. Southern Nuclear Company NMP-TR-104, SNC Training Committees, Version 15.0

9. Southern Nuclear Company NMP-TR-415, Systems Operator Initial and Continuing Training Program, Version 5.0 FT

10. Southern Nuclear Company NMP-TR-416, Licensed Operator Continuing Training Program Administration, Version 8.0 E8-10

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Enclosure 9 DRA Cumulative Risk and Performance Monitoring Program FT to NL180039 Cumulative Risk and Performance Monitoring Programs Table of Contents

1.0 INTRODUCTION

.................................................................................................. 2 2.0 RISK INFORMED APPLICATIONS ...................................................................... 2 3.0 PERFORMANCE MONITORING PROGRAM ...................................................... 2

4.0 REFERENCES

..................................................................................................... 3 DRA FT E91 to NL180039 Cumulative Risk and Performance Monitoring Programs 1.0 Introduction This Enclosure provides summaries of the three procedures that govern the implementation of the Southern Nuclear Operating Company (SNC) Risk-Informed Completion Time (RICT)

Programs Calculation of Cumulative Risk and Performance Monitoring.

Calculation of cumulative risk for the RICT Program is discussed in step 14 of Section 2.3.1 and step 7.1 of Section 2.3.2 of Topical Report NEI 06-09, Revision 0-A (Reference 1). The Performance Monitoring Program is discussed in Section 2.3, Element 3 of Regulatory Guide (RG) 1.174 (Reference 2). Further elaboration on the Performance Monitoring Program is found in Section 3 of RG 1.177 (Reference 3). The NRCs Safety Evaluation of NEI 06-09 (Reference

1) requests that the above procedures be discussed in the License Amendment Request.

The procedures referred to are currently effective with respect to the approved Vogtle RICT program and will be made effective for FNP once the RICT program is approved for implementation at FNP.

2.0 D

Risk Informed Applications This procedure contains the instructions for the calculation of cumulative risk. The Risk Informed Engineering (RIE) Department is the procedure owner and the RIE site engineer is RA responsible for executing the procedure. The procedure requires the calculation of cumulative risk at least every fuel cycle, not to exceed 24 months.

The procedure requires gathering historical data with respect to RICT Program entries for an assessment period which, as previously mentioned, is one fuel cycle, not to exceed 24 months.

The procedure provides the method for calculating the cumulative Incremental Core Damage (Reference 2).

FT Probability (ICDP) and Incremental Large Early Release Probability (ILERP). These values are then converted into average annual values which are then compared to the limits of RG 1.174 If any limits are exceeded, a Condition Report (CR) is written to ensure the data is reviewed to assess the cause and to implement any necessary corrective actions to ensure future plant operation is within the guidance. This evaluation assures that RMTS program implementation meets RG 1.174 (Reference 2) guidance for small risk increases.

The procedure further instructs personnel to document the periodic assessment in a calculation including the cumulative risk, the method of monitoring the cumulative risk, comparison with RG 1.174 limits (Reference 2), and any condition reports issued including references to items that track development and/or completion of corrective actions. This procedure is under the oversight of the RIE department.

3.0 Performance Monitoring Program Performance Monitoring is described in the Maintenance Rule implementation procedure as well as the On-Line Configuration Management procedure. This procedure is currently applicable to E92 to NL180039 Cumulative Risk and Performance Monitoring Programs Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

The purpose of performance monitoring is to monitor the effects of the RICT on a particular SSCs performance which has had its Completion Time (CT) extended by the RICT Program. In other words, this program is used to ensure that the use of the RICT program, for a specified SSC, does not degrade the performance of that SSC over time. The SSCs in the scope of the RICT program are also in the scope of the Maintenance Rule. Additionally, it does not alter the system or train Operability requirements with respect to the number of systems and trains required to be Operable nor does it change the stated TS performance criteria (e.g. flow rate, response times, stroke times, setpoints, etc.).

These procedures are under the oversight of the Engineering Systems Department (Maintenance Rule Implementation) and Work Management (On-Line Configuration Risk Management Program). The RIE site engineer has the primary responsibility for the execution of performance monitoring program for the Risk Informed Completion Time Program. The D

ownership of these procedures is subject to change as deemed appropriate.

Monitoring the actual performance of a component under the Maintenance Rule is done on a RA monthly basis. Consequently, if it is determined that the RICT was the cause, or a contributing factor, in exceeding Maintenance Rule performance criteria, corrective actions are initiated.

Although others are possible, these actions may include a moratorium on future entries into pre-planned RICTs for a period of time, or restricting the use of a RICT for specific configurations or components. Whatever the corrective actions, they are communicated to the site RIE Engineer for his or her evaluation.

4.0 References FT

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322

2. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis, US Nuclear Regulatory Commission, Revision 2, May 2011.

3. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, US Nuclear Regulatory Commission, Revision 1, May 2011.

E93 0 to NL-18-0039 Risk Management Action Examples Introduction This enclosure describes the process for identification of Risk Management Actions (RMAs) applicable during extended Completion Times and provides examples of RMAs. RMAs for the Farley Nuclear Plant (FNP) Risk Informed Completion Time (RICT) Program are governed by an SNC fleet wide procedure. This procedure contains guidance for the determination and implementation of RMAs when entering the RICT Program and is consistent with the guidance provided in Topical Report NEI 06-09, Revision 0-A (Reference 1).

Responsibilities The Outage and Scheduling group is responsible for developing the RMAs with support from the Risk Informed Engineering (RIE) site engineer and the Operations department on an as-needed basis. The Operations department is responsible for the implementation of RMAs. For example, if it is anticipated that a planned activity will exceed its Risk Management Action Time (RMAT), the Outage and Scheduling department will propose and develop RMAs. However, the Operations department will ultimately approve or disapprove such actions and, if approved, implement them. The same is the case for emergent activities (although in those cases it may be necessary for the Operations department to develop and implement the RMAs).

D Procedural Guidance RA For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the RMAT will be exceeded. The RMAs are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. RMAs may also be required to address the potential for a common cause failure. Additionally, if an emergent event occurs, requiring re-calculation of a RMAT already in place, the procedure requires a re-evaluation of the existing RMAs for the new FT plant configuration to determine if new RMAs are appropriate.

RMAs are put in place no later than the point at which an incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. Furthermore, if (as the result of an emergent event) the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1E-3 or 1E-4 events per year, respectively, RMAs are required to be implemented. These requirements are consistent with the guidelines provided in NEI 06-09 (Reference 1). Also for emergent activities, if a high degree of confidence cannot be established that a common cause failure has not occurred, RMAs shall be implemented prior to the front stop being reached, specifically to address the common cause possibility. RMAs to address the potential for common cause are not required if the RICT is numerically adjusted to account for the possibility of the common cause failure.

The RIE site engineer, or other designated risk analyst, will provide support on an as-needed basis for determining which RMAs are appropriate for minimizing the impact of changes in core damage risk. By determining which SSCs are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be identified and implemented to protect these SSCs. Additionally, the CRMP-generated Remain in Service list is an important information source for determining these important SSCs. The Remain in Service list provides a list of in-service SSCs that have a high impact on risk for a particular plant configuration. This listing is obtained on-demand by the CRMP user.

E10-2 0 to NL-18-0039 Risk Management Action Examples It is also possible to credit RMAs to affect the RICT Program calculations. However, such quantification of RMAs is not required. As stated in the procedure, omission of such a computation will result in conservative RICT Program values. However, if RMAs are to be credited, the procedure provides guidance on determining the risk impact of the RMA on RICT calculations. These include, but are not limited to, determination of RMA risk impacts on new temporary equipment functions and new or modified human actions. In addition, actions credited are required to be proceduralized and the implementing staff must be trained.

Types of Risk Management Actions Topical Report NEI 06-09 (Reference 1) classifies RMAs into three categories. These three categories are each addressed in the SNC RMA fleet-wide procedure. They are described below:

1) Actions to increase awareness and control.

A good example of this is a shift brief or a pre-job brief. Additionally, training (formal or informal) can serve to increase awareness.

D To increase control, the procedure suggests having the system engineer, or other system expert, present for the duration of the activity or certain portions of the activity. Also, a special purpose procedure may be written and used which includes the identification of the RA associated risk and also includes contingency plans in case of unexpected occurrences, including approaching the end of a RICT.

2) Actions to reduce the duration of maintenance activities.

This may be accomplished by pre-staging materials, conducting training on mock-ups, performing the activity around the clock, and performing walk downs on the actual system(s)

FT to be worked on prior to beginning work.

3) Actions to minimize the magnitude of the risk increase.

The previously mentioned CRMP generated Remain in Service list is used to assist in determining these actions. For example, work may be stopped or minimized on safety systems redundant to the system or component being removed from service, or maintenance minimized on other systems that adversely affect the CDF or LERF.

Minimizing work on systems that may cause a trip or transient would also be a prudent action to take to minimize the likelihood of an initiating event that the out of service component is designed to mitigate.

Other measures that serve to minimize risk include actions like establishing temporary systems to supply power or ventilation and rescheduling or shortening other risk significant work, if possible.

4) Actions to minimize the risk of a common cause failure Many of these RMAs are similar to those presented above. This could include precluding activities that increase the likelihood of the type of event the inoperable component is intended to mitigate. Prohibiting switchyard work is an example of this type of RMA. Also, E10-3 0 to NL-18-0039 Risk Management Action Examples systems redundant to the inoperable component could be protected, as well as redundant components within the same inoperable system.

Examples The RMA procedure provides examples of types of RMAs. Examples of RMAs that are considered during a RICT Program entry are provided in the items below:

A. Examples of RMAs that are considered during a diesel generator (DG) RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions; (2) Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit; (3) Deferral of maintenance that affects the reliability of the trains associated with the (4)

(5)

D operable DGs; Deferral of planned maintenance activities on station blackout mitigating systems, RA and treating those systems as protected equipment; Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.

B. Examples of RMAs that are considered during a safety related battery RICT, so that the (1)

(2)

(3)

FT increased risk is reduced and to ensure adequate defense in depth, are:

Limit the immediate discharge of the affected battery, if possible; Recharge the affected battery to float voltage conditions using a spare battery charger, if possible; Evaluate the remaining battery capacity and protect its ability to perform its safety function; and (4) Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries.

C. Examples of RMAs that are considered during a two required offsite circuits RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2) Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance.

E10-4 0 to NL-18-0039 Risk Management Action Examples (3) Maintain availability of offsite power to defer any planned activities with the potential to generate a grid disturbance.

(4) Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

(5) Consider staging a portable generator per procedure NMP-OS-019-361, which would accelerate connection to a 4160 VAC bus in the event of a station blackout.

D. Examples of RMAs that are considered during a required offsite circuit and DG RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit.

(2) Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance.

(3)

(4)

(5)

D Maintain availability of offsite power to/from RAT A, maintain Operability of both DGs, and maintain Operability of 4160 V safety buses.

RA Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

Consider staging a portable generator per procedure NMP-OS-019-361, which would accelerate connection to a 4160 VAC bus in the event of a station blackout.

(6)

(7)

(8)

FT The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions.

Deferral of maintenance that affects the reliability of the trains associated with the operable DGs.

Deferral of planned maintenance activities on station blackout mitigating systems, and treating those systems as protected equipment.

(9) Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.

E. Examples of RMAs that are considered during a loss of a DC train RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2) Establish 24/7 staffing and response teams to ensure prompt restoration of operability of the chargers E10-5 0 to NL-18-0039 Risk Management Action Examples (3) Work to establish alternate power to the 125 V DC bus by temporary modification or by implementation of FLEX procedures (4) Maintain Operability and availability of redundant and diverse electrical systems.

(5) Maintain/establish Operability/availability of important mitigating SSCs.

(6) Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

F. Examples of RMAs that are considered during RICT for load sequencer A, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2) Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance (3)

(4)

D Establish 24/7 staffing and response teams to ensure prompt restoration to operability of sequencer A.

RA Perform a beginning of shift brief that focuses on actions operators will take in response to a loss of offsite power or safety injection. Include review of local emergency start of DG A per procedure 13145-1, manual tie to bus 1AA02 per procedure 13427-1, and manual bus loading.

(5)

FT Maintain Operability and availability of redundant and diverse electrical systems by performing the following actions:

a. Establish protection of the following SSCs against inadvertent operation or contact that may impede the SSC from fulfilling its design function: RAT A, RAT B, DG A, sequencer B, bus 1AA02, and bus 1BA03, and

b. Terminate any in-progress testing or maintenance activities with the potential to impact the aforementioned SSCs, and

c. Defer any scheduled testing or maintenance activities with the potential to impact the aforementioned SSCs.

(6) Maintain/establish Operability/availability of additional important mitigating SSCs.

Identify risk-significant SSCs, either from a pre-plan or by real-time use of CRMP importance reports. Perform the following actions:

a. Terminate any in-progress testing or maintenance activities with the potential to impact the availability of important in-service SSCs, and

b. Defer any scheduled testing or maintenance activities with the potential to impact important in-service SSCs,

c. Promptly return to service any important out-of-service SSCs.

E10-6 0 to NL-18-0039 Risk Management Action Examples G. Examples of RMAs that are considered during an AC subsystem RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Terminate any in-progress maintenance/testing activities and defer any scheduled maintenance/testing activities with the potential to cause loss of 4160 V AC bus.

Also, avoid unnecessary switching (e.g., breaker manipulations on B train AC and DC electrical systems).

(2) Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable AC bus.

(3) If power cannot be readily restored through the inoperable AC bus, work to establish temporary modifications providing power to important loads fed from the inoperable bus.

(4) Maintain operability and availability of inoperable subsystems remaining electrical SSCs, as well as the other subsystems electrical SSCs.

H. Examples of RMAs that are considered during an AC vital subsystem RICT, so that the (1)

(2)

D increased risk is reduced and to ensure adequate defense in depth, are:

Limit the potential for a loss of offsite power by terminating all activities in the low RA voltage and high voltage switchyard.

Maintain operability and availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.

(3) Maintain/establish Operability/availability of important mitigating SSCs.

I.

(4)

(5) FT Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable SSC.

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

Examples of RMAs that are considered during an DC subsystem RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2) Maintain operability and availability of redundant and diverse electrical systems.

(3) Maintain/establish Operability/availability of important mitigating SSCs.

(4) Work to establish alternate power to the 125 V DC bus by temporary modification or by implementation of FLEX procedures.

(5) Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

E10-7 0 to NL-18-0039 Risk Management Action Examples J. Examples of RMAs that are considered during an inverter RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1) Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2) Maintain operability and availability of DC electrical systems in the subsystem within the same train and the redundant subsystem in the other train (e.g. if the inverter in subsystem A is inoperable, maintain operability in the subsystems B and C),

associated 480 V bus, and associated regulating transformer.

(3) Maintain/establish Operability/availability of important mitigating SSCs.

(4) Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable inverter.

(5) Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

References DRA

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322).

FT E10-8