"Draft Meeting" is not in the list (Request, Draft Request, Supplement, Acceptance Review, Meeting, Withholding Request, Withholding Request Acceptance, RAI, Draft RAI, Draft Response to RAI, ...) of allowed values for the "Project stage" property.

Text

Joseph M Farley March 12, 2018, Public Meeting - Draft 4b Application Enclosures
	ML18065A025
Person / Time
Site:	Farley
Issue date:	03/06/2018
From:	Shawn Williams; Plant Licensing Branch II
To:	;
	Williams S, NRR/DORL/LPLII-1
Shared Package
ML18065A015	List: ML18065A020; ML18065A022; ML18065A025;
References
	Download: ML18065A025 (167)
	v • d • e

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 1

Table of Contents 1.0 Introduction........................................................................................................... 2 2.0 Requirements Related to Scope of FNP PRA Model........................................... 2 3.0 Technical Adequacy of FNP Internal Events and Internal Flooding PRA Model... 2 3.1 RG 1.200 Peer Review for FNP Internal Events PRA Model against ASME PRA Standard Requirements.................................................................... 3 3.2 Resolution of Findings from RG 1.200 Internal Events Peer Review......... 3 4.0 Technical Adequacy of FNP Fire PRA Model..................................................... 45 4.1 RG 1.200 Peer Review for FNP Fire PRA Model against ASME PRA Standard Requirements........................................................................... 45 4.2 Resolution of Findings from RG 1.200 Fire PRA Peer Review................ 46 5.0 General Conclusions Regarding PRA Capability................................................ 73 6.0 References......................................................................................................... 73 DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 2

1.0 Introduction This enclosure provides information on the technical adequacy of the Farley Nuclear Plant (FNP) Probabilistic Risk Assessment (PRA) internal events model (including flooding) and the FNP fire PRA model in support of the License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 1).

NEI 06-09, as clarified by the NRC final safety evaluation (Reference 1), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool required to implement this risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.174 requirements for risk-informed plant-specific changes to a plant's licensing basis.

SNC employs a multi-faceted approach to establishing and maintaining the technical adequacy and fidelity of PRA models for all operating SNC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the FNP PRA.

Section 2 of this enclosure describes requirements related to the scope of the FNP PRA internal events model. Section 3 outlines requirements for the internal events PRA from RG 1.200 and how these are met. Section 4 similarly outlines requirements for the fire PRA from RG 1.200 and how these are met. Section 5 provides general conclusions. Finally, Section 6 lists references used in the development of this enclosure.

2.0 Requirements Related to Scope of FNP PRA Model The FNP internal events PRA model as referenced in the peer review (Reference 11) is an at-power model (i.e., it directly addresses plant configurations during plant modes 1 and 2 of reactor operation). The model includes both at-power internal events core damage frequency (CDF) and large early release frequency (LERF). Internal flooding is included in both the CDF and LERF models. Note that this portion of the FNP PRA model does not incorporate the risk impacts of external events. The treatment of seismic risk and other external hazards for this application is discussed in Enclosure 3. Various PRA notebooks were used for disposition information contained within Tables E2-2 and E2-4, which are available for inspection.

3.0 Technical Adequacy of FNP Internal Events and Internal Flooding PRA Model NEI 06-09 requires that the PRA be reviewed to the guidance of Regulatory Guide 1.200, Revision 0 (Reference 5) for a PRA which meets Capability Category (CC) II for the supporting requirements of the American Society of Mechanical Engineers (ASME) internal events at power PRA standard (Reference 6). It also requires that deviations from these capability categories relative to the RICT program be justified and documented. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09 (Reference 2) takes exception to the reference to RG 1.200, Revision 0, currently listed throughout TR NEI 06-09, Revision 0.

The NRC staff requires an assessment of PRA technical adequacy using RG 1.200, Revision 1, and the updated PRA standard which, at the time, was ASME RA-Sb-2005.

The FNP PRA has been subjected to a number of peer reviews and self-assessments, including one performed in accordance with the 2009 version of the PRA Standard (Reference 6) as endorsed with clarifications by RG 1.200, Revision 2 (Reference 3). The FNP PRA Peer review conducted in March 2010 was performed using the process defined in NEI 05-04 (Reference DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 3

13) and it was a full-scope peer review. NEI 05-04 (Reference 13) guidance supplants the NEI 00-02 (Reference 10) guidance for conducting a peer review. The results of the RG 1.200 peer review (Capability Category and Findings) are described in Section 3.1. Section 3.2 summarizes the resolution of findings identified in the RG 1.200 peer review.

The information provided in this section demonstrates that the FNP internal events PRA model (including flooding) meets the requirements of RG 1.200.

3.1 RG 1.200 Peer Review for FNP Internal Events PRA Model against ASME PRA Standard Requirements The 2009 version of the PRA Standard (Reference 6) contains a total of 326 numbered supporting requirements (SRs) in fourteen technical elements and one configuration control element. Eight of the SRs were determined to be not applicable to the FNP PRA. Thus, a total of 318 SRs are applicable.

Among 318 applicable SRs, 92% met Capability Category II or higher, as shown in Table E2-1.

Table E2-1. Summary of FNP Capability Categories Capability Category Met No. of SRs

% of total applicable SRs CC-I/II/III (or SR Met) 213 66.8%

CC-I 9

2.8%

CC-II 30 9.4%

CC-III 12 3.8%

CC-I/II 13 4.2%

CC-II/III 24 7.6%

SR Not Met 17 5.4%

Total 318 100%

Seventeen SRs were judged to be not met. These were IE-C5, AS-C2, SY-A6, SY-C1, HR-G7, HR-I3, IFEV-B3, IFPP-B2, IFPP-B3, IF-QUA7, IF-SNA4, IFSN-B3, IFSO-B3, QU-A5, QU-C2, QU-F1, and MU-B4. An additional 9 SRs met CC-I, but not CC-II. These were: IE-A5, IE-A9, IE-B3, HR-D2, HR-G1, LE-C2, LE-C9, LE-C11, and LE-C12. The peer review generated 40 Findings. These Findings and their resolutions are described in Section 3.3. These include resolution of the Findings related to the 17 SRs that were not met, and to 5 of the 9 SRs judged to be CC-I. Findings were not issued for the LE SRs judged to be not met, but a discussion of those 4 SRs is also provided in Section 3.2. Thus, the FNP internal events PRA (including flood) meets the requirements of RG 1.200.

3.2 Resolution of Findings from RG 1.200 Internal Events Peer Review Table E2-2 shows the details of the 40 Findings and the associated resolutions developed after the peer review. Resolution of these Findings results in all SRs met to at least Capability Category II. Also included are discussions of the 4 LE SRs judged to be CC-I, but for which no findings were issued.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 4

Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-A5-01 PERFORM a systematic evaluation of each system, including support systems, to assess the possibility of an initiating event occurring due to a failure of the system. USE A STRUCTURED APPROACH [SUCH AS A SYSTEM-BY-SYSTEM REVIEW OF INITIATING EVENT POTENTIAL, OR A FAILURE MODES AND EFFECTS ANALYSIS (FMEA), OR OTHER SYSTEMATIC PROCESS]

TO ASSESS AND DOCUMENT THE POSSIBILITY OF AN INITIATING EVENT RESULTING FROM INDIVIDUAL SYSTEMS OR TRAIN FAILURES.

There is no evidence of a system by system review of the Farley systems to verify no additional initiators exist. A systematic review of the Farley systems and trains should be performed to ensure that all potential initiators are identified and that the initiators are grouped properly on the basis of impact and frequency.

Add a systematic review of the safety and non-safety systems that could cause a plant scram to verify that no additional initiators are needed.

Resolved This F&O is resolved.

A systematic review of the Farley safety and non-safety systems was performed that resulted in the development of a Table C-1 Farley Initiating Event Identification Analysis which is documented as part of the Farley Initiating Event Notebook. This table lists each Farley system ordered by a system group identifier, system ID, system description, impact of system loss and treatment of system loss in Farley PRA. The treatment of system loss addressed specifically whether the loss of a system would result in an initiating event and how the initiating event was grouped. There is no impact on the PRA model since no additional initiators are identified.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 5

Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-A7-01 In the identification of the initiating events, INCORPORATE (a) events that have occurred at conditions other than at-power operation (i.e.,

during low-power or shutdown conditions), and for which it is determined that the event could also occur during at-power operation (b) events resulting in an unplanned controlled shutdown that includes a scram prior to reaching low-power conditions, unless it is determined that an event is not applicable to at-power operation Section 2 states that events occurring during Modes 3-6 are considered to determine if they are applicable at-power. Appendix B-1 includes events that occurred at power levels less than 10%. However, the review does not seem to look at the event applicability for Mode 1. Two of the reactor trips at 0%

power were due to Source Range Monitors (SRMs). These events would not be applicable to the at-power analysis since the SRM would be replaced by the APRMs for Mode 1.

Clarify the review of the LPSD events included in Appendix B-1 and how they are included in the plant specific frequency analysis.

Resolved This F&O is resolved.

These two events were reviewed and it was determined that they should be removed from the plant specific frequency analysis. Appendix B-1 of the Initiating Events Notebook was revised to reflect the changes to the analysis.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 6

Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-A9-01 REVIEW plant-specific operating experience for initiating event precursors, for identifying additional initiating events. FOR EXAMPLE, PLANT-SPECIFIC EXPERIENCE WITH INTAKE STRUCTURE CLOGGING MIGHT INDICATE THAT LOSS OF INTAKE STRUCTURES SHOULD BE IDENTIFIED AS A POTENTIAL INITIATING EVENT.

There is no indication that IE precursors such as intake clogging have been performed. Precursor reviews generally include a significant plant event that did not cause a scram but could have if prompt action is not taken.

Review significant non-scram events at the plant to determine if any precursors exist.

Resolved This F&O is resolved.

A search was performed using the Condition Reports database for significant non-scram events. A comparison of the results was made to Farleys initiating events list.

No new initiating event precursors to plant trips were found. Added methodology and review results in Appendix A of the Initiating Events notebook There is no impact on the PRA model since no additional initiating event precursors are identified.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 7

IE-A10-02 For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g., multi-unit LOOP events or total loss of service water) that may impact the model.

The Farley IE notebook indicates that failure of the Service Water (SW) pond dam was included as a special initiator.

However, a search of the model did not locate the dam failure. Further, the probability of a loss of the SW pond dam is estimated to be 1.9e-7 failures per year based on the FNP River Water Study (dated 1982). This analysis is based on a generic estimate of 1.9e-5 failures per year for earthen filled dams that in the opinion of Alabama Power Company should be reduced to 1.9e-7 per year due to design, monitoring, maintenance, and responsiveness of the owner to problems. Loss of the dam would result in a dual unit loss of service water. For an event of the magnitude of a dual unit loss of service water, the supporting evidence for reduction of the generic value by a factor of 100 is treated very lightly. An initiating event that would result in a dual event initiator should be included in the initiating event portion of the model. Evidence for reducing the generic dam failure probability is qualitative in nature, and the extension of this information to justify a factor of 100 reduction in the generic probability is not clear and poorly supported. Further, dam failure analysis technology has improved since 1982, and use of the newer approaches to analysis should be considered.

Resolved A sensitivity analysis was performed to show SW Pond Dam failures contribution to the CDF and LERF.

This F&O is resolved Based on the dam failure assessment study, it was concluded that loss of SW due to a random failure of the dam as an initiating event does not need to be modeled in the internal events PRA based on the screening criteria in IE-C6 (b) of the ASME PRA Standard (Reference 6).

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 8

Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition Consider revisiting the estimation of the probability of dam failure using newer technology and better supported calculation. Add the loss of the SW pond dam to the model, if appropriate.

IE-B1-01 COMBINE initiating events into groups to facilitate definition of accident sequences in the Accident Sequence Analysis and to facilitate quantification.

Events are grouped in general categories. It is not clear that the impact on systems are similar or that the grouped event frequency includes these events Loss of Turbine Building Cooling is grouped with loss of Service Water.

However, the frequency for these events is expected to be similar and may have different impact on the PSA systems.

Other potential groupings, such as the 7300 bus and 4.16 KV buses identified through the operator interviews were not clearly grouped. In other cases, the review of the events from NUREG/CR-3862 and NUREG/CR-5500 are not directly tied to an initiating event class.

Include the impact of the initiator (especially the transient events) on the PSA systems in the model.

Resolved This F&O is resolved.

Table C-1 Farley Initiating Event Identification Analysis was created and documented in the Farley Initiating Event Notebook. This table lists each Farley system ordered by a system group identifier, system ID, system description, impact of system loss and treatment of system loss in Farley PRA. The treatment of system loss addressed specifically whether the loss of a system would result in an initiating event and how the initiating event was grouped.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 9

Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-C1-01 CALCULATE the initiating event frequency accounting for relevant generic and plant-specific data unless it is justified that there are adequate plant-specific data to characterize the parameter value and its uncertainty.

In section 4 of the initiating event notebook, Farley discusses the quantification of the vessel rupture frequency. They present the WASH-1400 median frequency of 1E-07 with the associated error bounds but then proceed to treat that value as a mean.

This is mathematically incorrect and introduces a slight non-conservative bias. It is not likely to impact the overall results.

Calculate the mean from the median and error factor and use that in the quantification. (Mean should be about 2.7E-07.) There is also a newer generic source that has a better number.

Resolved This F&O is resolved.

Revised section 4.1 of the Initiating Events notebook and added reference 18 (PWROG project: PA-RMSC-0463) to the reference section to include a more current data source.

IE-C5-01 CALCULATE initiating event frequencies on a reactor year basis.

INCLUDE in the initiating event analysis the plant availability, such that the frequencies are weighted by the fraction of time the plant is at power.

Farley did calculate their initiating event frequencies on a reactor year basis.

However, they did not modify the resultant frequencies to address plant availability. Discussions with the Farley staff indicated that the adjustment was not made as part of quantification either.

The frequencies are slightly conservative.

The initiating event frequency should be modified to address plant availability.

This can be done by multiplying each initiating event frequency by the availability factor or the adjustment can be done as part of the quantification.

Resolved This F&O is resolved.

The adjustment has been made as part of the model quantification. Appendix B-2 of the Initiating Events notebook contains the development of the annual average availability factor.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 10 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-C15-01 CHARACTERIZE the uncertainty in the initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results.

Table 7 of the Farley Initiating Events Notebook presents the initiating event frequencies for the special initiators but does not characterize the uncertainty.

The special initiators are quantified using fault tree analysis so the uncertainty intervals inherently can be quantified based on the uncertainty data for basic events. However, the variance is not presented and there is no discussion of this beyond stating that the frequencies are calculated using fault trees. This is a documentation issue.

There is no indication that the uncertainty was not included in the overall model quantification.

Document how the uncertainty for the special initiators was characterized/

quantified as part of the discussion in section 3.3 of the Initiating Events Notebook.

Resolved This F&O is resolved This is a documentation issue:

As discussed in the issue statement, the uncertainty of special initiating event is evaluated during quantification process.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 11 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IE-D1-01 DOCUMENT the initiating event analysis in a manner that facilitates PRA applications, upgrades, and peer review.

Farley did document their initiating event analysis. However, the structure and content of the documentation was such that it was often difficult to trace the identification, grouping and quantification of the IEs in an easy to follow manner. This issue was identified in virtually all Technical Elements of the Farley PRA. It was often difficult to determine what Farley had done to address a given SR and required detailed evaluation of the model and many discussions with the Farley PRA staff. One part of the problem was that in several places, the documentation reflected an earlier version of the model (Version 8 versus Version 9) or did not match the model (treatment of miscalibration errors). This made the PRA difficult to review. However, of greater concern, the documentation could only support applications or updates if a knowledgeable/

experienced engineer was involved. This touches on virtually all PRA documents.

1. Ensure that the documentation reflects the latest version of the model.

2. Review the documentation to see if it has sufficient content and is structured such a less experienced engineer can understand the analysis.

Resolved This F&O is resolved.

Many documents including initiating event notebook and documentation reflecting an earlier version have been updated since the peer review was performed.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 12 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition AS-C2-01 DOCUMENT the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results.

In the discussion of large, medium, and small Loss Of Coolant Accidents (LOCAs), the operator failure to transfer to low head recirculation is discussed.

For large LOCAs, this error is OAR_A_1- -----H, and for other LOCAs (or event trees) the error is OAR_A_2----

--H. The only difference between the two errors is timing. However, the discussion of OAR_A_2------H indicates that the operator must manually align Component Cooling Water (CCW) cooling to the Residual Heat Removal (RHR) heat exchanger. The discussion of OAR_A_1------H does not include the requirement for the operator to realign CCW to the RHR heat exchanger. The two errors appear to have been modeled correctly, but the difference in the description in the AS notebook is confusing.

Add the discussion of the operator realigning CCW to the RHR heat exchanger to the description of OAR_A_1------H.

Resolved This F&O is resolved.

The description for OAR_A_1--

H in the Accident Sequence notebook was revised to note that operator action is still required to align CCW cooling to the RHR heat exchanger. to be consistent with the description of OAR_A_2------H.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 13 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition AS-C2-02 DOCUMENT the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results.

Table 2.6-1 of the Farley AS notebook identifies events %LOSSACF and

%LOSSACG as Loss of Power to 4kV Bus F and Loss of Power to 4 kV Bus G, respectively. However, the table in Section 2.6.4 identifies these events as Loss of 4160 V Bus F and Loss of 4160 V Bus G, respectively. These two events (Section 2.6.4) are not recoverable by the EDGs because of damage to the respective buses. In Section 2.6.4, the events Loss of Power to 4 kV Bus F and Loss of Power to 4 kV Bus G are labeled as %LOSPF and %LOSPG, respectively. Initiating events %LOSPF and %LOSPG are not included in Table 2.6-1. Table 2.6-1 is incomplete because it is lacking initiating events %LOSPF and %LOSPG. Table 2.6-4 incorrectly characterizes initiating events

%LOSSACF and %LOSSACG.

Add initiating events %LOSPF and

%LOSPG to Table 2.6-1. Correct the descriptions of initiating events

%LOSSACF and %LOSSACG in Table 2.6-4.

Resolved This F&O is resolved.

The Accident Sequence notebook was revised to correctly reference the loss of bus initiating events. The descriptions of the %LOSSACF and %LOSSACG events in Section 2.6.4 were not changed because they are correct. Instead, the descriptions for those events were corrected in Table 2.6-1 and events %LOSPF and

%LOSPG were added to Table 2.6-1. Documentation was revised.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 14 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SC-A2-01 SPECIFY the plant parameters (e.g., highest node temperature, core collapsed liquid level) and associated acceptance criteria (e.g., temperature limit) to be used in determining core damage.

SELECT THESE PARAMETERS SUCH THAT THE DETERMINATION OF CORE DAMAGE IS AS REALISTIC AS PRACTICAL, IN A MANNER CONSISTENT WITH CURRENT BEST PRACTICE. DEFINE COMPUTER CODE-PREDICTED ACCEPTANCE CRITERIA WITH SUFFICIENT MARGIN ON THE CODE-CALCULATED VALUES TO ALLOW FOR LIMITATIONS OF THE CODE, SOPHISTICATION OF THE MODELS, AND UNCERTAINTIES IN THE RESULTS, IN A MANNER CONSISTENT WITH THE REQUIREMENTS SPECIFIED UNDER The maximum core temperature of two cases of Medium LOCA (CL3-MLO-S2 and CL5-MLO-S1) exceeds 1800F early times after accident, but they are considered as success. In the MAAP analysis notebook describes "only exceeded 1800°F for less than 6 min; considered success." (Appendix B, Table B-1) In addition, there are two SGR cases (S1 and S2) in which the core temperature is oscillating unstably, exceeding 1800 F in some of the later oscillations. It is not clear that these or successes or that a stable configuration has been achieved. It is not clear that the identified cases cannot meet the success criteria for core damage.

First possible resolution is to perform analysis using another tool instead of MAAP (e.g., a more detailed model that would allow a higher core damage temperature as a success criterion) for these two cases. Second one is to describe the details in the notebook why the analyst assumes these cases as success.

Resolved This F&O is resolved.

While the core damage criteria of 1800°F was exceeded for a short period of time, these 2 MAAP cases are considered successful pertaining to the core damage success criteria. has been added to Success Criteria notebook to address the maximum core temperature of two cases of Medium LOCA (CL3-MLO-S2 and CL4-MLO-S1). Refer to disposition of SC-A5-01 for resolution of the SGR cases noted.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 15 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SC-A5-01 SPECIFY an appropriate mission time for the modeled accident sequences. For sequences in which stable plant conditions have been achieved, USE a minimum mission time of 24 hr.

Mission times for individual SSCs that function during the accident sequence may be less than 24 hr, as long as an appropriate set of SSCs and operator actions are modeled to support the full sequence mission time. For sequences in which stable plant conditions would not be achieved by 24 hr using the modeled plant equipment and human actions, PERFORM ADDITIONAL EVALUATION OR MODELING BY USING AN APPROPRIATE TECHNIQUE.

There are two SGR cases, S1 and S2, for which the maximum core temperature is oscillating wildly beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , sometimes exceeding 1800

°F. These cases are evidently considered as successes, though it is not evident that a stable configuration has been reached at 24 or even 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . In addition, there are cases for which the mission time is listed as less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months without explanation.

Either do additional calculations to show the two SGR cases are successes or provide adequate explanation of why they are considered successes and a stable condition has been reached. In addition, provide additional explanation of the mission times that are shorter than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Resolved This F&O is resolved.

MAAP analysis was performed using MAAP 4.0.8 to address two SGR cases. The calculation showed that the maximum core temperature did not oscillate and did not exceed 1800 F for the cases.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 16 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SC-B3-01 When defining success criteria, USE thermal/hydraulic, structural, or other analyses/evaluations appropriate to the event being analyzed, and accounting for a level of detail consistent with the initiating event grouping and accident sequence modeling.

The current success criteria for LOCAs are based on plant capabilities and system responses. Although the definitions for small, medium and large break LOCAs are reasonable based on this criteria, the specific break sizes associated with the transitions between the LOCA definitions have not been adequately justified. Currently the break sizes are based on the original IPE criteria and no thermal hydraulic analyses of the break sizes have been performed. Per the requirement, thermal hydraulic evaluations are required at a level of detail to support the definitions/break sizes so that the appropriate initiating event frequencies can be determined. Several utilities PRAs were dramatically impacted when the MAAP code was used to determine actual break sizes and some utilities determined that an additional fourth size LOCA was required to adequately model their plant. This has the potential to dramatically impact the CDF.

Resolved This F&O is resolved.

MAAP analyses were performed for a 6 break LOCA which is a lower end of large LOCA spectrum and upper end of the medium LOCA spectrum. The MAAP analyses shows that the LOCA is able to be mitigated by either medium LOCA success criteria or large LOCA success criteria..

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 17 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SC-B3-01 (continued)

See above Supplemental Comments:

This comment is a general comment on thermal-hydraulic analysis for Farley.

More plant-specific analysis would be required. According to your notebook, break sizes for MAAP analysis are as follows:

- Large LOCA : 8.25 ft2 (about 39 in diameter)

- Medium LOCA : 2.18E-02 ft2, 4.91E-02ft2, 1.36E-01ft2 (2 in, 3in, 5 in diameter)

- Small LOCA : 7.64E-04ft2, 5.45E-03ft2, 2.18E-02ft2 (0.37 in, 1 in, 2 in diameter)

The above break sizes are different from NUREG/CR-6928 (Reference 14).

Furthermore, they do not appear to explicitly cover the full range of potential LOCAs (from 5 inches up to 39 inches does not appear to be explicitly addressed).

See above See above DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 18 SC-B3-01 (continued)

See above According to NUREG/CR-6928 (Reference 14), the break sizes for LOCA are defined as follows:

- LLOCA : greater than 6 inches inside diameter (D.2.2) ---> about 0.2 ft2

- MLOCA : between 2 and 6 inches inside diameter (D.2.4) -- -> about 0.02 ft2 ~ 0.2 ft2

- SLOCA : between 0.5 and 2 inches inside diameter (D.2.19) ---> about 0.00005 ft2 ~ 0.02 ft2 The success criteria change for the different break classes but there is no analysis to show that the success criteria are appropriate for both the upper and lower end of the break spectrums. For example, the primary difference between LLOCA and MLOCA is typically the number of accumulators required and possibly the number of pumps required. The primary difference between MLOCAs and SLOCAs is that secondary side heat removal is needed for small LOCAs. However, the MAAP analyses do not show that for LOCAs greater than 2 inches, the break is sufficient to remove decay heat while below 2 inches secondary heat removal is required. More and appropriate selection of break size would be required, such as 6 inches, 0.5 inches, etc. Develop LOCA break sizes based See above See above DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 19 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition on Farley specific flow capacities and required systems.

SC-B5-01 CHECK the reasonableness and acceptability of the results of the thermal/hydraulic, structural, or other supporting engineering bases used to support the success criteria.

This SR requires that the reasonableness and acceptability of the SC results be verified. Although there was a table added the Success Criteria (SC) notebook (during the last few days prior to the peer review) that compares the SCs for Farley to SCs for Summer and Turkey Point, there was no text discussing the table, how the comparison was done, and the reasonableness/ acceptability of any differences between Farley and either Summer or Turkey Point. This is a documentation issue rather than a technical issue since the comparison was apparently done. However, there is no basis in the documentation to determine whether the work to actually verify the reasonableness of the SCs was completed in accordance with the intent of the standard.

Add discussion to the system notebook that references Table B and, at least at a high level, explains how the comparison was done and what was done if differences were found. At least, provide a couple of examples to illustrate this process.

Resolved This F&O is resolved.

New text concerning the reasonableness of the SCs has been incorporated into Sections 3.0 of Success Criteria notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 20 SY-A8-01 ESTABLISH the boundaries of the components required for system operation. MATCH the definitions used to establish the component failure data.

In the diesel generator model, the diesel generator, the output breakers, the fuel oil transfer pumps, the sequence relays and the Local Control Panel are all modeled individually. However, Farley uses NUREG/CR-6928 (Reference 14) as the source of their generic diesel generator data and collects plant specific data in accordance with the 6928 component boundaries. The NUREC/CR-6928 (Reference 14) diesel generator component boundary explicitly includes the output breaker and the fuel oil system (without much definition)

Thus, the component boundaries as used in the Farley diesel generator system model do not match the component boundaries used for collecting the failure data. Furthermore, the component boundaries used to derive the generic common cause boundaries do not match the component boundaries used to develop the generic failure rates. For the most part, Farley has made the appropriate adjustments to match the two divergent data sets.

However, the generic common cause data for diesel generators had an event whose description was such that it could be interpreted as either involving fuel oil transfer pumps or not. The decision was made to include the event as a diesel failure because it would be conservative.

The component boundary definitions in the Systems and Data Analysis Resolved This F&O is resolved.

The modeling approach is valid because:

i)

The modeled fuel oil transfer pumps are external fuel oil pumps to makeup day tanks which are not sufficient to supply fuel oil to DGs for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. The pumps are required to makeup fuel oil from storage tank.

ii)

DG Output circuit breaker, sequence relays and the Local Control Panel are modeled separately because thee of five Farley DGs are shared by two units. Even though explicit modeling of the circuit breaker is somewhat conservative, the proper dependency model is reflected in the model.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 21 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition Notebooks were not very detailed so this was difficult to identify.

Farley needs to adjust their data collection and quantification to collect and quantify the diesel generator system failure data consistent with how the system is modeled. Farley also needs to review their component boundary definitions to ensure that they are sufficiently detailed to identify exactly what is included within each component and that are consistent from the model to the system notebooks to the data analysis notebook to the common cause failure analysis.

SY-A9-01 If a system model is developed in which a single failure of a super component (or module) is used to represent the collective impact of failures of several components, PERFORM the modularization process in a manner that avoids grouping events with different recovery potential, events that are required by other systems, or events that have probabilities that are dependent on the scenario.

The system model boundary is not clearly defined between the notebook and the model. Example is room cooling for Emergency Core Cooling System (ECCS) system is model as part of the system but is listed as a dependent system to the ECCS. AFW discussion of boundary includes condensate tank and steam supply up to steam generators, but later in the notebook defines condensate and steam supply as support systems. See also SY-A8-01 for diesel boundary issues.

Resolved This F&O is resolved.

The system notebooks were reviewed and modified as needed to reflect the boundary of the system as shown in the model. The support system sections were reviewed and corrected as needed to reflect the support systems as modeled. Farley PRA System Analysis Notebooks.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 22 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SY-A23-01 DEVELOP system model nomenclature in a consistent manner to allow model manipulation and to represent the same designator when a component failure mode is used in multiple systems or trains.

The system model nomenclature did not consistently use the fault tree guideline definitions in the naming convention.

Examples include: guide has FW as feedwater system but model uses MF as system designator, RF component type identifier is not match the guide, room coolers are modeled with the system supporting. The room cooler system designator is the same as the ECCS pump.

Farley should review their naming convention and make sure it is applied consistently in all models.

Resolved This F&O is resolved.

The naming conventions have been updated in the Farley Fault Tree Analysis Guidelines notebook. Specifically the identifier FW was changed to MF for Main Feedwater and the component description for identifier RF was changed to Refrigeration Unit.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 23 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SY-B6-01 PERFORM engineering analyses to determine the need for support systems that are plant-specific and reflect the variability in the conditions present during the postulated accidents for which the system is required to function.

The room heatup calculations for the Engineered Safety Features (ESF) pump rooms and ESF electrical equipment rooms are excellent. But some calculation results are mismatched with documents and references, the others are conservatively applied into fault tree model. Description of Ref.12 and HVAC system notebook are mismatched with Ref.4. The calculations results show the temperature of the ESF equipment rooms during 30 days after loss of Heating, Ventilation and Air Conditioning (HVAC) condition. Some document errors occurred using 30-day calc. results.

If the calc. results for ESF pump rooms and electrical equipment rooms would be checked for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , temperature of some rooms will be lower than the limit.

If then, the system fault trees does not develop "room cooling failure" any more for those cases. Descriptions should be matched.

Resolved This F&O is resolved.

This is a documentation issue.

The references were corrected.

The model was checked for conservative room cooler failure modeling as a result of interpretation of the calculation results. The HVAC model for the Engineered Safety Features (ESF) pump rooms and ESF electrical equipment rooms were updated based on up-to-date room heatup calculations. Farley PRA System Analysis Notebooks.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 24 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition SY-C1-01 DOCUMENT the systems analysis in a manner that facilitates PRA applications, upgrades, and peer review.

In section 6.1.7 of the system notebooks for AFW, CCW, Containment Cooling, Containment isolation, Containment Spray, ECCS, IA, MS, SW incorrect reference information to test and maintenance is provided.

Farley needs to correct the references for test and maintenance information.

Resolved This F&O is resolved.

This is a documentation issue.

The references were corrected.

Farley PRA System Analysis Notebooks.

HR-D2-01 FOR SIGNIFICANT HFES, USE DETAILED ASSESSMENTS in the quantification of pre-initiator HEPs. USE SCREENING VALUES BASED ON A SIMPLE MODEL, SUCH AS ASEP IN THE QUANTIFICATION OF THE PREINITIATOR HEPS FOR NONSIGNIFICANT HUMAN FAILURE BASIC EVENTS. When bounding values are used, ENSURE they are based on limiting cases from models such as ASEP.

Farley develops detailed restoration errors for three events and applies this probability to most of the remaining events without any specific evidence through procedures or tests that the events are similar enough that the same values should apply. The values for these restoration errors could be significantly over-estimated since the value applied is not shown to be directly applicable to the event analyzed.

Detailed analysis should only be applied to the event analyzed or to directly applicable events where procedures and actions are similar (SW pump trains with identical restoration type errors through similar procedures).

Perform detailed analysis on all events to verify the applicability used or use screening values for those events not explicitly analyzed with a detailed analysis.

Resolved This F&O is resolved.

A revision to Table 8-2 of the HRA notebook has been incorporated providing a more detailed explanation of the approach used. The pre-initiator approach relies on detailed THERP assessments that are mapped to similar HFEs.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 25 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition HR-D2-02 FOR SIGNIFICANT HFES, USE DETAILED ASSESSMENTS in the quantification of pre-initiator HEPs. USE SCREENING VALUES BASED ON A SIMPLE MODEL, SUCH AS ASEP IN THE QUANTIFICATION OF THE PREINITIATOR HEPS FOR NONSIGNIFICANT HUMAN FAILURE BASIC EVENTS. When bounding values are used, ENSURE they are based on limiting cases from models such as ASEP.

The screening probability used for unanalyzed events is 1E-4. This is significantly lower than the base screening HEP from ASEP which is median failure rate of 3E-2. Even if credit is taken for a recovery factor such as post-maintenance testing or independent verification, then the screening value would be approximately 8E-3. The screening values used are significantly below the screening values recommended in Technique for Human Error Rate Prediction (THERP) and Accident Sequence Evaluation Program (ASEP).

Review the Pre-accident HRA screening values that are used and be consistent with ASEP as discussed in the SR.

Resolved This F&O is resolved.

A revision to Table 8-2 of the HRA notebook has been incorporated providing a more detailed explanation of the approach used. The pre-initiator approach relies on detailed THERP assessments that are mapped to similar HFEs.

HR-G1-01 PERFORM DETAILED ANALYSES FOR THE ESTIMATION OF HEPS FOR SIGNIFICANT HFES.

USE SCREENING VALUES FOR HEPS FOR NONSIGNIFICANT HUMAN FAILURE BASIC EVENTS.

The top HRA events in the QU notebook are not developed in the HRA notebook.

Example 1RTOPMANRTNSGH and OMG_A_2-------H. These events appear in several of the top 50 cutsets and are thus significant to the risk assessment Develop HRAs for these events and include in the HRA calculation.

Resolved This F&O is resolved.

Included the events in the HRA calculator (section 10.92 and 10.93) file using applicable values found in appropriate references (NUREG CR-5500 and WCAP-15831).

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 26 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition HR-G7-01 For multiple human actions in the same accident sequence or cut set, identified in accordance with supporting requirement QU-C1, ASSESS the degree of dependence, and calculate a joint human error probability that reflects the dependence. ACCOUNT for the influence of success or failure in preceding human actions and system performance on the human event under consideration including (a) time required to complete all actions in relation to the time available to perform the actions (b) factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.) (c) availability of resources (e.g.,

personnel)

The top HRA cutset combinations in the QU notebook are not addressed in the HRA dependency analysis. These events appear in several of the top 50 cutsets and are thus significant to the risk assessment Explicitly evaluate the top HRA combinations in the dependency analysis.

Resolved This F&O is resolved.

An HRA Dependency Analysis was conducted and incorporated into the Revision 9 model quantification. This analysis has been incorporated into the HRA notebook as Attachment C.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 27 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition HR-G7-02 For multiple human actions in the same accident sequence or cut set, identified in accordance with supporting requirement QU-C1, ASSESS the degree of dependence, and calculate a joint human error probability that reflects the dependence. ACCOUNT for the influence of success or failure in preceding human actions and system performance on the human event under consideration including (a) time required to complete all actions in relation to the time available to perform the actions (b) factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.) (c) availability of resources (e.g.,

personnel)

Attachment C to the HRA notebook performs the dependency assessment, but the dependency factors are based upon 2004 HRA values. The multiplication factors in the rule file are to be based upon current HRA. The recovery rules seem to address dependence with factors greater than one and only then for 5 events. This is not consistent with the dependence methods.

Update the HRA dependence evaluation to be consistent with industry practices.

Resolved This F&O is resolved.

An HRA Dependency Analysis was conducted and incorporated into the Revision 9 model quantification. This analysis has been incorporated into the HRA notebook as Attachment C.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 28 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition HR-I3-01 DOCUMENT the sources of model uncertainty and related assumptions associated with the human reliability analysis.

Assumptions are listed in the individual HRA analyses. However, some major assumptions normally associated in an HRA analysis, such as default minimum values for pre-and post-accident HRAs, are not included in the analysis. In addition, uncertainty based on using the same HRA probability for all manual valve misalignments is ripe for an uncertainty evaluation. Also the HRA calculation does not address the different types of uncertainty that is included in other Farley document packages. Review the EPRI report on HRA uncertainties and see if any will apply to Farley. Documentation of sources of uncertainty is required by the SR Include a source of uncertainty in the HRA calculation.

Resolved This F&O is resolved.

A document was created to address HRA Uncertainty for the Farley Revision 9 model. It can be found as Attachment F in the HRA notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 29 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition DA-C14-01 EXAMINE coincident unavailability due to maintenance for redundant equipment (both intrasys-tem and intersystem)

THAT IS A RESULT OF A PLANNED, REPETITIVE ACTIVITY based on actual plant experience.

CALCULATE coincident maintenance unavailabilities that are a result of a planned, repetitive activity that reflect actual plant experience. Such coincident maintenance unavailability can arise, for example, for plant systems that have installed spares (i.e., plant systems that have more redundancy than is addressed by tech specs).

Several of the data sets used in the Farley database are based on information that is getting dated. The period over which these data were collected is 1984 through 2001, or earlier. The affected data sets include Table 4 (simultaneous maintenance on redundant equipment), offsite power recovery, and plant-specific data used for failure rates, probabilities, and unavailability. For RIR application, periodically updated plant specific data is required.

These data sets need to be updated using more recent information.

Resolved This F&O is resolved.

The data were updated using more recent industry generic data and plant specific experience data.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 30 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFPP-B2-02 DOCUMENT the process used to identify flood areas. For example, this documentation typically includes (a) flood areas used in the analysis and the reason for eliminating areas from further analysis (b) any walkdowns performed in support of the plant partitioning The IF notebook provides descriptions about flood areas within four (4) buildings, such as auxiliary building, diesel building, service water intake structure, and turbine building. There is no description about the other buildings.

Even though they are not risk-significant, the description about the reason why those buildings are not analyzed is needed. The screened/ eliminated areas are not considered in the analysis.

Possible resolution is to add information about the screened/eliminated areas and buildings in terms of internal flooding analysis.

Resolved This F&O is resolved.

New text concerning screened/eliminated areas and buildings has been incorporated into the Section 3.1 of the Flooding notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 31 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFPP-B2-03 DOCUMENT the process used to identify flood areas. For example, this documentation typically includes (a) flood areas used in the analysis and the reason for eliminating areas from further analysis (b) any walkdowns performed in support of the plant partitioning Even though Farley has areas that are common between both units the documentation of how multi-unit impacts were addressed could not be located.

Discussions with the Farley PRA staff did reveal that Farley had considered multi-unit effects, However, the documentation of how Farley explicitly considered the potential for multi-unit floods is not well presented.

The IF Notebook needs to be updated to address the potential for multi-unit floods or the propagation of a flood in one unit to the other unit via shared spaces.

Farley needs to explicitly describe how they dealt with the evaluation multiunit effects for areas where there shared spaces. The basis for any screening of such areas should be explicitly described in the text as well as in the screening table.

Resolved This F&O is resolved.

New text concerning multi-unit impacts has been incorporated into the Section 3 and 12.5 of the Flooding notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 32 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFSN-A2-01 For each defined flood area and each flood source, IDENTIFY plant design features that have the ability to terminate or contain the flood propagation. INCLUDE the presence of (a) flood alarms (b) flood dikes, curbs, sumps (i.e.,

physical structures that allow for the accumulation and retention of water) (c) drains (i.e., physical structures that can function as drains) (d) sump pumps, spray shields, water-tight doors (e) blowout panels or dampers with automatic or manual operation capability The flood analysis does discuss the potential effect of: alarms, structure such as curbs and sumps, drains, sump pumps, watertight doors; However any direct application of these factors was hard to find. The factors most often explicitly credited was the credit for jacketed piping eliminating spray considerations and air/water tight doors stopping propagation.. The remarks column in table 7-1 does seem to reference hatches as propagation paths but it is not clear that impact of drains and curbs or the like were considered for propagation.

Farley should update the flood documentation to provide more information on plant features that can impact the propagation or retention for each flood scenario, especially anywhere that non-watertight doors, berms or curbs are credited Resolved This F&O is resolved.

New text has been incorporated in Table 6-1 through 6-4, Tables 7-1 through 7-4, Table 9-1, Section 12.3 of the Flooding notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 33 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFSN-A4-01 ESTIMATE the capacity of the drains and the amount of water retained by sumps, berms, dikes, and curbs. ACCOUNT for these factors in estimating flood volumes and SSC impacts from flooding.

In the IF Notebook, there was extensive discussion with respect to treatment of drains, there was explicit evidence that drains were considered as propagation paths for several flood scenarios.

However, no explicit estimation of drain capacities could be found. This is a direct violation of SR.

Farley should consider adding a table that explicitly includes drain capacities.

Resolved This F&O is resolved.

New text has been incorporated into the appropriate sections of the Internal Flooding Analysis Notebook.

IFSN-B3-01 DOCUMENT sources of model uncertainty and related assumptions associated with the internal flood scenarios.

The IF Notebook did not seem to include assumptions related to the flood scenario selection in a coherent fashion nor did there seem to be any discussion concerning sources of uncertainty.

Farley needs to include a section in the IF Notebook to discuss the IF assumptions and sources of uncertainty.

A section on assumptions could be included in each section (such as was done for section 9 and 11) or a single section encompassing all tasks could be added Resolved This F&O is resolved.

New text concerning uncertainty and assumptions has been incorporated into the appropriate sections of the Internal Flooding Analysis Notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 34 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFEV-B3-01 Document sources of model uncertainty and related assumptions associated with the internal flood-induced initiating events.

The Farley PRA flooding analysis indicates that sources of uncertainty were not documented because of the low contribution to CDF and LERF from flooding. Although this is true, this SR requires that sources of model uncertainty and related assumptions associated with the internal flood-induced initiating events be documented.

Include a discussion of uncertainty and assumptions related to internal flood initiating events. This finding is related to other internal flooding SRs that discuss documentation of uncertainty.

Resolved This F&O is resolved.

New text concerning uncertainty and assumptions has been incorporated into the appropriate sections of the Internal Flooding Analysis Notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 35 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFQU-A6-01 For all human failure events in the internal flood scenarios, INCLUDE the following scenario-specific impacts on PSFs for control room and ex-control room actions as appropriate to the HRA methodology being used:

(a) additional workload and stress (above that for similar sequences not caused by internal floods)

(b) cue availability (c) effect of flood on mitigation, required response, timing, and recovery activities (e.g.,

accessibility restrictions, possibility of physical harm) (d) flooding-specific job aids and training (e.g.,

procedures, training exercises)

HRA for flooding event was performed but the base is different from internal event HRA. It seems that there is version mismatch.

Possible resolution is to update the HRA for flooding events like HRA for internal events.

Resolved This F&O is resolved.

A plant-specific calculation describes the HRA methodology for flooding PRA and flooding human failure events were added to the HRA Calculator database.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 36 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFQU-A7-01 PERFORM internal flood sequence quantification in accordance with the applicable requirements described in the quantification (QU).

Quantification of flooding event does not perform uncertainty analysis and dependency analysis. Section 10.1.7 explains the dependencies between human interactions, and Farley performed dependency analysis when quantifying the flood CDF. However, there is no description of calculation results about the dependencies.

Technical Items are missing.

Possible resolution is to perform and provide uncertainty analysis and dependency analysis, even though the flood risk is not significant.

Resolved This F&O is resolved.

An HRA Dependency Analysis was conducted and incorporated into the Revision 9 model quantification. This analysis has been incorporated into the HRA notebook as Appendix C.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 37 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFQU-A11-01 CONDUCT walkdown(s) to verify the accuracy of information obtained from plant information sources and to obtain or verify inputs to (a) engineering analyses (b) human reliability analyses (c) spray or other applicable impact assessments (d) screening decisions Internal Flooding Analysis Notebook Appendix.A does not describe the information related with human reliability analyses and screening decisions.

Possible resolution is to provide the room for

1) Operator mitigation action and

2) Reason of screening decisions.

Supplemental Comments:

According to ASME Standard, IFQU-A11, human actions (and human reliability analysis) modeled for each flood area's quantification are verified via flood walk downs. Also, the reason of screening decision should be verified via walk downs.

Proposed resolution : The walk down sheet for each flood area add two more sections as follows:

G. related human actions H. Screening Decision In case of screening, table 6-1 in the notebook would be a good reference. In case of HRA, table 10-2 and 10-3 would be a good reference.

Resolved This F&O is resolved.

Although qualitative screening is documented in Table 6-1 to 6-4 of the Internal Flooding notebook, the tables did not include any human actions.

Section 6 of the Internal Flooding notebook lists the screening criteria which includes human mitigating actions as a criterion (criterion d.). However most of the flood locations in Tables 6-1 to 6-4 were qualitatively screened based on criterion a or b. None were screened on criterion d, which shows that although human actions were considered as a screening criterion, there were no applicable areas in the Farley flooding PRA.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 38 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition IFQU-B3-01 DOCUMENT sources of model uncertainty and related assumptions associated with the internal flood accident sequences and quantification.

The Farley PRA flooding analysis indicates that sources of uncertainty were not documented because of the low contribution to CDF and LERF from flooding. Although this is true, this SR requires that sources of model uncertainty and related assumptions associated with the internal flood-induced initiating events be documented.

Include a discussion of uncertainty and assumptions related to internal flood initiating events. This finding is related to other internal flooding SR that discusses documentation of uncertainty.

Resolved This F&O is resolved.

New text concerning uncertainty and assumptions has been incorporated into the appropriate sections of the Internal Flooding Analysis Notebook.

QU-F1-01 DOCUMENT the model quantification in a manner that facilitates PRA applications, upgrades, and peer review.

The maintenance related mutually exclusive events are stated to be based on Tech Spec disallowed maintenance conditions. The mutually exclusive logic was based upon FNP-0-ACP-52.1 but was not referenced as the source of the mutually exclusive logic. The review of the QU notebook referenced the incorrect document the development of the mutually exclusive logic.

Update the documentation to reflect the actual references.

Resolved This F&O is resolved.

Documentation reference has been updated in the Internal PRA Quantification Notebook.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 39 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition QU-F4-01 DOCUMENT the characterization of the sources of model uncertainty and related assumptions.

The information regarding the assumptions and sources of uncertainty is located in Appendix D of the Farley QU notebook. However, this appendix is not referenced in the QU notebook, neither is it included in the notebook's table of contents. The only reference to the appendix is in the Revision 9 Roadmap and Quality Self-Assessment document, and in this document it is misidentified as Appendix A. References to this document are either nonexistent or incorrect. Even though the document contains a lot of good information, it is almost impossible to locate.

Correct the QU notebook table of contents to include Appendix D and its title. Add information to Section 2 that references the appendix. Correct the reference to the appendix in the Revision 9 Roadmap.

Resolved This F&O is resolved.

Added Appendix D to the Internal PRA Quantification Notebook. Corrected references to the Appendix in the Revision 9 Roadmap.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 40 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition N/A (LE-C2)

INCLUDE realistic treatment of feasible operator actions following the onset of core damage consistent with applicable procedures, e.g.,

EOPs/SAMGs, proceduralized actions, or Technical Support Center guidance.

The Farley PRA LERF model relies largely on human error probabilities taken from the WCAP-16341-P.

Because the WCAP HEPs are generic rather than plant-specific, they were derived as conservative estimates.

No Finding Although this SR was determined to be CC-I by the peer review, no F&O was made. The conservatism introduced by meeting this SR at CC-I level would not significantly affect the conclusions made based on the Farley PRA results, including the calculation of RICT values.

The major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 41 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition N/A (LE-C9)

JUSTIFY any credit given for equipment survivability or human actions under adverse environments.

No credit is taken for either equipment operation or human actions in adverse environments.

No Finding Although this SR was determined to be CC-I by the peer review, no F&O was made. The conservatism introduced by meeting this SR at CC-I level would not significantly affect the conclusions made based on the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 42 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition N/A (LE-C11)

JUSTIFY any credit given for equipment survivability or human actions that could be impacted by containment failure.

No credit was taken in the Farley PRA for equipment or operator actions impacted by containment failure. The WCAP-16341-P methodology conservatively does not credit containment sprays for fission product scrubbing or pressure suppression for the containment failure.

No Finding Although this SR was determined to be CC-I by the peer review, no F&O was made. The conservatism introduced by meeting this SR at CC-I level would not significantly affect the conclusions made based on the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 43 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition N/A (LE-C12)

REVIEW significant accident progression sequences resulting in a large early release to determine if engineering analyses can support continued equipment operation or operator actions after containment failure that could reduce LERF. USE conservative or a combination conservative and realistic treatment for non-significant accident progression sequences.

The LERF frequency calculated in the Farley PRA is so low that no review was performed to reduce LERF based on engineering analysis to support equipment operation or operator action after containment failure.

No Finding Although this SR was determined to be CC-I by the peer review, no F&O was made. The conservatism introduced by meeting this SR at CC-I level would not significantly affect the conclusions made based on the Farley PRA results, including the calculation of RICT values.

Major contributors to Farley LERF (97% of total LERF) are containment bypass scenarios such as interfacing systems LOCA and containment isolation failure concurrent with core damage scenarios. For such LERF scenarios with containment bypassed or containment isolation failed, operator actions or mitigation systems which can be credited in reducing the likelihood of early containment failure after core damage are of little importance because containment barrier is already failed at the time of the core damage.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 44 Table E2-2. Resolution of FNP PRA Peer Review Findings F&O#

Topic Finding Description Status Disposition MU-B4-01 PRA Upgrades shall receive a peer review and the peer review section of each respective part of the standard for those aspects of the PRA that have been upgraded.

There is no reference to a peer review for upgrades. Did not find a section which addressed upgrades (not updates) to the PRA specifically involving changes to key PRA software.

This is a direct violation of an SR.

Revise either NL-PRA-001 or NL-PRA-002 to explicitly require a peer review for PRA upgrades (i.e. methodology change or major software change etc.)

Resolved This F&O is resolved.

Relevant SNC Procedure was revised to require a peer review following an upgrade of the PRA model.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 45 4.0 Technical Adequacy of FNP Fire PRA Model NEI 06-09 requires that the PRA be reviewed to the guidance of Regulatory Guide 1.200, Rev 2 (Reference 3) for a PRA which meets Capability Category (CC) II for the supporting requirements of the American Society of Mechanical Engineers (ASME) fire events at power PRA standard. It also requires that deviations from these capability categories relative to the RICT program be justified and documented.

The FNP Fire PRA has undergone a RG 1.200, Revision 2 (Reference 3) Peer Review against the ASME PRA Supporting Requirements (SRs) by a team of knowledgeable industry (vendor and utility) personnel. The review (Reference 12) was conducted by the Westinghouse Owners Group in accordance with NEI 07-12 as endorsed by RG 1.200 Rev 2 (Reference 3). The conclusion of the review was that the FNP methodologies being used were appropriate and sufficient to satisfy the ASME/ANS PRA Standard RA-Sa-2009 (Reference 6). The review team also noted that NUREG/CR-6850 methodologies were applied correctly.

The summary of the peer review findings exhibited the following statistics for the evaluation of elements to the combined PRA Standard. For the FNP Fire PRA, 88% of the SRs were assessed at Capability Category II or higher, including 8% of the SRs being assessed at Capability Category III. The FNP Fire PRA had an additional 5% of the applicable SRs assessed at the Capability Category I level. The Fire PRA was found to not meet 7% of the applicable SRs.

The Westinghouse Peer Group concluded that the Farley Fire PRA is consistent with the ASME/ANS PRA Standard and supports risk-informed applications. As a result of the peer review and the fire risk evaluation process the FNP Fire PRA has undergone additional model refinements. These refinements were made consistent with the methodologies that were reviewed during the FNP Peer Review.

This enclosure provides a detailed assessment of each of the findings identified by the Peer Review team.

4.1 RG 1.200 Peer Review for FNP Fire PRA Model against ASME PRA Standard Requirements The ASME/ANS RA-SA-2009 version of the PRA Standard (Reference 6) contains a total of 173 numbered supporting requirements (SRs) in 13 technical elements. The configuration control element has 10 additional SRs. Thus, a total of 183 SRs were assessed.

Among 183 SRs, 29 were determined to be not applicable to the FNP Fire PRA either due to the fact that the requirements were not applicable to the FNP approach or the technical element was not used for the FNP analysis (i.e., QLS and QNS). Of the 154 total applicable SRs, approximately 87% met Capability Category II or higher, as shown in Table E2-3.

Table E2-3. Summary of FNP Fire Events Capability Categories Capability Category Met No. of SRs

% of total SRs

% of total applicable SRs Met 100 54.6%

64.9%

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 46 Table E2-3. Summary of FNP Fire Events Capability Categories Capability Category Met No. of SRs

% of total SRs

% of total applicable SRs Not Met 13 7.2%

8.4%

CC I 9

4.9%

5.8%

CC II 5

2.7%

3.3%

CC III 14 7.6%

9.2%

CC I/II 4

2.3%

2.6%

CC II/III 9

4.9%

5.8%

NA 29 15.8%

NR 0

Total 183 100.0%

100%

The peer review generated 31 Findings out of which 13 SRs were judged to be not met. These were PP-B2, PP-B3, PP-C3, PRM-B2, FSS-D7, FSS-D8, FSS-D11, FSS-F1, FQ-C1, FQ-D1, FQ-E1, FQ-F1, and UNC-A1. An additional 9 SRs met CC-I, but not CC-II. These were: CS-B1, FSS-B2, FSS-C1, FSS-C2, FSS-D3, FSS-E3, FSS-F2, FSS-G6, and FSS-H5. The Findings and resolutions associated with these SRs are described in Section 4.3. Thus, the FNP fire PRA meets the requirements of RG 1.200.

4.2 Resolution of Findings from RG 1.200 Fire PRA Peer Review Table E2-4 shows the details of the 31 Findings and the associated resolutions developed after the peer review.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 47 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition CS-B1-01 The Farley breaker Coordination documentation was identified to be incomplete based on the Farley Fire PRA components being credited.

The PRA components are not explicitly discussed in a coordination calculation.

Calculation SE-C051326701-002 is titled NSCA components; however, informal review has determined that PRA components are addressed. The information to determine the status of coordination for PRA components consists of informal queries and spreadsheets. Supporting Requirement CS-B1-01 Category II requires all buses credited in the Fire PRA to be analyzed for proper over current coordination and protection.

Revise calculation SE-C051326701-002 to formally validate that PRA buses are addressed for proper coordination and incorporate results into the Fire PRA model as needed.

Resolved This F&O is resolved.

The Farley circuit analysis calculation, SE-C051326701-002, has been updated to address all coordination concerns. This update identified two panels that were found to not be coordinated; all other panels were dispositioned as acceptable. The two panels are N1R19L00504 and N2R19L00504. Calculation PRABC-F-11-003 (Cable Selection and Detailed Circuit Analysis) has been updated to address this coordination issue.

Based on these conclusions these two panels have been failed in every scenario for the Farley Fire PRA. Associated Circuits Analysis Common Power Supply and Common Enclosure calculation, SE-C051326701-002 has been updated to reflect this update. The Farley Component Selection Report, PRA-BC-F 002, has also been updated to reflect the inclusion of these panels to the UNL list.

CS-B1-02 The Farley breaker Coordination calculations use cable length as part of the E-068 identifies cases where the cable lengths of electrical loads were credited to demonstrate selective coordination for the Cable Spreading room. This assumption is Resolved This F&O is resolved.

An analysis was completed that reviewed the panels that credited DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 48 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition justification for proper coordination. This is not a justifiable disposition for use in the Fire PRA.

only valid for the Appendix R fire where the equipment and cables are assumed damaged for the entire fire area. Supporting Requirement CS-B1-01 Category II requires all buses credited in the Fire PRA to be analyzed for proper over current coordination and protection.

Analyze impacted PRA buses for proper coordination and incorporate results into the Fire PRA model.

cable length as part of the justification for coordination. The entire function of these panels was then failed for any fire that impacted the cable within the identified length. Once the length requirement was met the function of that cable was the only function failed. A modification improves coordination for six additional 125VDC load distribution panels per unit. For further information on the modification of these panels see Plant Modifications Committed in Table S-2 of Attachment S of NFPA 805 submittal.

FQ-A3-01 Appendix L of NUREG-CR/6850 had been incorrectly applied to the Main Control Board scenarios in the Farley Fire PRA. The ignition frequencies have since been updated to accurately apply Appendix L.

A non-suppression probability of 3.04E-5 is used for the Main Control Room (NSP-0401*

basic events). A review of the Scenario Development report, the Summary Report, and the MCR Report did not locate the justification of this probability. Based on discussion with the Farley team, the values were derived from NUREG/CR-6850, Attachment L. A review of that Attachment did not support a NSP below 1E-4 under the best of circumstances. A NSP of 2E-2 (similar to other NSP events) would make MCR fire the highest contributor to plant risk.

Resolved This F&O is resolved.

The Farley MCR analysis has been updated to accurately apply the non-suppression factors as appropriate to the Main Control Board scenarios. The Farley Fire Scenario Report discusses the scenario development process for the Main Control Board and the use of Appendix L in section 13.1.2 of PRA-BC-F-11-014.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 49 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition Re-evaluate the NSP used for the Control Room and document the evaluation clearly in one of the reports.

FQ-C1-01 Possible combination events were missing from the cutset results for the Fire PRA model.

A review of cutsets for different sequences found multiple HRA combinations that are not being replaced by a COMBO* event and do not appear to be evaluated for dependence.

One such combination is 1OPMSO32-IH-F and OAR_B_1------H-F which has a combined failure probability of approximately 7E-5. A review of the HRA Calculator package supplied shows that no evaluation was performed for this combination of events.

Other HRA combinations could also be missing, particularly with new operator actions added for the fire scenarios. HRA dependence could significantly increase cutsets since the rule file makes HRAs independent unless the events are replaced by an evaluated combination.

Review the FPRA cutsets without recovery (all events set to screening values) to ensure that all important combinations are evaluated.

Resolved This F&O is resolved.

Every COMBO event is evaluated and incorporated in the fire PRA.

An updated dependency analysis was completed after the peer review findings were addressed in the model. The latest results of the dependency analysis captures all important combinations. This is documented in the Human Reliability Analysis for Fire Events, PRA-BC-F-11-016.

FQ-D1-01 The CCFP for Farley Fire PRA was much greater than what the FPIE number was.

After continued refinement the Fire PRA CCFP has decreased to a more reasonable value as In Section 3 of the Farley Nuclear Plant Summary Report, Farley reports a CDF of 9.65E-05/year and a LERF of 1.92E-5/year.

This yields a Conditional Containment Failure Probability (CCFP) of 1.99E-01. For the FPIE PRA, the reported CDF was of the order of 3.5E-05/year and the reported LERF was of the order of 2E-07/year. This translates to a CCFP of about 4E-03. This is a significant Resolved This F&O is resolved.

The Farley Fire PRA has continued to evolve and be refined throughout the analysis.

Currently the CCFP is at a much more reasonable value based on the final CDF and LERF results.

The results and insights related to DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 50 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition compared with the FPIE.

difference, especially when considering that the leading contributor to LERF for the FPIE PRA, SGTR, is not applicable for fire. This yields inconsistent results.

While the current results may be correct, Farley needs to look at the contributors to LERF to explain the basis for the high CCFP with respect to the FPIE PRA CCFP. Farley should look at sequences where the fire not only causes core damage but also directly affects containment integrity. Two likely candidates are sequences that lead to a new ISLOCA scenario and sequences that lead to containment isolation scenarios.

CDF and LERF can be found in the Farley Summary Report section 3 of PRA-BC-F-11-017.

The high fire-induced CCFP was directly related to the human error, OCI_A_1 ------H-F Operator fails to manually isolate containment prior to core damage during a fire event) having a screening HEP of 1.0 in the model reviewed by the peer reviewers.

The HEP has been updated by performing a detailed HRA after the peer review and the updated HEP is now 1.20E-02.

With new HEP of 1.20E-02, the fire-induced conditional containment failure probability is estimated to be 0.024 from the fire CDF and LERF, 5.24E-5/yr and 1.26E-6/yr, respectively for Unit 1.

As presented in Table W-1, Attachment W of NFPA LAR dated September, 25 2012, internal events CDF and LERF for Unit 1 are 1.06E-5/yr and 1.24E-7/yr, respectively. These risks yield an internal events conditional containment failure DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 51 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition probability of 0.012, which is comparable to the fire-induced CCFP FQ-E1-01 The Farley Fire PRA documentation did not accurately address the types of reviews that were performed during the scenario cutset review sessions.

The summary report lists and describes significant contributors to core damage and LERF. The back references require consideration of analysis issues which are not described in the report as having been done.

For example, the back references require a review the results of the PRA for modeling consistency, a review of results to determine that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results, a review of contributors for reasonableness and a review of the importance results for reasonableness.

Appendix F notes that these were accomplished and typically refers back to Appendix C. Appendix C does not describe these reviews as being accomplished, nor does it describe the results of the reviews. In addition, back Reference D5 requires a review of non-significant cutsets for reasonableness. Appendix F states that dominant cutsets were reviewed and those that were reduced in frequency to non-significance as a result of the review constitute the review of non-significant cutsets. This does not satisfy the requirement to review non-significant cutsets. Non-significant cutsets generated in the solution of the model need to be reviewed to confirm that Resolved This F&O is resolved.

The Farley Summary report includes additional details describing the types of reviews that were completed on the Farley Fire PRA. The type of review and the detailed cutset reviews are described in section C.1 of Appendix C in the Summary Report.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 52 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition their frequency is not underestimated due to modeling errors.

Expand the discussion of model solution and review in the summary report to indicate that required review items have been accomplished.

FQ-F1-01 Level of detail describing the risk significant scenarios was identified as not being sufficient in detail The documentation of the FPRA results does not adequately describe the top risk contributors such that it is clear why these scenarios, basic events, and human actions are dominant. Based on other findings (FQ-D1-01 and FQ-E1-01), it is not clear that the Farley team understands the bases for these top scenarios. Results presentation is important for PRA acceptability.

Understanding of the PRA results is necessary for performing any RI application to support the plant.

Provide more detailed discussions of the fire impacts and results to represent a strong understanding of the fire scenarios.

Resolved This F&O is resolved.

The Farley Summary report has been updated to reflect the insights by reviewing the top contributors for CDF and LERF.

This describes the fire induced impacts as well as the random failures. The resolution of this finding is found in Appendix C of Farley Fire PRA Summary Report.

FSS-A2-01 Target set definition in Fire Zones (FZs) that do not have fire rated boundaries on all sides as it relates to scenarios that are classified as full room burnouts.

FNP is missing the basis for not including targets outside the fire compartment for full room burnout scenarios. For full room burnout scenarios, all targets in the fire compartment are included. However, there is no documented basis for not including targets outside the fire compartment for full room burnout scenarios. If the compartment has an opening to an adjacent compartment, it was not verified that targets in the adjacent Resolved This F&O is resolved.

A review of the full room burnout scenarios was completed that looked for open boundaries to the adjoining FZs and the possible interactions that could take place.

For some particular fire areas a scenario was postulated that DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 53 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition compartment would be outside of the ZOI of all the ignition sources in the compartment analyzed for full room burnout.

See F&O PP-B3-01 (F) for a possible resolution.

would fail all targets within the fire area.

However, in most cases it was determined that there was no ignition source near the open boundary that would impact targets in an adjoining FZ. The Farley Fire Scenario Report includes discussion of the scenario development process for these specific cases in section 3.1.1 of PRA-BC-11-014.

FSS-B2-01 The Main Control Room Abandonment calculation identifies the potential for a workstation fire but does not describe the fire type in significant detail.

An office workstation fire scenario is discussed in the documentation, but is not fully justified. The workstation fire scenario is potentially the most significant fire scenario considered.

Provide better documentation of how the workstation fire was modeled and the results of this fire scenario.

Resolved This F&O is resolved.

The Farley Main Control Room Abandonment Calculation includes the discussion of the workstation fire in section B.8 as a sensitivity to the analysis with the results shown in Table B-8.

NUREG/CR-6850 does not provide any basis for this type of fire from an ignition frequency standpoint. Therefore it is not included as one of the potential ignition sources in the base calculation. A review of the sensitivity analysis involving the workstation shows that the analysis is not sensitive to that type of fire given the design of the Main Control Room envelope.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 54 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition FSS-C1-01 The Farley Fire PRA does not employ the use of a two point fire modeling treatment in the development of the fire scenarios.

Two-point fire intensity model that encompass low likelihood, but potentially risk contributing, fire events were not used in all cases. Fire scenarios were done with ignition sources characterized with one fire intensity.

To reach Capability Category II, use a two-point intensity model for all ignition sources.

Utility Comment: The development of fire scenarios for the Farley Fire PRA did not identify any instances where further analysis resolution would be gained by the treatment as inferred by the requirements for CC II and CC III. The implications of retaining the CC I treatment in lieu of refining as described for CC II or CC III is potentially a higher calculated CDF contribution. The CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

Response: The SR stipulates that a two-point model is required for CC-II. As you stated in your comment, Farley feels that the one-point model is conservative and justified.

This would be viewed as the proposed resolution, but the F&O stands.

Resolved This F&O is resolved.

Although the finding still stands and the SR is met at CC I, further resolution of this F&O will not impact the RICT calculations which are based on a risk delta.

The development of fire scenarios for the Farley Fire PRA did not identify any instances where further analysis resolution would be gained by the treatment as inferred by the requirements for CC II and CC III. The implications of retaining the CC I treatment in lieu of refining as described for CC II or CC III is potentially a higher calculated CDF contribution. The CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

FSS-C2-01 The Farley Fire PRA did not characterize Ignition source intensity were characterized such that fire is initiated at full peak intensity Resolved This F&O is resolved.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 55 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition the ignition source intensity for a time-dependent growth rate in the scenario development.

and ignition sources that are significant contributors to fire risk were not characterized using a realistic time-dependent fire growth profile. Generic methods from the Hughes Associates Generic Fire Modeling Treatments were used to characterize ignition source intensity. These generic methods did not incorporate fire growth curves.

Characterize ignition sources that are significant contributors to fire risk using a realistic time-dependent fire growth profile.

Utility Comment: The only readily available reference for a time dependent growth rate that could be considered in the analysis is 12 minutes as recommended in NUREG/CR-6850. The treatment would involve a t2 growth rate. If a particular source/target interaction has a spacing where the target is at the critical damage spacing threshold, such a treatment may provide some benefit as successful suppression with that time period would prevent target damage. However, if the target is located well within the calculated damage distance, the corresponding time to reaching the damage threshold is very short and effectively precludes any meaningful credit for suppression. In the case of the Farley Fire PRA, the majority of the target spacing for the dominant risk contributors is such that no meaningful credit for suppression is available. In other dominant Although the finding still stands and the SR is met at CC I, further resolution of this F&O will not impact the RICT calculations which are based on a risk delta.

The only readily available reference for a time dependent growth rate that could be considered in the analysis is 12 minutes as recommended in NUREG/CR-6850. The treatment would involve a t2 growth rate. If a particular source/ target interaction has a spacing where the target is at the critical damage spacing threshold, such a treatment may provide some benefit as successful suppression with that time period would prevent target damage. However, if the target is located well within the calculated damage distance, the corresponding time to reaching the damage threshold is very short and effectively precludes any meaningful credit for suppression. In the case of the Farley Fire PRA, the majority of the target spacing for the dominant risk contributors is such that no meaningful credit for suppression is available. In other dominant risk contributors, the DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 56 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition risk contributors, the scenario involves high energy arcing fault (HEAF) events were no growth time is applicable. The implications of retaining the CC I treatment in lieu of refining as described for CC II/III is potentially a slightly higher calculated CDF contribution.

The CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative. Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

Response: The Farley modeling was found to be consistent with CC-I but did not meet the requirements of CC-II. The comment provides the basis for stating that the existing treatment is adequate. It does not provide evidence that a time-dependent heat release rate model was used.

scenario involves high energy arcing fault (HEAF) events were no growth time is applicable. The implications of retaining the CC I treatment in lieu of refining as described for CC II/III is potentially a slightly higher calculated CDF contribution. The CC I treatment inherently will not result in under-estimation of fire risk. As such, the current treatment is conservative.

Provided this treatment does not result in masking of risk increases in future applications, further refinements are not considered necessary.

FSS-D1-01 The treatment of Secondary combustibles was not clearly defined in the scenario development documentation.

The fire modeling tools selected for use are appropriate for evaluating the zone of influence associated with individual fixed and transient ignition sources, but do not provide for estimating fire growth and damage behavior for fire scenarios involving ignition and fire spread on secondary combustibles.

With the generic fire modeling treatment selected for this fire PRA, there does not appear to be a way to model fire growth on secondary combustibles. Consequently, the extent of fire development cannot be modeled.

Resolved This F&O is resolved.

The Farley Scenario development notebook was updated to include additional details on how the treatment of secondary combustibles is dealt with during scenario development. Further information regarding this finding can be found in section 4.0 of Farley Fire PRA Scenario Development Notebook DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 57 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition Where secondary combustibles are located within the zone of influence, develop methods for estimating fire growth on secondary combustibles and the damage caused by this additional fire development.

FSS-D7-01 The Fire PRA credits the in cabinet CO2 system installed at Farley. There was no documentation provided to support the availability of this system.

SR FSS-D7 requires credited fire suppression systems to be installed and maintained in accordance with applicable codes and standards, and the credited systems must be in fully operational state during plant operation. These requirements are not met, but fire suppression systems are still being credited. As noted in the Conclusions section of Document # 0005-0012-002-002-04 (Hughes Associates), "The other main concern with the systems installed at FNP is the periodic maintenance and subsequent corrective action. Firstly, the plant procedures for inspection, testing and maintenance (ITM) do not address a few key activities required by NFPA 12. Secondly, the prioritization of work orders sometimes results in extended impairments (e.g., observed CR / work request tags over two years old), which negatively affects the fire protection program objective to maintain working systems."

Credit is being taken for fire suppression systems that do not meet the requirements of FSS-D7 for taking this credit.

Verify that credited fire suppression systems are installed and maintained in accordance Resolved This F&O is resolved.

Supporting documentation has been included in the Farley Fire Scenario report to further discuss the in cabinet CO2 suppression system and the associated test and inspection procedures that are credited in the Fire PRA. It has also been identified that the system does require modifications, such as mechanical equipment and detection upgrades, to be made to make the system operable as designed.

This is found in section 8.1.1 of Farley Fire PRA Scenario Development Notebook DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 58 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition with applicable codes and standards and demonstrate that credited systems are in a fully operable state during plant operation.

FSS-D7-02 The non-suppression probability that was originally used to calculate the MCR abandonment frequency was unconservative based on direction provided in Appendix P of NUREG-CR/6850.

In Tables 13-1 through 13-12 the equation e^(-lambda*t) was used to calculate the non-suppression probability for MCR abandonment scenarios. The control room lambda value from Table P-2 was selected.

The time, t, was obtained through the CFAST runs and plugged into the equation. In scenarios in which the time to abandonment was greater than 25 minutes a nominal NSP of 0 was selected. A NSP of 0 should not be assumed for these cases. Instead, it is suggested to run the CFAST cases longer than 25 minutes such that the analysis can credit a larger time with no abandonment conditions reached (i.e. if the case is ran to 60 minutes with no abandonment conditions reached, it can be credited up to 60 minutes) and still use the e(-lambda*t) equation to calculate NSP.

Additionally, the MCR equipment rooms are normally unoccupied and NSP should be associated with the electrical equipment room vs. the control room. If the control room lambda is used, a basis should be developed why the control room lambda is more appropriate than the electrical cabinet lambda. If the control room lambda basis has been justified, then a sensitivity analysis should be performed using the lambda of Resolved This F&O is resolved.

The application of the MCR abandonment non suppression probability has been re-evaluated using the floor value of 1.00E-03 for all bins that are determined to reach the abandonment threshold. The results of this review are identified in section 13 of Farley Fire PRA Scenario Development Notebook DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 59 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition electrical fires. This calculation can be non-conservative.

FSS-D8-01 The Farley Fire PRA does not look at the time available for a suppression system to successfully suppress a fire before target damage.

Note 8 associated with SR FSS-D8 suggests consideration of the time available to suppress a fire prior to target damage and specific features of physical analysis units and fire scenarios under analysis that might impact suppression system activation and coverage. Such consideration is not documented. Credit is taken for automatic fire suppression in some scenarios without consideration of the factors required under this SR.

Perform an analysis that considers the time available to suppress a fire prior to target damage and the specific features of the PAUs and fire scenarios under analysis to determine what impact they have on suppression system activation and coverage.

Resolved This F&O is resolved.

The Fire PRA was first developed without credit for suppression or detection, the target set for a given scenario was based on the ignition source type. Further in the analysis credit for the existing detection and suppression, and in some cases plant modifications, systems were credited. For these cases where the credit was taken the target set was not changed based on the time to suppression or distance to target. Instead a conservative approach was taken to leave the original target set included in the Fire PRA along with the failure rate of the suppression system, therefore not requiring a review of damage time vs. suppression time. This is found in section 8.0 of Farley Fire PRA Scenario Development Notebook.

FSS-E3-01 The Farley documentation did not address the uncertainty related to the use of fire Supporting requirement E3 asks to provide a mean value of, and statistical representation of, the uncertainty intervals for the parameters used for fire modeling the fire scenarios. Farley performed fire size and heat release rate selection in accordance with Resolved This F&O is resolved.

Although the finding still stands and the SR is met at CC I, further resolution of this F&O will not impact the RICT calculations as DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 60 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition modeling for the fire scenarios.

NUREG/CR-6850 and/or applicable FAQs.

However, the methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist. However, this is not reported in the documentation.

In the documentation, explain that it is understood that methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist.

Utility Comment: This specific F&O was issued against a technical element and the indicated resolution involves a documentation clarification. This documentation clarification will be implemented.

the F&O pertains to a documentation issue. The documentation has been updated to include discussions related to the uncertainty for fire modeling.

See Table D-1 of the Farley Fire PRA Summary report. The associated SR was dispositioned as CC I which is judged to be sufficient given the two concerns noted.

FSS-F1-01 The exposed structural steel evaluation was not originally performed as part of the Farley Fire PRA.

Section 2.11 of the FNP Summary Report (FNP_Summary_Report_final.pdf) claims that, "The Structural Steel Evaluation performed to evaluate the potential for fire to impact structural steel capacity which could impact fire compartment boundaries is documented in the FNP Fire PRA Report PRA-BC-F-11-014, Rev. 0, Fire Scenarios Report." This documentation was not found in the referenced report.

Include in the Fire Scenarios report the structural steel evaluation identified in final Summary Report and update self-assessment.

Resolved This F&O is resolved.

A review and analysis was completed of the structures at Farley for both units to determine the amount of exposed structure steel that is susceptible to fire damage and ultimately leading to a building collapse. The analysis concluded that there is a potential for this scenario to occur in the Turbine Building. This scenario has been added and is accounted for in the total plant risk and delta risk calculations. This is found in DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 61 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition section 10.5 of Farley Fire PRA Scenario Development Notebook.

FSS-G6-01 The Farley Fire PRA MCA analysis was incomplete at the time of review with many open items.

The Multi-compartment analysis identifies several areas where further evaluation is required. This evaluation has not been completed to either screen the zone or develop a fire scenario based on multi-compartment fire. A screening of the multi-compartment scenarios were done, those that were screened out were not included in the quantification. The multi-compartment scenarios flagged for further evaluation are in Table 3-1 of the Multi-Compartment Analysis.

Further evaluation is still being worked on, so these scenarios have not been included in quantification. Given the current CDF, the MCA could increase risk above 1E-4/yr.

Complete the MCA to either quantify the PAUs where a fire could spread to an adjacent PAUs or screen the PAUs for MCA Resolved This F&O is resolved.

The Farley Fire PRA MCA analysis has been completed with all scenarios being evaluated. The HGL/MCA report has been updated to show the final results for the analysis. This is found in Attachment B of PRA-BC-11-015.

FSS-H1-01 Non-Fire PRA targets were removed from the database leading to inconsistencies between the scenario development sheets and what was identified in the field.

For fire scenarios considered during the peer review walkdown, the nature and characteristics of the damage target set were different in three different sets provided for review, including the computer printout of the fire scenario summary and two sets of walkdown notes. One consistent set of documentation should be maintained in a retrievable format.

Include all relevant target sets in the computer-based documentation and handle Resolved This F&O is resolved.

The scenario development database has been re-populated with all target set information, targets specifically modeled in the Fire PRA and those that are not.

The scenario printout sheets found in Appendix A of the Fire scenario development report contain all targets identified during the walk down phase regardless DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 62 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition by disposition those targets that are not risk significant for a particular scenario.

of the relationship to Fire PRA components. This is found in Appendix A of Farley Fire PRA Scenario Development Notebook.

FSS-H5-01 The Farley documentation did not address the uncertainty related to the use of fire modeling for the fire scenarios.

The generic fire modeling tool referenced in the Fire Scenario Report, Reference 6 (Hughes generic treatment) is used for generic treatment of ignition sources as an approach to bound many scenarios, but its use does not provide uncertainty treatment on a fire scenario basis.

Provide uncertainty evaluations at least generically for those scenarios that use the generic treatment tools and on a case by case basis for the sources that use additional detailed fire modeling to further describe the scenarios used.

Utility Comment: This specific F&O is inconsistent with F&O FSS-E3-01. The indicated resolution for FSS-E3-01 states in part that the analysis documentation should be enhanced to note that methods for developing the statistical representation of the uncertainty intervals and mean values currently do not exist. However, F&O FSS-H5-01 then asks to undertake evaluations to address uncertainty. This latter F&O should be revised so that it is consistent with FSS-E3-01.

Resolved This F&O is resolved.

Although the finding still stands and the SR is met at CC I, further resolution of this F&O will not impact the RICT calculations as the F&O pertains to a documentation issue. The documentation has been updated to include discussions related to the uncertainty for fire modeling in response to F&O FSS-E3-01.

See Table D-1 of the Farley Fire PRA Summary report.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 63 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition Response: The F&Os address the specific SR requirements. The response to F&O FSS-E3-01 may be used to justify the treatment of uncertainty for FSS but the F&O documents compliance with the standard and as such remains.

IGN-A7-02 Newly installed potential Ignition sources were identified in the field that were not included as part of the original scenario development.

During the walkdown - ignition sources (specifically electrical cabinets) were found in the plant that is not listed on the list of ignition sources for the particular PAU. Specific examples include N1R1L0001 in the cable spreading room and N1R15A002X and N1R5A003X in the switchgear room. A walkdown and/or review of plant modification is necessary to ensure the plant FPRA reflects the as built as operated configuration.

This issue may be due to new plant equipment that was added after the initial ignition frequency walkdown - nevertheless the fire PRA should be reconciled to include these new ignition sources.

Resolved This F&O is resolved.

The Farley Fire PRA has been in development for some time. The ignition source walk down and scenario development were some of the first tasks that were completed as part of this analysis.

A qualitative review of the panels identified during the peer review walkdown showed no significant change in the plant CDF. This is based on the fire zones these panels were located in and the level of scenario development already included in these fire zones. The panels are located in a part of the room that already contains detailed scenarios and the introduction of the new sources are not expected to change the target set of adjoin scenarios.

Section 3.5 of the Summary Report, provides steps that will be taken to account for changes in the plant design that have DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 64 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition occurred since the initial Fire PRA development.

IGN-A7-04 The yard transformers had been incorrectly binned during the Task 6 development and should be moved to their appropriate bins.

Bins 27-29 have not been filled. Large Yard Transformers have been incorrectly binned in Bin 23 (indoor transformers). It is clearly stated in NUREG/CR-6850 that large yard transformers are not part of this count. As a result each large outdoor transformers (MT, UAT, SuT) should be binned in both Bin 27 (Yard Transformer - Catastrophic) and Bin 28 (Yard Transformer - Non Catastrophic).

Additionally, Bin 29, Transformer Yard -

Others, should also be filled.

Since Bin 23 may have been misinterpreted, it is suggested that indoor transformers typically associated with essential lighting, etc. be looked at for applicability in the FPRA if not already evaluated. Indoor transformers over 45kVA should be included in the count for this bin.

Resolved This F&O is resolved.

The Farley Fire PRA task 6 has been updated to accurately represent the transformers located in the yard to their applicable bins and have been removed from bin 23. The frequency per component has been updated accordingly and used for the applicable scenarios.

See Appendix C of Plant Partitioning and Fire Ignition Frequency for Farley Fire PRA, PRA-BC-F-11-009.

IGN-A7-05 The Farley scenario development did not accurately account for the frequency split between the two fire zones as it was identified in the field.

During the walkdown of the Bravo 4160 Switchgear room, it was observed that the Foxtrot Switchgear was split between 2 PAUs. The switchgear had a count of 15 vertical sections. PAU 335 had a count of 8 switchgear vertical sections and PAU 343 had a count of 8 vertical sections. This is a clear example of inadequate PAU boundary.

Recommend that the PAU such that the Foxtrot switchgear is contained in one PAU Resolved This F&O is resolved.

The Farley Fire PRA has been updated to accurately correct the scenario development to account for the ignition source split between the two fire zones of the SWGR room. The ignition source count of the SWGRs has not been changed to reflect the accurate number of cubicles. This change DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 65 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition and the count of the entire switchgear should be 15 vertical sections. In cases where ignition sources have been split between PAUs the count should be verified correct.

would result in a non-significant impact to the total plant ignition frequency based on the total count for Bin 15. The ignition frequency for the scenarios related to the SWGRs are accurately represented. These updates can be found in the Farley Scenario report, Appendix A, PRA-BC-F 014.

IGN-A9-01 The transient factors in the ignition frequency development had identified fire zones that had a 0 factor which led to a frequency of 0.

PAU 2321 (Sample Panel Room) has a transient fire frequency of zero. Similar to the first page of Appendix B, a storage factor of low or 1 should be chosen such that 2321 has a non-zero transient fire frequency. Right now 2321 has a non-zero ignition frequency due to a small number of cable in the area filling Bins 11 and 12.

A non-zero transient factor should be filled in.

Resolved This F&O is resolved.

The transient ignition frequency allocation has been re-visited for the Farley Fire PRA based on this finding. The appropriate changes have been made to accurately reflect the transient ignitions sources located within each fire zone. These updates were made in Farley Plant Partitioning and Ignition Source Task 1 and 6 report, PRA-BC-F-11-003, and carried into the ignition source calculation for the scenario development, PRA-BC-F-11-014.

PP-B3-01 The Farley Fire PRA did not contain sufficient information on scenario development with respect to the SNOC has not provided sufficient evidence that Fire Zone PAUs were evaluated for fire resistance capabilities of barriers, nor was there sufficient evidence that credited spatial separations were analyzed. Specific examples are cited in PRA-BC-F-11-001, Resolved This F&O is resolved.

The Farley scenario development report has been updated to provide more details on the scenario development based on DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 66 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition crediting of fire barriers.

Section 2.2, for PAUs that use "natural divisions." The document cites that the lack of fire barriers between these PAUs will be evaluated during the MCA. However, the MCA analysis appears to only discuss hot layer issues, and does not consider whether a fire propagates outside of the PAU or if there is a zone of influence and target damage outside of the PAU. Another example of where spatial separation is credited is Tool Room 0441.

Full room burnout scenarios are developed and quantified, but without sufficient evidence that fire barriers or spatial separation issues have been evaluated. It appears that specific PAUs are screened from having multi-compartment impacts without consideration of fire propagation or ZOI impact across spatial divisions.

SNOC has presented a plan to resolve the Fire Zone PAU vs. Fire Area PAU issue.

Implementation of this plan is sufficient to address the issues identified in PPB2 and PP-B3. In the plan, Fire Areas will be treated as PAUs. Particularly, SNOC staff have acknowledged that for "full burn" and "base case" fire scenarios, they will review and document the capabilities of barriers and the appropriateness of credited spatial separations, and will not inappropriately credit the ignition source and target identification process. This can be found in the Farley Scenario Development report, PRA-BC-F-11-014, section 3.1.1. The impact on the Hot Gas Layer and Multi-Compartment Analysis has also been revisited to assure that the boundaries of the rooms have been adequately represented in the calculation of the volumes.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 67 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition barriers or spatial separations for fire scenarios. The plan includes the following:

1. Those APs that have one or more boundaries that are not physical features or are not rated fire barriers will be identified and a requirement will be added to clarify that this must be recognized in the development of fire scenarios. There will be confirmation that the results of the above have been observed and documented.

2. Enhance the documentation to acknowledge the crediting of non-rated physical boundaries and provide a basis recognizing that the justification will rely on physical observations during plant walkdowns or through equivalent means as well as general construction methods (masonry block wall, concrete walls, etc.).

3. Address the nature and consequence of anticipated fire events for all APs for which explicit fire scenarios are not developed (base cases) and confirm that the results are appropriate given the boundaries for the AP.

4. Confirm that bounding room burn-out cases are not used for any APs that are not fully bounded by physical fire barriers, and that there is a justification for crediting those physical barriers.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 68 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition

5. Confirm that the resulting analysis does not change (reduce) the level of resolution associated with the existing fire scenarios developed to support the requirements of SRs associated with FSS.

Modify the hot gas layer and multi-compartment analysis (MCA) so that any unnecessary conservatism caused by using a smaller volume artificially caused by an assumed AP boundary are removed.

PP-C3-01 The Farley Fire PRA did not contain sufficient information on scenario development with respect to the identification of fire barriers.

Plant personnel have given verbal assurance that plant walkdowns have been performed to confirm the plant partitioning boundaries. It is reasonable to presume that the fire protection engineer would perform this walkdown task.

In addition, walkdowns were performed to support the Fire PRA ignition frequency task.

Furthermore, some notes were found as further evidence that some walkdowns were performed.

However, documentation of the plant partitioning walkdown is not readily available for peer review. SR PP-C3 requires documentation of key or unique features of the partitioning elements for each physical analysis unit. SR PP-B7 requires a confirmatory walkdown of partitioning elements.

Include Plant Partitioning walkdown sheets as part of PRA secondary documentation, and refer to the walkdown sheets in PRA-BC-F-Resolved This F&O is resolved.

The Farley Task 1 and 6 report identifies the ignition sources identified in each fire zone. The results of the walkdowns are input into a database that contains the necessary information related to Task 1 and 6. This database is considered to be the controlled copy of the results of these tasks.

These results are found in Appendix D of report PRA-BC-F-11-009. Section 3.1.1 of the Farley Scenario Report, PRA-BC-F-11-014, describes the process of identifying applicable scenarios based on the ignition source, surrounding targets and fire barriers.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 69 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition 11-001, Farley Fire PRA Tasks 1 & 6, Plant Partitioning and Fire Ignition Frequency. In particular, fire barriers and spatial separations that are credited in fire scenarios should be validated. When where no prior documentation can be found, new walkdowns may be required.

PP-C3-02 The Farley Fire PRA did not contain sufficient information on scenario development with respect to the documentation of fire barriers.

Fire Zones are identified as Fire PRA plant analysis units in PRA-BC-F-11-00. Fire PRA staff have expressed that the Fire Areas, not Fire Zones, should be assessed as the PAUs.

However, the Fire Zone PAU form the basis for initial PAU ignition frequency, whole room burns, and initial screening in later PRA analysis Fire Zones as PAUs are used consistently and extensively in the FPRA documentation. There is a disconnect between the PAUs defined in PRA-BC-F 00 and SNOC staff's statements of what constitutes a PAU. This adversely affected the review of the Plant Partitioning technical element. SNOC desires to call the entities that are currently described as Fire Zone PAUs as Administrative Partition, and to treat Fire Areas as PAUs.

F&O PP-B3-01 identifies an acceptable plan to address the technical issues around the definition of PAUs, that Fire Areas, not Fire Zones, form the basis for PAUs. Fire Zones and similar entities will be identified as Resolved This F&O is resolved.

The Farley Fire PRA documentation has been updated to be consistent in the naming convention throughout the analysis concerning the use of PAU and fire zone. The rooms at Farley are considered fire zones, while the fire areas are considered PAUs. The Task 1 and 6report, Plant Partitioning and Ignition Frequency PRA-BC-F 009, Cable selection and Detailed Circuit Analysis PRABC-F 003, and the Farley Scenario report contain this clarification.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 70 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition "Administrative Partitions" (AP). Since the term "Physical Analysis Unit" or PAU is extensively in Fire PRA documentation to describe Fire Zone PAUs, all Fire PRA documents should be reviewed and revised to call these compartments Administrative Partition.

Furthermore, the term "Administrative Partition" (AP) should be defined in the PP documentation and the APs descriptions (formally, Fire Zone PAUs), should be retained.

PRM-B2-01 The Farley internal events finding had only been partially addressed in respect to the impact on the Fire PRA.

Internal Events PRA peer review exceptions and deficiencies have only partially been dispositioned. Table 1 of the Fire Model document (PRA-BC-F-11-004_V0a) lists some of the internal events findings, but not all. All findings included in the internal events peer review must be included and disposed in the PRM notebook. Disposition of findings could not be verified. Discussion with Southern Company personnel indicated that some of the findings had not been addressed.

Expand Table 1 of the Fire Model document to include all findings. Describe the impact of the finding on the fire PRA. For those that impact model elements applicable to the fire analysis, describe the resolution in sufficient detail to allow a reviewer to conclude the finding has been dispositioned.

Resolved This F&O is resolved.

Table 1 of Fire PRA logic Development, PRA-BC-F-11-004 has been updated to address all internal events PRA findings and their impacts on the fire PRA.

PRM-C1-01 The RCP shutdown seals were not The new RCP shutdown seals are included in the fault tree model but are not described in Resolved This F&O is resolved.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 71 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition adequately discussed in the documentation for the Fire PRA model development.

Appendix B. Appendix B should be revised to describe these new seals and their impact on RCP seal failure flow rate. The Fire PRA modeling pertaining to RCP seal failure is not adequately described in PRA-BC-F-11-004.

Revise Appendix B to describe the new shutdown seals and their impact.

Fire PRA has been developed based on internal events PRA model having model of RCP shutdown seal. Section 2.0, Appendix B of Fire PRA logic Development, PRA-BC-F-11-004 has been updated to add RCP shutdown seal modeling.

UNC-A1-01 The Farley fire PRA provided Train A and B CDF results but did not define total plant CDF. The parametric uncertainty analysis should be more specific in scope and use a greater sampling size.

Farley presents the CDF results in Section 3.0 of the Summary Report. The way the results are presented are as an annualize CDF for Train A operating and an annualize CDF for Train B operating and both are called total plant CDF. There is no discussion as to what these two CDF values meant or a value for the "true" plant CDF. In Appendix D of the Summary Report, Farley presents the results of their parametric uncertainty analysis for CDF. Although not documented, this appears to be for CDF related to Train A Operating only. The parametric uncertainty analysis was performed using the Latin Hypercube method with only 1000 samples. The resulting curve was not well behaved and the calculated mean is well below the point estimate in Section 3.

As a start, Farley needs to define what the two results, annualize CDF for Train A operating and an annualize CDF for Train B operating, mean and a single total Plant CDF needs to be presented. This will probably be the average of the original two values. For the Resolved This F&O is resolved.

Appendix D of the Farley Summary report has been updated with a revised parametric uncertainty analysis for both CDF and LERF for Train A and B individually. The quality of the analysis was improved by applying the Monte Carlo method with 50,000 samples. The resulting curves are well behaved and the calculated means show minimal difference when compared to the point estimates.

Discussion of how the total plant CDF/ LERF is calculated is also provided in the Summary Report.

This describes how the Train A and Train B results are averaged together to obtain the total plant CDF/LERF.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 72 Table E2-4. Resolution of the FNP Fire PRA Peer Review Findings F&O #

Topic Finding Description Status Disposition uncertainty analysis, Farley needs to document what is covered by the analysis, Train A results, Train B results or both. Farley did run an uncertainty case using 10,000 samples and the results seemed to be better behaved. Farley is running an uncertainty case with 50,000 samples which is consistent with their FPIE PRA process. The results of this analysis should be presented in Appendix D in the Summary Report instead of the current analysis.

UNC-A1-02 The Farley documentation did not adequately address the review of LERF scenarios in the analysis to show that the appropriate reviews had been completed.

Farley did quantify the fire-related LERF for Unit 1 but failed to meet the requirements from LE-F2 and LE-F3 from Section 2 which require that "REVIEW contributors for reasonableness (e.g., to assure excessive conservatisms have not skewed the results, level of plant-specificity is appropriate for significant contributors, etc.)" and "IDENTIFY and characterize the LERF sources of model uncertainty and related assumptions in a manner consistent with the applicable requirements of Tables 2-2.7-2(d) and 2-2.7-2(e)." As discussed in F&O FQ-D1-01, the calculated LERF and CCFP indicate that there some potential issues with the LERF calculation.

See F&O FQ-D1-01 (F) and perform the reasonableness reviews after requantifying.

Resolved This F&O is resolved.

The Farley Summary report has been updated to reflect the insights by reviewing the top contributors for LERF. This describes the fire induced impacts as well as the random failures.

The resolution of this finding is found in Appendix C of Farley Fire PRA Summary Report.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 73 5.0 General Conclusions Regarding PRA Capability The information provided in this enclosure demonstrates that the FNP at-power internal events PRA model (including flooding) and the fire PRA model conform to the standard at CC-II which satisfies the guidance of RG 1.200, Revision 2. In addition, the FNP PRA model complies with all requirements for technical adequacy of the baseline PRA as defined in NEI 06-09 (Reference

1) as clarified by the NRC final safety evaluation of this report (Reference 2).

The FNP internal events PRA model (including flooding) and the FNP fire PRA model technical capability evaluations described above provide a robust basis for concluding that the PRA models are suitable for use in supporting the License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines".

6.0 References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines",

Revision 0-A, October 2012, (ADAMS Accession No. ML12286A322.

2. Letter from Jennifer M. Golder (NRC) to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,'

dated May 17, 2007 (ADAMS Accession No. ML071200238

3. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", Revision 2, March 2009.

4. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", Revision 1, January 2007.

5. Regulatory Guide 1.200, An Approach for Determining Technical Adequacy of PRA Results for Risk-Informed Activities, For Trial Use, USNRC, February 2004.

6. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

7. ASME RA-Sc-2007, ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications", Addenda to ASME RA-S-2002, ASME, New York, NY, August 31, 2007.

8. ASME RA-SB-2005, Addenda to ASME RA-S-2002 Standard for PRA for Nuclear power Plant Applications, American Society of Mechanical Engineers, New York, NY, December 2005.

9. ASME RA-Sa-2003, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, April 2002 and Addenda to Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers 2003.

10. NEI-00-02, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, 2000.

DRAFT to NL-18-0039 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 74

11. LTR-RAM-II-10-015, RG 1.200 PRA Peer Review Against the ASME PRA Standard Requirements for the Farley Nuclear Power Plant Probabilistic Risk Assessment, May 2010.

12. LTR-RAM-II-12-007, Fire PRA Peer Review of the Farley Nuclear Plant Fire Probabilistic Risk Assessment Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard, March 2012.

13. NEI 05-04, Process for Performing PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Revision 2, September 2008.

14. NUREG/CR-6928 / INL/EXT-06-11119, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, February 2007.

DRAFT

Farley Nuclear Plant - Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Model DRAFT

E3-2 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table of Contents Section Page Introduction.................................................................................................................................. 3 Scope.......................................................................................................................................... 3 Technical Approach..................................................................................................................... 4 References.................................................................................................................................. 8 : Seismic Bounding Analysis.................................................................................. 9 Estimate Bounding CDF................................................................................................... 9 Evaluate Potential Risk Increases Due to Out of Service Equipment.............................. 10 Evaluate Bounding LERF Contribution........................................................................... 10 Conclusion..................................................................................................................... 11 References..................................................................................................................... 11 : Evaluation of External Event Challenges and IPEEE Update Results................ 13 Conclusions.................................................................................................................... 25 References..................................................................................................................... 25 DRAFT

E3-3 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Introduction Topical Report NEI 06-09, Revision 0-A (Reference 1), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference 2), requires that the License Amendment Request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on their insignificance to the calculation of configuration risk as well as discuss conservative or bounding analyses applied to the configuration risk calculation.

This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources. This enclosure also provides the Farley Nuclear Plant (FNP) specific results of the application of the generic methodology and the disposition of impacts on the FNP Risk Informed Completion Time (RICT) Program.

to this enclosure presents the plant-specific bounding analysis of seismic risk to FNP. Attachment 2 to this enclosure presents the justification for excluding analyses of other external hazards from the FNP PRA.

Scope Topical Report NEI 06-09, Revision 0-A (Reference 1) and the associated Pressurized Water Reactor (PWR) Owners Group (PWROG) guidance (Reference 3) do not provide a specific list of hazards to be considered in a RICT Program. However, non-mandatory Appendix 6-A in the ASME/ANS PRA Standard (Reference 4) provides a guide for identification of most of the possible external events for a plant site. This information was reviewed for the Farley site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The data in the UFSAR (Reference 7) regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well as present and projected industrial activities (e.g., increases in the number of flights, construction of new industrial facilities) in the vicinity of the plant were also reviewed for this purpose. No new site-specific and plant-unique external hazards were identified through this review and associated plant visit.

Table E3.1 Minimum Scope of External Hazards to be considered Seismic Events Accidental Aircraft Impact External Flooding including Intense Local Precipitation Extreme Winds and Tornadoes (including generated missiles)

Turbine Generated Missiles External Fires Accidents from Nearby Facilities Release of Chemicals Stored at the Site Transportation Accidents Pipeline Accidents (e.g., natural gas)

DRAFT

E3-4 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models The scope of this enclosure is consideration of the above hazards for FNP. Seismic events in particular are considered in Attachment 1, and the other listed external hazards are considered in Attachment 2.

Technical Approach The guidance contained in NEI 06-09 states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCOs) selected to be part of the RICT Program. The process includes the ability to address external hazards by 1) Screening the hazard based on a low frequency of occurrence, 2) Bounding the potential impact and including it in the decision-making or 3) Developing a PRA model to be used in the RMAT/RICT calculation.

The overall process for addressing external hazards is shown in Figure E3.1, below, where each hazard identified in Table E3.1, above, is addressed individually.

The process considers two aspects of the external hazard contribution to risk. The first is the contribution from the occurrence of beyond design basis conditions, e.g., winds greater than design, seismic events greater than design-basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant. The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power, etc.

While the plant design basis assures that the safety related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless cause a demand on these systems that in and of itself presents a risk.

Step 1 - Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. As noted in Regulatory Guide 1.200 (Reference 8), the fundamental criteria that have been recognized for screening-out events are the following: an event can be screened out if either (1) it meets the criteria in the NRCs 1975 Standard Review Plan (SRP) or a later revision (Reference 5); or (2) if it can be shown using a demonstrably conservative analysis that the mean value of conditional core damage probability is less than 10-1, given the occurrence of the design-basis-hazard event; or (3) if it can be shown using a demonstrably conservative analysis that the CDF is less than 1E-06 per year. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. Sometimes, the bounding CCDP is conservatively assumed to be 1.0. For FNP, however, bounding CDF values are estimated in Attachments 1 and 2, without the estimation of CCDP.

If the bounding CDF for the hazard can be shown to be less than 1E-6/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program. The basis for this is as follows:

DRAFT

E3-5 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-5.

The maximum time interval allowed for this RICT is 30 days.

If the maximum CDF contribution from a hazard is <1E-6/yr, then the maximum ICDP from the hazard is <1E-7 (1E-6/yr

30 days/365 days/yr).

Thus, the bounding ICDP contribution from the hazard is shown to be less than 1%

of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

Figure E3.1 Process for Addressing External Hazards in RICT Program DRAFT

E3-6 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using this approach, some external hazards can cause a plant challenge, even for hazard severities that are less than the design basis limit. These considerations are addressed in Step 3 of the process.

There is one other important consideration for screened hazards that must be addressed within the RICT Program. This consideration relates to maintaining the boundary conditions of the base risk analysis. The screening process described above assumes that the capability of the plant to withstand the hazard is consistent with the design assumptions. In some cases, plant activities can change this assumption. Some examples are shown below:

Removal of a toxic gas monitor from service on the control room heating, ventilation and air conditioning (HVAC) system can impact the ability of the plant systems and operators to respond to a toxic gas release. For FNP, the Control Room Emergency Filtration/Pressurization System is excluded from the RICT Program; therefore, this boundary condition is not applicable.

Removal of a tornado missile or flood barrier from service in order to support a maintenance activity can degrade the capability of the plant to respond to such hazards, if the removal of the barrier reduces the protection of equipment that is expected to be available. That is, if the barrier only protects equipment that is considered out of service under the RICT Program, there is no need to address this further, but if other equipment that is intended to be available could be impacted, the basis for the screening of the hazard becomes invalid. For FNP, as a precondition to entering a RICT, plant procedures assure that if the design basis assumptions applicable to a hazard are temporarily not applicable (for example, barrier degradation), which may increase the likelihood of a plant challenge from loss of equipment that is not considered out of service within the RICT Program, appropriate compensatory measures are implemented to accomplish the following:

o Compensate for loss of protection; or o An incremental CDF/Large Early Release Frequency (LERF) equal to the applicable hazard frequency for all impacted equipment will be added to the incremental CDF/LERF resulting from the unavailability of structures, systems, and components (SSCs) attributed to the LCO Condition for which a RICT is calculated.

Step 2 - Hazard Analysis There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-6/yr. Such hazards are generally those with relatively larger frequencies of beyond design basis conditions, such as seismic events. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard. The basic approach to computing a bounding CDF is as follows:

DRAFT

E3-7 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Estimate Bounding CDF This approach is described in Attachment 1 of this Enclosure for the seismic hazard.

Evaluate Potential Risk Increases Due to Out of Service Equipment Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out of service equipment. For FNP, as discussed in Attachment 1, the only beyond design basis hazard that could not be screened out is the seismic hazard, and as demonstrated in Attachment 1, with the approach used the change in risk with equipment out of service cannot be higher than the bounding seismic CDF (SCDF).

Evaluate Bounding LERF Contribution The RICT Program requires addressing both core damage and large early release risk.

When a comprehensive PRA does not exist, the LERF considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as described in of this Enclosure.

Step 3 - Risks from Hazard Challenges Steps 1 and 2 address the direct risks from damage to the facility from external hazards.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using Steps 1 and 2 without a full PRA, there are risks that may be unaccounted for. These risks are related to the fact that some external hazards can cause a plant challenge, even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events can cause extended loss of offsite power conditions below design basis levels. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms.

The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or they are not significant to risk.

to this enclosure provides an analysis using Steps 1 and 2 for the FNP site with respect to the beyond design basis seismic hazard. Attachment 2 to this enclosure provides an analysis of the representative external hazards for the FNP site, as discussed in Step 3.

DRAFT

E3-8 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models References

1. Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322.

2. ML071200238, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), Letter from Jennifer M.

Golder (NRR) to Biff Bradley (NEI), May 17, 2007.

3. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk Informed Completion Time and Risk Managed Action Time for RITSTF Initiative 4B, August 2010.

4. American Society of Mechanical Engineers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.

5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975.

6. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

7. Joseph M. Farley Nuclear Plant Units 1 and 2 UFSAR, Rev 28 December 2017

8. Regulatory Guide 1.200, An Approach For Determining The Technical Adequacy Of Probabilistic Risk Assessment Results For Risk-Informed Activities, Revision 2, U.S.

Nuclear Regulatory Commission, March 2009 DRAFT

E3-9 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models

Seismic Bounding Analysis The purpose of this attachment is to present the analysis that bounds the potential seismic impact and include it in the decision-making process (Step 2 from Figure E3.1), as a seismic PRA is not available for FNP. The process for analyzing an unscreened external hazard without the use of a full PRA involves the following three steps:

1. Estimate Bounding CDF

2. Evaluate Potential Risk Increases Due to Out of Service Equipment

3. Evaluate Bounding LERF Contribution Estimate Bounding CDF A seismic margin assessment (SMA) was developed for the FNP Individual Plant Examination for External Events (IPEEE) (Reference A.1-1). Thus, there is not a current estimate of seismic core damage frequency (SCDF), so an alternative approach is taken to develop an SCDF estimate. This approach uses the current FNP seismic hazard curve and a limiting seismic capacity of a component whose seismic failure would lead directly to core damage as identified in the SMA. In this approach, a plant level high confidence of low probability of failure (HCLPF) seismic capacity corresponding to the limiting HCLPF component is used to determine the failure probabilities as a function of seismic hazard level, and these are convolved with the seismic hazard curve. This is a commonly used approach to estimate SCDF when a seismic PRA is not available. This approach is consistent with approaches that have been used in other regulatory applications (e.g., Reference A.1-4).

The seismic hazard for the FNP site was evaluated in 2013 (Reference A.1-2) and provided to NRC (Reference A.1-3). The FNP IPEEE (Reference A.1-1) was a limited scope seismic margins assessment performed relative to a review level earthquake (RLE) of 0.1g PGA (peak ground acceleration), and established that the corresponding HCLPF for equipment required for response to the RLE is a HCLPF of 0.1g referenced to peak ground acceleration (PGA),

which corresponds to a spectral frequency of 100 Hz. The HCLPF can also be scaled to other spectral frequencies, based on the reference level earthquake used in the SMA. The PGA is generally used as the convolution acceleration for most seismic PRAs, including other SPRAs performed by SNC. However, because this seismic risk estimation is based on the overall plant-level HCLPF, the controlling seismic failures would be unknown. Based on judgment from the recent seismic walkdowns, the seismic risk for FNP could be sensitive to the natural frequency of the service water pond dike/dam, or to electrical cabinets and equipment.

The natural frequencies of these items range from about 2.2 Hz to 8 Hz. Therefore, the FNP plant level fragility is estimated for the PGA (100Hz) and for the 2.5, 5 and 10 Hz spectral hazard curves. That is, four convolutions hazard frequency and HCLPF are performed, one for each spectral frequency. The average of these four results is then used to estimate the seismic risk. Note that the HCLPF is judged to be very conservative for FNP based on the following:

DRAFT

E3-10 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Detailed seismic walkdowns of the FNP structures and equipment have recently been performed for a future seismic PRA. The results of these walkdowns show that virtually all of the equipment reviewed has much higher seismic capacity than 0.1g.

Other Westinghouse PWRs with equipment similar to FNP have HCLPFs closer to 0.3g.

Therefore, it is judged that there is significant conservatism in using the IPEEE HCLPF of 0.1g for the estimation of the FNP plant seismic fragility.

Calculation of the SCDF in this manner also requires definition of uncertainty parameters for seismic capacity. The uncertainty parameter for seismic capacity is represented by a combined beta factor (c) of 0.4. This is a commonly-accepted approximation, and is consistent with the value used in other regulatory applications (e.g., Reference A.1-4). Using the above inputs, the total estimated FNP SCDF is determined to be 4.51E-6 (Reference A.1-7).

Therefore, a RICT bounding value of 4.51E-6 will be used as the estimate of SCDF (ICDFseismic) for the LAR submittal RICT calculations.

Evaluate Potential Risk Increases Due to Out of Service Equipment The approach taken in the computation of SCDF in Reference A.1-5 assumes that the SCDF can be based on the likelihood that a single seismic-induced failure leads to core damage. This approach is bounding and implicitly relies on the assumption that seismic-induced failures of equipment show a high degree of correlation (i.e., if one SSC fails, all similar SSCs will also fail). This assumption is conservative, but direct use of this assumption in evaluating the risk increase from out of service equipment could lead to an underestimation of the change in risk.

However, if one were to assume no correlation at all in the seismic failures, then the seismic risk would be lower than the risk predicted by a fully correlated model, but the change in risk using the un-correlated model with a redundant piece of important equipment out of service would be equivalent to the level predicted by the correlated model.

If the industry accepted approach (Reference A.1-5) of correlation is assumed, the conditional core damage frequency given a seismic event will remain unaltered whether equipment is out of service or not. Thus, the risk increase due to out of service equipment cannot be greater than the total SCDF estimated by the bounding method used in Reference A.1-5. That is, for the FNP site, the delta SCDF from equipment out of service cannot be greater than 4.51E-6/yr.

Evaluate Bounding LERF Contribution A review of plant specific and generic information on LERF contributors for internal events and seismic events was performed. For internal events, LERF is typically associated with the Interfacing System Loss of Coolant Accidents (ISLOCAs), Steam Generator Tube Ruptures (SGTR), and failures of containment isolation. Based on several recent PWR SPRAs, the tubes of the steam generators are judged to not be vulnerable to seismic events based on their ductile materials. Also, ISLOCA has not been found to be a significant contributor to LERF for SPRAs. That is, the usual failures leading to ISLOCA are failures of valve and check valve internals. For seismic events, valves are found to have high seismic capacity, so these failure modes are not contributors to seismic LERF. However, failure of containment isolation has been identified by SPRAs as a contributor to seismic LERF.

DRAFT

E3-11 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Seismic PRAs have generally found that structural failures and failure of containment isolation are the significant contributors to seismic LERF. At FNP, the Category I structures have high seismic capacity based on the initial work for the future SPRA. Therefore, seismic failure of containment isolation is judged to be the most significant contributor to SLERF.

While seismic failures of containment isolation have some degree of correlation with seismic CDF failures, a large majority of the potential failures, such as valves, would be significantly uncorrelated with the dominant seismic CDF failures. Therefore, the seismic fragility for containment isolation failure (which is based on the same conservative HCLPF for CDF) can be convolved with the seismic CDF fragility in order to estimate the seismic LERF. That is, the SLERF is estimated by the convolution of the seismic hazard with the core damage fragility and the LERF fragility, for each of the four spectral frequencies noted in the SCDF discussion, and averaged over the resulting values. Using the above inputs, the total estimated FNP SLERF is determined to be 2.07E-6 (Reference A.1-7).

Therefore, a RICT penalty of 2.07E-6 will be used as the bounding estimate of SLERF (ILERFseismic) for the LAR submittal RICT calculations.

Conclusion The above analysis provides the technical basis for addressing the seismic-induced core damage risk for FNP by reducing the ICDP/ILERP criteria to account for a bounding estimate of the configuration risks due to seismic events.

The RICT and RMAT calculations are based on the technical basis provided above.

The actual RICT and RMAT calculations performed by the CRMP tool are based on adding an incremental 4.51E-6/year and 2.07E-6/year seismic contribution to the configuration-specific delta CDF/delta LERF attributed to internal and fire events contributions. Thus, any change in risk due to the seismic contribution from the un-modelled seismic scenarios is accounted for by adding a permanent seismic contribution of 4.51E-6/2.07E-6 to the CRMP logic model that is used to quantify instantaneous CDF/LERF whenever a RICT is in effect. This method ensures that an incremental seismic CDF/LERF equal to the bounding SCDF/SLERF is added to internal and fire events incremental CDF/LERF contribution for every RICT occurrence.

The ICDP/ILERP acceptance criteria of 1E-5/1E-6 are used within the CRMP framework to calculate the resulting RICT and RMAT based on the total configuration-specific delta CDF/LERF accounting for internal events, fire and seismic CDF/LERF contributions.

References A.1-1.

Alabama Power Company, Farley Nuclear Plant, Units 1 and 2, Individual Plant Examination of External Events, June 1995.

A.1-2.

Lettis Consultants International (LCI), Inc., Farley Seismic Hazard and Screening Report, LCI Project 1041, Rev. 1, October 30, 2013.

DRAFT

E3-12 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models A.1-3 Alabama Power Company, Joseph M. Farley Nuclear Plant - Units 1 and 2 Seismic Hazard and Screening Report for CEUS Sites, NL-14-0342, March 31, 2014.

A.1-4.

Generic Issue 199, Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, IN2010-18, September 2, 2010.

A.1-5.

Staff Report, Implications of Updated Probabilistic Seismic Hazard Estimates In Central And Eastern United States On Existing Plants, Safety/Risk Assessment, ML100270639, August 2010.

A.1-6.

Southern Nuclear Co., FNP Level 1 and 2 PRA Model Revision 9 - at power, internal events, Calculation No. PRA-BC-F-14-001 Farley IE Model Rev 9 Ver 3, January 9, 2014.

A.1-7 Southern Nuclear Co., Seismic Risk Evaluation based on IPEEE and EPRI 2014 Farley Seismic Hazard, PRA-BC-F-17-002, September 28, 2017.

DRAFT

E3-13 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models

Evaluation of External Event Challenges and IPEEE Update Results As shown in Figure E3.1, there are three parts to the process for addressing external hazards for the RICT Program. Step 2 of the process addresses beyond design basis hazards that were not screened out in Step 1. As shown in Enclosure 3 Attachment 1, a bounding analysis approach was used to address the impact of seismic risk on RICT Program calculations. As such, the primary purpose of this attachment is to address Step 3 of the process from Figure E3.1.

As described in this enclosure, the incremental risk associated with challenges to the facility that do not exceed the design capacity must be accounted for. This attachment also provides results of the hazard screening performed as part of Step 1 of the process from Figure E3.1.

Seismic is the only hazard that was not screened out from Step 2 in Step 1.

Step 1 Hazard Screening Except Seismic Events The FNP IPEEE for Units 1 and 2 (Reference. A.2-1) provides an assessment of the vulnerability of the site to these hazards. The FNP IPEEE external hazard screening evaluation was updated to support this LAR. The updated evaluation of other external hazards for FNP Units 1 and 2 (Reference A.2-2) provides an assessment of the vulnerability of the site to these hazards. In general, the FNP site screened these external hazards based on Table 10-1 of NUREG/CR-2300, PRA Procedures Guide (Reference A.2-13), and performed a bounding evaluation (Reference A.2-2) for those hazards not subject to screening (aircraft impact, extreme winds and tornadoes, external flooding including intense local precipitation, industrial and military facility accidents, pipeline accidents, transportation accidents, and turbine-generated missiles). The bounding evaluation determined that the bounding CDF for beyond design basis conditions is less than 1E-6 per year. Table E3.A2.1 presents the results of the updated IPEEE analysis.

This screening and bounding evaluation assures that safety related equipment is not affected from beyond design basis events other than seismically induced impacts, which are evaluated in Attachment 1 of this Enclosure.

Step 2 Risks from Hazard Challenges Except Seismic Events Table E3.A2.1 reviews the bases for the evaluation of these hazards, identifies any challenges posed, and identifies any additional treatment of these challenges, if required.

The conclusions of the assessment, as documented in Table E3.A2.1, assures that the hazard either does not present a design-basis challenge to FNP, or is adequately addressed in the PRA.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Seismic Events Seismic events treated using a bounding approach with change to RICT Program criteria (see Attachment 1 to this enclosure).

Seismically induced loss of offsite power (LOSP) is a challenge within the design basis.

Addressed as part of internal events treatment of LOSP.

Accidental Aircraft Impacts There are no airports within 10 miles of the plant. There are no military facilities or military training routes close to the plant.

Aircraft hazard is not a design basis hazard event for the plant and the UFSAR (Reference A.2-3) using the most recent data confirms this conclusion.

As a result, beyond design basis challenges from accidental aircraft impacts are screened out. (Reference A.2-2)

Aircraft impact induced LOSP is a potential challenge within the design basis.

Projected air traffic does not pose a credible challenge to FNP.

The likelihood of damage causing a LOSP is judged to be sufficiently small that it will not significantly impact the RICT Program calculations and it can be excluded from RICT Program evaluation.

Avalanche Topography is such that no avalanche is possible as plant is not located near large mountains where snow avalanches are prevalent.

Impact of cascade of snow or rock would be damage to the exterior structure The effect of an avalanche does not pose a credible risk to FNP.

Biological Event The accumulation or deposition of vegetation or organisms (e.g. zebra mussels, clams, fish) on an intake structure or internal to a system that uses an intake structure would not occur as the Chattahoochee River is not the Ultimate Heat Sink (UHS) for FNP. The Service Water Storage Pond provides this service.

As this is slow to develop, there would be adequate warning for these events.

There are no challenges presented to the FNP site from biological events.

Excluded from RICT Program evaluation.

Coastal Erosion FNP is a riverine site located inland.

There are no challenges presented to the FNP site from coastal erosion.

Excluded from RICT Program evaluation.

Drought Drought is a slowly developing hazard. The plant location (riverine site with upstream dams: Walter F. George Dam and Columbia Lock and Dam; and downstream There are no challenges presented to the FNP site from coastal erosion.

Excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program dam, Jim Woodruff Dam) precludes impact on FNP.

External Flooding The external flooding hazard at the site was recently updated as a result of the post-Fukushima 50.54(f) Request for Information. The flood hazard reevaluation report (FHRR) was submitted to NRC for review on October 20, 2015 (Reference A.2-4). The NRC concluded in (Reference A.2-5) that the reevaluated flood hazards information in (Reference A.2-4) is suitable for the assessment of mitigating strategies (i.e., defines the mitigating strategies flood hazard information described in guidance documents currently being finalized by the industry and NRC staff) for Farley. Further, the NRC staff has concluded that the reevaluated flood hazard information is a suitable input for other assessments associated with Near-Term Task Force Recommendation 2.1 "Flooding."

The results in (Reference A.2-4) indicate that the frequency of a local intense precipitation (LIP) event capable of producing flood magnitudes reported in the FHRR is estimated to be well below 10-6/yr.

The second mechanism evaluated in the FHRR is combined events river flooding that is primarily caused by a probable maximum precipitation (PMP) event and wind-wave action. However, this mechanism is estimated to produce a maximum flood elevation that will not top the vehicle barrier system (VBS) surrounding the site. Although wind-wave action may produce sloshing over the VBS, the volume expected due to sloshing will Weather induced Loss of Offsite Power (LOSP) is a potential challenge, e.g., Flood induced loss of Emergency AC power, Aux. Feedwater (TDAFW Pump), Low Pressure/Decay Heat Removal pumps, and High Pressure/Makeup Pumps.

The combined effects of river flooding will not challenge the plant due to the VBS and site grade. LIP will be addressed by several modifications as a result of the Mitigating Strategies Assessment (MSA) in response to NRC Order EA-12-049, "Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (ADAMS Accession No. ML12054A735).

These modifications include building protection curbs around several key doors to keep flood waters from entering the building housing Key SSCs and FLEX equipment. Therefore, FLEX will be able to cope with the reevaluated flood hazard, and the modifications will provide protection for Key SSCs to maintain Key Safety Functions (KSFs) throughout the flooding event. Given the extremely low likelihood of an LIP event and the ability of FLEX to cope with the reevaluated flood hazard, the risk from an LIP event is sufficiently low enough to not warrant further analysis.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program not challenge site grade or any plant SSCs.

Extreme Winds and Tornados (including generated missiles)

FNP has been designed for extreme winds and tornado loadings that are substantially higher than the design basis events presently required. Most of the safety related structures, systems and components (SSCs) are protected from tornado missiles using barriers with thicknesses exceeding the current requirements based on recent tornado hazard analysis. Detailed tornado missile risk analysis has shown that the frequency of missile damage to target groups is less than 7x10-7 per year per unit, which is less than the screening criterion of 1E-6 per year (Reference A.2-2). On that basis, beyond design basis challenges from extreme winds &

tornados are screened out.

Loss of offsite power from extreme winds & tornados is a potential challenge within the design basis.

The site is currently evaluating tornado missiles in response to RIS 15-06. Tornado missile protection (TMP) vulnerabilities are in the process of being evaluated for risk impact.

Weather-related LOSP and recovery are included in data used for internal events PRA (Reference A.2-6). No further analysis required.

Results of the TMP evaluation will be reflected in the extreme winds and tornados screening evaluation.

Fog Water droplets suspended in the atmosphere at or near the Earths surface that limit visibility affect the frequency of occurrence of other hazards (e.g. highway accidents, aircraft landing and take-off accidents) and is indirectly considered.

Fog has a rare occurrence in the site region. Section 2.3.2.2 of UFSAR states that visibility of less than 1/4 mile occurs less than 1.3 percent of the time.

There are no challenges presented to the FNP site from fog.

Excluded from RICT Program evaluation.

Frost Snow and Ice govern this risk.

There are no challenges presented to the FNP site from frost.

Excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Hail Showery precipitation in the form of irregular pellets or balls of ice may occur.

Hail may occur but there are no openings in the walls or roofs of safety related buildings through which hail may enter and damage essential equipment. Tornado missile protection features, structural walls and roods are adequate to withstand the impact of hail.

There are no challenges presented to the FNP site from hail.

Excluded from RICT Program evaluation.

High Summer Temperature The highest recorded temperature at Dothan Airport was 108°F. The HVAC systems are designed to maintain prescribed building temperatures during outside temperature variations between 20°F and 95°F. Even if the maximum temperature exceeds the design limits for HVAC systems, such exceedance lasts only for a brief period and, given the thermal inertia of the concrete structures where safety-related equipment are located, will not have any impact.

There are no challenges presented to the FNP site from high summer temperature.

Excluded from RICT Program evaluation.

High Tide, Lake Level or River Stage This event is of negligible impact on plant. The plant location (riverine with upstream and downstream dams) preclude impact on plant due to this hazard. See External Flooding discussion for more information.

There are no challenges presented to the FNP site from high tide, lake level, or river stage.

Excluded from RICT Program evaluation.

Hurricane FNP is not on the coast and hurricane wind effects are bounded by extreme winds and tornados assessment.

See extreme winds and tornados.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Ice Cover Accumulation of frozen water on bodies of water (e.g. rivers) or on structures, systems and components.

Icing does not normally occur on the Chattahoochee River at FNP. The only incidence of icing occurred in 1961 along the banks in slack water areas. No record of the river being iced over at this location has been found. Therefore, there would be no interference with the flow of water into the river water intake due to ice. Even if the surface did become frozen there would be no interference with withdrawal of water by the river water intake due to depth of water in the river (UFSAR Section 2.4.7).

There are no challenges presented to the FNP site from ice cover.

Excluded from RICT Program evaluation.

Turbine-Generated Missiles The probabilistic analysis performed for failures of turbines in Units 1 & 2 shows the probability of turbine missile damage is less than the NRC accepted value (per RG 1.115, Reference A.2-

12) of 1x10-7 per year. To further reduce the probability of turbine failure, FNP has adopted a rigorous maintenance program.

Therefore, given the worst case probability of turbine missile damage of 1E-7 the bounding CDF assuming a CCDP of 1.0 is less than 1E-6 per year. (Reference A.2-2)

Beyond design basis challenges from turbine-generated missiles are screened out.

Loss of offsite power from turbine missiles is a potential challenge within the design basis.

The likelihood of damage causing a LOSP is judged to be sufficiently small that it will not significantly impact the RICT Program calculations and it can be excluded from RICT Program evaluation.

Internal Fires FNP Internal Fire model addresses risk from internal fires.

Internal Fire impacts are evaluated in the internal Fire PRA.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Internal Flooding FNP Internal events and internal flooding model addresses risk from internal flooding events.

Internal Flooding impacts are evaluated in the internal flooding PRA.

Landslide FNPs location prevents landslides from occurring as there are no steep hills.

There are no challenges presented to the FNP site from landslide.

Excluded from RICT Program evaluation.

Lightning Lightning strikes are not uncommon in nuclear plant experience. They can result in losses of off-site power or surges in instrumentation output if grounding is not fully effective. The latter events often lead to reactor trips.

This was considered in plant design.

There are no challenges presented to the FNP site from lightning.

Excluded from RICT Program evaluation.

Low Lake Level or River Stage A decrease in the water level of the lake or river does not impact FNP.

A decrease in the water level of the lake or river does not impact FNP as FNP does not rely on Chattahoochee River for the UHS since the storage pond provides the necessary UHS requirements.

There are no challenges presented to the FNP site from low lake level or river stage.

Excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Low Winter Temperature The lowest recorded temperature at Dothan Airport was 5°F; the plant design basis is 17°F.

The HVAC systems are designed to maintain prescribed building temperatures during outside temperature variations between 20°F and 95°F. Even if the minimum temperature exceeds the design limits for HVAC systems, such exceedance lasts only for a brief period and, given the thermal inertia of the concrete structures where safety-related equipment are located, will not have any impact. Therefore, the temperatures inside the plant buildings are expected to be higher than 17°F.

There are no challenges presented to the FNP site from low winter temperature.

Excluded from RICT Program evaluation.

Meteorite or Satellite Impact A meteoroid or artificial satellite that releases energy due to its disintegration in the atmosphere above the Earths surface, direct impact with the Earths surface, or a combination of these effects. This hazard is of negligible likelihood of impact to the site (very low event probability).

There are no challenges presented to the FNP site from meteorite or satellite impact.

Excluded from RICT Program evaluation.

Forest or Range Fires Fires at nearby facilities, onsite chemical storage, nearby transportation routes, or pipelines are addressed within those external hazard categories. For forest fires, UFSAR Sec 2.3.6 (Reference A.2-3) states that wooded areas are sufficiently far from the plant structures that brush and forest fires do not present a hazard. (Reference A.2-2)

There are no challenges presented to the FNP site from forest fires.

Excluded from RICT Program evaluation.

Industrial or Military Facility Accident No military bases or firing ranges, oil pipelines, or tank farms are located within a 10-mile radius of the plant site. Therefore, the hazards from industrial and military facility accidents are screened out from FNP PRA. (Reference A.2-2)

There are no challenges presented to the FNP site from accidents at nearby facilities.

Excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Release of Chemicals in Onsite Storage Chemicals stored near FNP have been evaluated annually since the OL issuance (Reference A.2-2). Procedures are in place to assess the impact of any new chemical procured for plant operations on control room habitability based on the toxicity limits given in RG 1.78 (Reference A.2-7). Based on the evaluations reported in the UFSAR (Reference A.2-3) on storage and handling of toxic chemicals near the site, this hazard group does not pose a credible threat to FNP Units 1

& 2. (Reference A.2-2)

There are no challenges presented to the FNP site from chemicals stored onsite.

Excluded from RICT Program evaluation.

River Diversion UFSAR Section 2.4.9 states that the river upstream from the site does not have sufficiently high banks to cause a potential diversion of the river and bypass of the intake structure. With Lake Seminole varying between el 76 ft MSL and 78 ft MSL, a temporary blockage of the river upstream from FNP would not seriously affect the quantity of water available to the river water intake. Even if the river was temporarily blocked, cooling water could be obtained from the storage pond.

There are no challenges presented to the FNP site from river diversion.

Excluded from RICT Program evaluation.

Sand or Dust Storm A strong wind storm with airborne particles of sand and dust is not relevant for this region.

There are no challenges presented to the FNP site from sand or dust storms Excluded from RICT Program evaluation.

Seiche This is an oscillation of the surface of a landlocked body of water that can vary in period from minutes to several hours; however, there is no large body of water close to the site for this event.

There are no challenges presented to the FNP site from seiche.

Excluded from RICT Program evaluation.

Snow The 100 year snow load is estimated as 10 psf. The design basis roof live load for seismic Category I structures is at least 20 psf.

There are no challenges presented to the FNP site from snow.

Excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Soil Shrink-Swell Consolidation The relative change in volume of the soil as a result of the type of soil and the amount of moisture. This is slow to develop and procedures are in place to monitor differential settlement (UFSAR Section 2B.7.3.1)

There are no challenges presented to the FNP site from soil shrink-swell consolidation.

Excluded from RICT Program evaluation.

Storm Surge FNP is located inland and is not affected by storm surge.

There are no challenges presented to the FNP site from storm surge.

Excluded from RICT Program evaluation.

Toxic Gas Toxic gas is covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident Toxic gas is covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident Toxic gas is covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident Transportation Accidents Analysis of postulated accidents on nearby transportation routes has shown (Reference A.2-2) that they do not pose a credible threat to FNP since these routes are farther than the safe distances specified in RG 1.78 (Reference A.2-7) and RG 1.91 (Reference A.2-8).

There are no challenges presented to the FNP site from transportation accidents.

Excluded from RICT Program evaluation.

Pipeline Accidents (e.g., natural gas)

A 6-in gas pipeline passes about 2.5 miles east of the main plant building. This is a grade B pipe with a nominal wall thickness of 0.188 in. and an average depth of 30 in. It carries 12 million cubic feet per day. In Section 2.2.3.2 of the UFSAR (Reference A.2-3), it is stated that an explosion or fire following a break of this pipe would not be hazardous for FNP. Therefore, the hazard posed by pipeline accidents is screened out from the FNP PRA.

(Reference A.2-2)

Beyond design basis challenges from pipeline accidents screened out.

Loss of offsite power from blast pressure damage to SSCs from pipeline accidents is a potential challenge within the design basis.

Based on the UFSAR evaluation, the pipeline does not pose a challenge to FNP.

As a result, the likelihood of damage causing a LOSP is judged to be sufficiently small that it will not significantly impact the RICT Program calculations and it can be excluded from RICT Program evaluation.

DRAFT to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Table E3.A2.1 Evaluation of Hazard Challenges and Disposition for RICT Program External Hazard Current Risk Basis Challenge(s) Posed Disposition for RICT Program Tsunami FNP is located inland is not exposed to the Tsunami threat There are no challenges presented to the FNP site from tsunamis.

Excluded from RICT Program evaluation.

Volcanic Activity Not applicable to the site because of location (no active or dormant volcanoes located near plant site)

There are no challenges presented to the FNP site from volcanic activity.

Excluded from RICT Program evaluation.

Waves FNP is located inland and is not affected by any wave activity.

There are no challenges presented to the FNP site from waves.

Excluded from RICT Program evaluation.

DRAFT

E3-24 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models Step 3 Seismic-Induced LOSP Challenges For the FNP site, the only incremental risk associated with challenges to the facility that do not exceed the design capacity, which is not already addressed, is the seismically-induced LOSP. The methodology for computing the seismically-induced LOSP frequency is simply a convolution of the mean seismic hazard curve and the offsite power fragility. The Farley seismic hazard curve is the re-evaluated hazard submitted to NRC (Reference A.2-9) in response to the 50.54(f) request regarding Recommendation 2.1 of the NRC Fukushima Near Term Task Force.

Table E3.A2.2 provides the mean seismic hazard, represented by a series of discrete seismic hazard intervals from just below the FNP operating basis earthquake to significantly above the safe shutdown earthquake, and the LOSP failure probability for each seismic interval based on the fragility of offsite power, represented by failure of ceramic insulators in the offsite power switchyard. The failure probabilities are based on the fragility data from Table 4B-1 of the RASP Handbook (Reference A.2-10):

Median Offsite Power Capacity = 0.3g PGA, R = 0.3, U = 0.45 Given the mean frequency and failure probability for each seismic interval, it is straightforward to compute the estimated frequency of seismically induced loss of offsite power for the FNP site by taking the product of the interval frequency and the offsite power failure probability. As shown in Table E3.A2.2, the total seismic LOSP frequency is the sum of interval frequencies, or approximately 5E-6/yr.

Table E3.A2.2 Seismic LOSP Frequency Based on FNP Seismic Hazard and RASP Handbook Fragility Data (Reference A.2-10)

Seismic Interval (g)

Represent ative Acceler-ation (g)

Interval Frequency

(/yr)

Offsite Power Failure Prob.

Weighted Average LOSP freq 0.05 - 0.1 0.07 1.13E-04 3.77E-03 4.26E-07 0.1 - 0.3 0.17 2.11E-05 1.55E-01 3.27E-06 0.3 - 0.5 0.39 9.35E-07 6.82E-01 6.37E-07 0.5 - 0.7 0.59 1.80E-07 8.95E-01 1.61E-07 0.7 - 0.9 0.79 5.56E-08 9.64E-01 5.36E-08 0.9 - 1.1 0.99 2.25E-08 9.87E-01 2.22E-08 1.1 - 1.3 1.20 1.31E-08 9.95E-01 1.30E-08 1.3 - 1.5 1.40 2.39E-09 9.98E-01 2.38E-09

>1.5 2.12 6.40E-09 1.00E+00 6.40E-09 Total Seismic LOSP Frequency =

4.59E-06 The internal events PRA relies on the loss of offsite power data in Reference A.2-11. Based on the FNP internal events PRA (Reference A.2-4), the total LOSP frequency is approximately 2E-2/yr. from plant-centered, grid-related, and weather-related causes. Applying the non-recovery DRAFT

E3-25 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models probability at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to each of these causes of LOSP results in a frequency of unrecovered loss of offsite power of 1.5E-3/yr. that is already included in the internal events PRA.

The seismically-induced (unrecoverable) LOSP frequency (5E-6/yr) is therefore less than 1% of the total unrecovered LOSP frequency. This frequency is judged to be a sufficiently small fraction that it will not significantly impact the RICT Program calculations and it can be omitted.

Conclusions Based on this analysis of external hazards for FNP Units 1 and 2, no additional external hazards need to be added to the existing PRA model. The evaluation concluded that the hazards either do not present a design-basis challenge to FNP, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.

References A.2-1.

Alabama Power Company, Farley Nuclear Plant, Units 1 and 2, Individual Plant Examination of External Events, June 1995.

A.2-2.

Joseph M. Farley Nuclear Plant Units 1 and 2, Evaluation of Other External Hazards, Southern Nuclear PRA Report, Revision 0, December 31, 2013.

A.2-3 Joseph M. Farley Nuclear Plant Units 1 and 2 UFSAR, Rev 28 December 2017 A.2-4.

Joseph M. Farley Nuclear Power Plant - Units 1 & 2 Flood Hazard Reevaluation Report (FHRR), Version 1.0, NRC Docket No. 50-348 & 50-364, October 20, 2015 A.2-5 NRC ADAMS Accession No. ML15343A418 - Joseph M. Farley Nuclear Plant, Units 1 and 2 - Interim Staff Response to Reevaluated Flood Hazards Submitted in Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation (TAC No. MF7039 and MF7040), December 10, 2015 A.2-6 FNP Level 1 and 2 PRA Model Revision 9 - at power, internal events, PRA-BC-F-14-001 Farley IE Model Rev 9 Ver 3, January 28, 2014.

A.2-7 Regulatory Guide 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room during a Postulated Hazardous Chemical Release, U.S. Nuclear Regulatory Commission, Revision 1, 2001 A.2-8 Regulatory Guide 1.91, Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants, U.S. Nuclear Regulatory Commission, Revision 1, February 1978 A.2-9 Alabama Power Company, Joseph M. Farley Nuclear Plant - Units 1 and 2 Seismic Hazard and Screening Report for CEUS Sites, NL-14-0342, March 31, 2014.

A.2-10 Risk Assessment of Operational Events Handbook, Volume 2 - External Events, Revision 1.01, U.S. Nuclear Regulatory Commission, January 2008.

DRAFT

E3-26 to NL-18-0039 Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Models A.2-11 Losses of Off-Site Power at U.S. Nuclear Power Plants - Through 2001, Final Report, EPRI TR-1002987, Electric Power Research Institute, April 2002.

A.2-12 Regulatory Guide 1.115, Protection Against Turbine Missiles, U.S. Nuclear Regulatory Commission, Revision 2, January 2012.

A.2-13 ANS-IPEEE-NRC, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments of Nuclear Power Plants, Report NUREG/CR-2300, 1983.

DRAFT

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Base CDF and LERF Table of Contents DRAFT to NL-18-0039 Baseline CDF and LERF E4-3 1.0 Introduction.............................................................................................................. 4 2.0 References............................................................................................................... 4 DRAFT to NL-18-0039 Baseline CDF and LERF E4-4 1.0 Introduction The purpose of this enclosure is to demonstrate that the total Core Damage Frequency (CDF) and total Large Early Release Frequency (LERF) are below the limits established in Regulatory Guide (RG) 1.174 (Reference 1), which are 1E-4/year for CDF and 1E-5/year for LERF. These limits allow for the risk metrics of NEI 06-09 (Reference 2) to be applied to the Farley Nuclear Plant (FNP) Risk Informed Completion Time (RICT) Program.

Table E4.1 reflects the Unit 1 and Unit 2 CDF and LERF values that resulted from a quantification of the baseline internal events (including internal flooding and an evaluation of the contribution from a loss of service water (SW) dam event) (References 4 and 5) and fire Probabilistic Risk Assessment (PRA) average annual models (Reference 3). Table E4.1 also includes the seismic CDF/LERF values described in Enclosure 3. Other external hazards, as discussed in Enclosure 3, are below accepted screening criteria and therefore do not contribute significantly to the totals. The values for the internal events and fire PRAs represent the average of Train A and Train B plant configuration alignments CDF/LERF results for each unit.

Table E4.1 Total Baseline Average Annual CDF/ LERF Farley Unit 1 Farley Unit 2 Source Baseline CDF/year Baseline LERF/year Source Baseline CDF/year Baseline LERF/year Internal Events PRA 8.90E-06 9.76E-08 Internal Events PRA 8.76E-06 7.93E-08 Fire PRA 8.35E-05 4.21E-06 Fire PRA 7.89E-05 4.51E-06 Seismic 4.51E-06 2.07E-06 Seismic 4.51E-06 2.07E-06 Loss of SW Dam 3.49E-07 4.53E-09 Loss of SW Dam 3.49E-07 4.53E-09 Other External Events N/A N/A Other External Events N/A N/A TOTAL UNIT 1 9.73E-05 6.38E-06 TOTAL UNIT 2 9.25E-05 6.66E-06 As demonstrated in Table E4.1, the total CDF and total LERF for each unit are within the limits set forth in RG 1.174, which permit small changes in risk that may occur during entries into the RICT Program. Therefore, the FNP RICT Program is consistent with NEI 06-09 guidance.

The values shown in Table E4.1 are a snap shot in time (Reference 3) and are subject to change based on the on-record PRA models that support the RICT Program. The RICT Program will monitor these values to ensure that annual average CDF and LERF are reasonably within RG 1.174 limits of 1E-04 and 1E-05 as a condition of program implementation requirement. Enclosure 9 provides additional information on the RICT Program monitoring process.

2.0 References

1. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing basis, May 2011 (ADAMS Accession No. ML090410014).

DRAFT to NL-18-0039 Baseline CDF and LERF E4-5

2. NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

3. Farley Fire PRA Summary Report, Revision 1, F-RIE-FIREPRA-U00-014

4. SNC Calculation PRA-BC-F-18-002, "Farley FPIE Asymmetric Cooling Provisional Update," Revision 1.

5. SNC Calculation F-RIR-ILRT-U00-002, "Farley Nuclear Plant Service Pond Dam Failure Evaluation," Revision 1 DRAFT

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Probabilistic Risk Assessment (PRA) Model Update Process DRAFT to NL-18-0039 PRA Model Update Process E5-1 Table of Contents 1.0 Introduction............................................................................................................ 2 2.0 PRA Model Update Process.................................................................................. 2 2.1 Internal and Fire Events PRA Maintenance and Update........................... 2 2.2 Review of Plant Changes for Incorporation into the PRA Model................ 2 3.0 References............................................................................................................ 3 DRAFT to NL-18-0039 PRA Model Update Process E5-2 1.0 Introduction The administrative controls applicable to the Probabilistic Risk Assessment (PRA) models used to support the Risk Informed Completion Time (RICT) Program ensure that these models reflect the as-built, as-operated plant. Plant changes, including physical modifications and procedure or operating practice changes, are reviewed prior to implementation to determine if they could impact the PRA models. If so, the process then determines the quantitative significance of the change and, if appropriate, implements the PRA model change concurrently with the plant change. If the change is not quantitatively significant, the PRA model change is prioritized for implementation at a routine model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Routine updates are performed, as a minimum, every two fuel cycles. If a quantitatively significant change cannot be implemented in the PRA model such that it could adversely affect RICT calculations, alternatives including bounding analyses or restrictions on the use of the RICT program are put in place until the PRA model can be changed.

2.0 PRA Model Update Process 2.1 Internal and Fire Events PRA Maintenance and Update The Southern Nuclear Operating Company (SNC) risk management process ensures that the applicable PRA model reflects the as-built and as-operated plant for each of the Farley Nuclear Plant (FNP) units, as required by Regulatory Guide 1.200 (Reference 2). The process delineates the responsibilities and guidelines for updating the full power internal events and internal fire PRA models at all operating SNC sites, and it includes both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential impact areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) and assessing the risk impact of unincorporated changes. The process also provides for controlling the model and associated electronic files.

The SNC PRA update process procedures include a requirement to maintain the total CDF and LERF mean values from all quantified sources documented in the LAR, including impact of changes to fire ignition frequency updates, within the RG 1.174 risk acceptance guidelines of 1E-4/yr. (CDF) and 1E-5/yr. (LERF) (Reference 3).

2.2 Review of Plant Changes for Incorporation into the PRA Model

1. Plant Changes (including both physical modifications to the facility and changes to procedures or operating practices) are reviewed as follows:

a. Modifications to the physical plant are reviewed for changes to maintain the PRA consistent with the as-designed plant. The review of design changes, e.g., Design Change Packages (DCP), Minor Design Changes (MDC), etc., is performed on an on-going basis. All design changes expected to impact or result in a need to change the baseline PRA model are identified in the PRA change log.

b. Modifications to plant procedures, Technical Specifications, and other licensing documents are reviewed to maintain the PRA consistent with the as-operated plant.

DRAFT to NL-18-0039 PRA Model Update Process E5-3 The review is performed on an on-going basis. Licensing Document Change Requests (LDCR) expected to significantly impact or change the baseline PRA model are identified in the PRA model change log.

c. Reliability data, unavailability data, initiating events frequency data, human reliability data, and other such PRA inputs are reviewed at least every two fuel cycles to maintain the PRA consistent with the as-operated plant.

2. If a quantitatively significant change to the PRA model is identified, it is accounted for in the model prior to the implementation of that plant change, including a physical modification, a procedure change, or other changes as noted in Item (1).

3. Following the data review performed at least every two fuel cycles, the PRA is reviewed to account for cumulative changes identified by the analysis.

4. If PRA model errors are discovered, they are reviewed to determine the quantitative impact on PRA results. Errors that result in quantitatively significant changes to the PRA model are corrected as soon as possible. Other errors are corrected on a completion schedule that is determined based on their priority.

5. When a PRA model change is required but cannot be immediately implemented for a quantitatively significant plant change or model error, the process calls for either one of the following actions:

a. Alternative analyses to conservatively bound the expected risk impacts of changes on the model are performed. In such a case, these alternative analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model. The use of such bounding analyses is consistent with NEI 06-09 (Reference 1).

b. Appropriate administrative restrictions on the use of the RICT Program for extended CTs are put in place until the model changes are completed.

3.0 References

1. NEI 06-09, Risk-Informed Technical Specifications Initiative 4B: Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, US Nuclear Regulatory Commission, Revision 2, March 2009.

3. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific changes to the Licensing Basis, May 2011 (ADAMS Accession No. ML12321A054)

DRAFT

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Attributes of the Configuration Risk Management Program (CRMP) Model DRAFT to NL-12-1344 Attributes of the CRMP Model E6-2 Table of Contents

1.0 INTRODUCTION

.................................................................................................. 3 2.0 PROCESS............................................................................................................ 3 3.0 ADMINISTRATIVE CONTROLS........................................................................... 5 4.0 QUALITY REQUIREMENTS................................................................................ 9 5.0 TRAINING AND QUALIFICATION....................................................................... 9

6.0 REFERENCES

................................................................................................... 11 DRAFT to NL-12-1344 Attributes of the CRMP Model E6-3 1.0 Introduction This enclosure describes the process for adapting the peer-reviewed baseline Probabilistic Risk Assessment (PRA) models for use in the Configuration Risk Management Program (CRMP) software to support the Risk Informed Completion Time (RICT) Program. Farley Nuclear Plant (FNP) intends to employ a CRMP software tool which provides for real time recalculation of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for configuration risk. The baseline PRA models are separate internal events (including internal flooding) and internal fires models, which calculate average annual risk. The CRMP model used in the RICT Program must integrate results for all modeled hazard groups and determine CDF and LERF for actual plant conditions which exist at the time. The process employed to adapt the baseline models for CRMP use is demonstrated 1) to preserve the CDF and LERF quantitative results, 2) to maintain the quality of the peer-reviewed PRA models and 3) to correctly accommodate changes in risk as required due to time-of-year, time-of-cycle and configuration-specific considerations as required. As indicated in Enclosure 1, the representative RICT values reported in Enclosure 1 are calculated using separate zero-maintenance annual average PRA models which include the internal events (including internal flooding) PRA model, internal fire events PRA model that reflect NFPA-805 implemented plant modifications, seismic bounding delta CDF/LERF values, and main control room (MCR) abandonment bounding delta CDF/LERF values. The CRMP model that reflects the as-built and as-operated plant condition including credit for NFPA-805 modifications will be developed prior to implementation of the RICT Program. Quality controls and training programs applicable for the CRMP tool are also discussed in this enclosure. The MCR abandonment bounding delta CDF/LERF values are subject to replacement either with updated values as the model is updated or optionally reflected as a logic change within the Internal Fire PRA model. The Seismic bounding delta CDF/LERF values are subject to replacement with updated values as the model is updated.

2.0 Process The baseline PRA models for internal events (including internal flooding) and internal fires are peer-reviewed models, updated to incorporate resolution of relevant peer review findings and to incorporate plant changes that reflect the as-built and as-operated plant. These models will then be modified using the following process to create a single top CRMP model, which also includes changes needed to facilitate configuration-specific risk calculations.

Each step in the process is documented using, as required, separate reports or calculations, which provide for necessary reviews and approvals of the changes being applied. The significant steps of the process are described below:

Step 1: This step represents the model for internal events and internal flooding which was subjected to the peer review process.

Step 2: This step represents the model for internal fires which was subjected to the peer review process.

Step 3: This step represents the modification of the internal events and internal flooding model to resolve peer review findings determined to be relevant to the use of the models in the RICT Program, as well as updates to address plant changes.

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-4 Step 4: This step represents the modification of the internal fires model to resolve peer review findings determined to be relevant to the use of the models in the RICT Program, as well as updates to address plant changes.

Step 5: This step makes changes to the internal events (including internal flooding) and fire PRA models to include systems, structures, and components (SSCs) that are in the scope of the RICT Program but which are not part of the baseline PRA models. An evaluation of the RICT Program scope against the baseline PRA model scope is performed to identify SSCs which are not part of the baseline model and which need to be included to support configuration risk evaluations for LCOs in the scope of the RICT Program. It is expected that future revisions to the baseline PRA model will incorporate those SSCs that support configuration risk evaluations for the RICT program.

The changes being made to the existing baseline PRA models do not involve new methods; as such there is no need for any focused scope peer review. The associated LCOs are described in Enclosure 1.

Step 6: This step integrates the two baseline PRA models, following steps 4 and 5, into a single top fault tree model for calculation of CDF and LERF. The single top model is capable of evaluating the fire scenarios along with the internal events initiators and then combining the numerical results for use in the CRMP. At this step, the single top risk model calculates the total average annual CDF and LERF from internal events, internal floods, and internal fires.

Also at this step, the results obtained from the integrated model are validated against the baseline model results to ensure the single-top model is properly calculating CDF and LERF. The single top model accommodates such comparisons because it permits quantification of all initiating events, or a selection of initiating events, which facilitates comparisons to the two baseline PRA models.

At the completion of step 6, the two PRA baseline models are integrated, and the single top model is verified to provide quantitative results consistent with the two baseline models.

Step 7: This step optimizes, if required, the single top model to improve quantification time and is an intermediate step towards the next step.

At the conclusion of step 7, the quantified results from the optimized model are benchmarked to ensure the optimization process did not significantly alter the numerical results from the baseline PRA models.

Step 8: This step changes the model logic to account for variations in system success criteria based on the time of year or the time in the operating cycle as required. It also accounts for other specific changes needed to properly account for configuration-specific issues as required, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle. The CRMP model used for the RICT Program is required to either conservatively model these variations or include the capability to account for the variations.

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-5 The types of changes implemented in the CRMP model are described in Table E6.2.

Some specific examples of equipment alignment possibilities are shown (e.g., status of PORV block valves) but a number of other system alignments, such as high head charging and nuclear service water trains that are not shown but would be reflected in the CRMP model based on the configuration-specific equipment alignments in effect at the time of a RICT calculation.

Table E6.2 Changes Made During Translation to CRMP Model Description Basis for Change Seismic Bounding Risk Seismic risk is not included in the baseline PRA models. As justified in of this LAR, bounding seismic CDF and LERF values are calculated and included in the FNP baseline risk of the CRMP model.

Plant Availability (PAV) Event The baseline PRA models account for the time the reactor operates at power by using a plant availability factor. This is appropriate for determining the average annual (time based) risk, but the factor is not applicable to configuration-specific risk calculated for the RICT Program. Therefore, the probability of the PAV event is set to 1.0 in the CRMP model. This change is necessary to adjust the modeled initiating event frequencies from a per year to per reactor year basis for use in the CRMP.

Maintenance Event Probabilities Maintenance events in the baseline PRA models have probabilities based on the fraction of the year the equipment is unavailable. For the CRMP model, the actual configuration of equipment is known, so the maintenance event probabilities are set to 0. When components are in maintenance, these events (or equivalent events) are set to 1.

Primary Pressure Relief Control Interval for Anticipated Transient Without Trip (ATWT)

Events The FNP core design reflected in the baseline PRA model for ATWT events uses interval values to reflect impact of core life, whereas the CRMP model must reflect configuration-specific risk. Therefore the CRMP model is configured to select an interval value corresponding to the time in core life. The CRMP model will allow user input to select the appropriate time in life configuration applicable for RICT Program calculations.

PORV Block Valve Configuration The success criteria in the baseline PRA for primary pressure relief during ATWT is based on average values for the period of time a PORV block valve is closed. The CRMP model must reflect configuration-specific risk. Therefore the CRMP model is configured to select a value of either zero or 1.0 for closure of the PORV block valves. The CRMP model will allow user input to select the appropriate configuration applicable for RICT Program calculations.

3.0 Administrative Controls Departmental procedures and their sub-tier instructions and guidelines provide high level guidance and requirements for creating and maintaining the CRMP model for implementing the RICT Program at FNP. The procedures collectively implement the following requirements of DRAFT to NL-12-1344 Attributes of the CRMP Model E6-6 NEI 06-09, Revision 0-A (Reference 1), consistent with RG 1.177 (Reference 2) guidance, for the CRMP model:

A process for evaluation and disposition of proposed facility changes shall be established for items impacting the CRMP model (Section 2.3.4, Item 7.2).

The CRMP model shall accurately reflect the as-built, as-operated plant consistent with RG 1.200 guidance for PRA capability category II (Section 2.3.5, Item 9 and Section 4.1).

The CRMP model shall be updated to reflect the as-built and as-operated plant on a periodic basis not to exceed two refueling cycles (Section 2.3.5, Item 9.1).

Common cause treatment, as applied in the CRMP model, shall be consistent with the PRA model and Risk Managed Technical Specification (RMTS) guidance. If a component is out-of-service for planned maintenance, there is no justification for changing the common cause failure (CCF) factors. If an emergent failure occurs, the "extent of condition" evaluation performed by Operations either addresses the situation or provides assurance that a CCF is not occurring, so no changes in CCF modeling are necessary. However, optionally if an extent of condition evaluation cannot establish with a high degree of confidence that there is no common cause failure mechanism, the probability that the redundant component is failed from a common cause failure mechanism will be modified numerically, consistent with the guidance in RG 1.177 while calculating the RICT. If, for either option, it is determined that a common cause failure mechanism exists, the redundant SSC will be declared inoperable and cannot be considered available for PRA functional. The previously mentioned set of procedures/instructions ensures that basic events for CCF of multiple components will not be changed within the CRMP model by excluding (removing) them from the tag table (Section 2.3.4, Item 6). Specifically, the treatment of CCF in the CRM Tool will be as described below:

o Planned Configurations:

For planned configurations the RICT calculations will be performed consistent with NEI 06-09, Section 3.3.6, Common Cause Failure Consideration, guidance on the treatment of CCF, as follows:

For all RICT assessments of planned configurations, the treatment of common cause failures in the quantitative CRM Tools may be performed by considering only the removal of the planned equipment and not adjusting common cause failure terms.

This approach will result in slightly shorter completion times than if RICTs were calculated using the RG 1.77 approach (i.e., it is conservative), and it will prevent deviation from the NRCs approach of NEI 06-09.

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-7 o Emergent Configurations For emergent configurations, the RICT program will abide by NEI 06-09, Section 3.3.6, Common cause Failure Consideration guidance on the treatment of CCF, as follows:

For RICT assessments involving unplanned or emergent conditions, the potential for common cause failure is considered during the operability determination process.

This assessment is more accurately described as an extent of condition assessment.

In addition to a determination of operability on the affected component, the operator should make a judgement with regard to whether the operability of similar or redundant components might be affected.

The components are considered functional in the PRA unless the operability evaluations determines otherwise.

An extent of condition evaluation together with an operability evaluation will provide an assessment of the vulnerability of the operable redundant components to any common cause failure potential. The RICT determination process for an emergent configuration will be consistent with the following guidance provided in the NRC SER for NEI 06-09:

Emergent Failures. During the time when a RICT is in effect and risk is being assessed and managed, it is possible that emergent failures of SSCs may occur, and these must be assessed to determine the impact on the RICT. If a failed component is one of two or more redundant components in separate trains of a system, then there is potential for a common cause failure mechanism. Licensees must continue to assess the remaining redundant components to determine there is reasonable assurance of their continued operability, and this is not changed by implementation of the RMTS. If a licensee concludes that the redundant components remain operable, then these components are functional for purposes of the RICT. However, the licensee is required to consider and implement additional risk management actions (RMAs), due to the potential for increased risks from common cause failure of similar equipment. The staff interprets TR NEI 06-09, Revision 0, as requiring consideration of such RMAs whenever the redundant components are considered to remain operable, but the licensee has not completed the extent of condition evaluations In keeping with the above NRC guidance, if it is determined that redundant components remain operable, these components are considered PRA functional for purpose of RICT determinations. However, FNP will consider and implement additional RMAs, due to the potential for increased risks from common cause failure of similar equipment, whenever the redundant components are considered to remain operable but an extent of condition evaluation has not yet been completed. The consideration and implementation of additional RMAs, according to the NRC SER on NEI 06-09, is considered to be consistent with the guidance of RG 1.177 regarding the treatment of increased risks from common cause failures.

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-8 TS Loss of Function Conditions (LOF) A RICT is allowed to be calculated during a TS LOF Condition if at least one train in a two train system is PRA functional (for more than two train systems, the number of trains that are required to be PRA functionality is described in Enclosure 1, Table E1-1). However, the following additional constraints shall be applied to the criteria for "PRA Functional".

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality during a Technical Specifications loss of function condition where a RICT is applied.

3. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. If a TS LOF is due to CCF vulnerability of the redundant train(s) and does not impact the PRA functionality of the redundant train(s), a RICT can only be established if the inoperability of the initial TS Condition is considered PRA Functional.

Criteria shall exist to require CRMP model updates concurrent with implementation of facility changes that significantly impact RICT calculations (Section 2.3.5, Item 9.2).

Initiating event models in the CRMP shall accurately include external conditions and effects of out-of-service equipment (Section 2.3.5, Item 1).

The impacts of out-of-service equipment shall be properly reflected in the CRMP model initiating event models, as well as system response models. For example, if a certain component being declared inoperable and placed in a maintenance status is modeled in the PRA, the entry of that equipment status into the CRMP model must accommodate risk quantification to include both initiating event and system response impact (Section 4.2, Item 1).

The CRMP model fault trees shall be traceable to the PRA (Section 2.3.5, Item 3).

Changes to the CRMP model and data shall correctly reflect configuration-specific risk (Section 4.2, Item 3).

In order for human recovery actions as modeled in the PRA to be credited in the RICT Program, such actions shall be performed via approved station procedures with the implementing personnel trained in their performance (Section 4.2, Item 4).

The baseline PRA models assess average annual risk. However, some risk is not consistent throughout the year, and the CRMP tool needs to properly assess change in risk for the existing plant configuration. The departmental procedure process requires that time averaging features of the baseline PRA shall be excluded from the CRMP model (specific items discussed in Table E6.2) (Section 2.3.4, Item 5).

Benchmarking of the CRMP model against the baseline PRA is performed and documented to demonstrate consistency (Section 2.3.5., Item 3).

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-9 4.0 Quality Requirements Southern Nuclear Operating Company (SNC) employs a multi-faceted approach to establishing and maintaining the quality of the PRA models, including the CRMP models, for all operating SNC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process (described in Enclosure 5) and the use of self-assessments and independent peer reviews (described in Enclosure 2). The information provided in Enclosure 2 demonstrates that the FNP at-power internal events PRA model (including internal flooding) and internal fire PRA comply with RG 1.200, Revision 2 (Reference 3), requirements. This information provides a robust basis for concluding that the PRA is of sufficient quality for use in risk-informed licensing actions.

For maintenance of an existing CRMP model, changes made to the baseline PRA model in translation to the CRMP model, and changes made to the CRMP configuration files, are controlled and documented by departmental procedures. Those procedures specify an acceptance test to be performed after every CRMP model update. This testing verifies proper translation of the baseline PRA models and acceptance of all changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components included in CRMP to the correct basic events in the CRMP model.

Prior to the implementation of the RICT Program, results of the acceptance testing for the integrated single top model, including fire (Step 6), the optimized single top model if developed (Step 7), and the CRMP model, which is used for configuration specific calculations (Step 8) are compared with the model produced in Step 5 to ascertain fidelity of the CRMP model. The results are documented in the model development reports and/or calculations.

The model development reports will discuss the results and justify variations in the CDF and LERF results. The primary variations in the CDF and LERF results typically stem from using average maintenance models in Step 5 and zero-maintenance models in Step 8.

5.0 Training and Qualification The training for personnel developing the CRMP model used to support RICT Program implementation is developed based on SNC procedures as described in Enclosure 8. The qualification of personnel developing and using the CRMP model is controlled by SNC qualification and training programs based on the Institute of Nuclear Power Operation (INPO)

Accreditation (ACAD) requirements. SNC fleet-wide procedures establish the responsibilities and requirements for the training and qualification of personnel who perform engineering activities. The following discussion provides an overview of general accountabilities and aspects of FNP training programs applicable to plant staff involved with the CRMP tool development and use.

The Southern Nuclear Fleet Operations Training Manager is accountable for the performance and use of Training procedures. Site Functional Area Managers are responsible for the following:

Governance and oversight of any site-specific sub-tiered instructions, guidelines, and forms and the overall administration of and performance of the continuing training program DRAFT to NL-12-1344 Attributes of the CRMP Model E6-10 Conducting courses to support the training and qualification of individuals in the engineering population.

Ensuring that training and qualification records are processed in accordance with procedures.

The SNC Training Manager is responsible for conducting courses to support the training and qualification of individuals in the Engineering population and for processing Training and Qualification records in accordance with SNC fleet-wide procedures and applicable site procedures.

The Engineering Fleet Training Program Committee (TPC) is composed of the four Engineering TPC Chairs, one Training Manager, and the Vice President of Engineering. This group is responsible individually and collectively to drive training program performance to levels of excellence and leverage training to drive station performance to levels of excellence. They are responsible for ensuring:

Training program performance issues are identified and resolved Student performance shortfalls (in training and in-plant) are identified and resolved Training is a core business and addresses needs through annual, biennial and long-range planning.

Overall training program health remains strong and meet station needs, and provides workers the knowledge and skills necessary for job performance.

Approving position-specific qualifications that are designated for common fleet Engineering duties and activities.

FNP Site and Corporate Department Managers with personnel performing Job Performance Requirements (JPRs) that are covered by the Training program are responsible for the following:

Ensuring that individuals are evaluated for inclusion in, or exclusion from, the Engineering Training program population based on their job assignment.

Ensuring that personnel in their department complete qualifications and training in accordance with procedural requirements.

Maintaining and reviewing the qualification requirements in the Learning Management System (LMS).

Administering the Engineering Training Population Determination Form for Supervisors who perform engineering activities independently or who perform the Final Technical Review of engineering activities. This applies regardless of inclusion in or exclusion from the Engineer population.

DRAFT to NL-12-1344 Attributes of the CRMP Model E6-11 Ensuring that only qualified individuals perform engineering activities independently or perform the Final Technical Review of engineering activities. This applies to individuals regardless of inclusion in or exclusion from the Engineer population.

Designating one or more individuals as Department Training Coordinator(s) to ensure effective use of LMS.

Designating personnel to be Technical Mentors.

Participating in Engineering Training Committees, which oversee the Engineering Support Personnel Accredited Training Program.

Coordinating the scheduling of assignments Each Supervisor with personnel performing JPRs covered by the Training program is responsible for the following:

Checking employee qualifications prior to assigning work, to ensure that the assigned personnel are qualified for the work being assigned Ensuring items and qualifications are assigned, as needed, to assigned personnel Participating in Engineering Training Committees, which oversee the Engineering Support Personnel Accredited Training Program.

Personnel performing Engineering JPRs that are covered by the training program are responsible for the following:

Verifying they are qualified in the Learning Management System (LMS) prior to independently performing the work, whether or not they are in the accredited program population.

Ensuring that completion of qualifications and training is done in accordance with procedural requirements.

As stated above, the qualification of personnel developing and using the CRMP model is controlled by the SNC qualification and training programs, which are based on INPO ACAD requirements.

6.0 References

1. NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Nuclear Energy Institute, Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

2. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications, August 1998 (Adams Accession No. ML003740176).

3. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

DRAFT

Farley Nuclear Plant - Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines Key Assumptions and Sources of Uncertainty DRAFT to NL-NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E72

Table of Contents Introduction..................................................................................................................................... 3 Assessment of Internal Events PRA Epistemic Uncertainty Impacts.............................................. 3 Assessment of Translation Uncertainty Impacts............................................................................. 5 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts.......................................... 16 References.................................................................................................................................... 25

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E73

Introduction The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program. Topical Report NEI 06-09 (Reference 1), Section 2.3.4, item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties. The baseline internal events (including internal flooding) PRA and fire PRA (FPRA) models document assumptions and sources of uncertainty and these were reviewed during the model peer reviews.

The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT Program.

The epistemic uncertainty analysis approach described below applies to the internal events PRA, and any epistemic uncertainty impacts that are unique to FPRA are also addressed. In addition, Topical Report NEI 06-09 requires that the uncertainty be addressed in RICT Program Configuration Risk Management Program (CRMP) tools by consideration of the translation from the PRA model to the CRMP tool. The CRMP model, is discussed in Enclosure 6. It consists of separate zero-maintenance annual average PRA models which include the internal events (including internal flooding) PRA model, internal fire events PRA model that reflects NFPA 805 plant modifications, seismic bounding delta CDF/LERF values, and also main control room abandonment bounding delta CDF/LERF values that are calculated separately from the fire PRA model when a TS inoperable SSC needed for remote shutdown, consistent with plant operating procedures, is determined not to be PRA functional. The main control room abandonment bounding delta CDF/LERF option will no longer be used after its contribution is fully integrated into the fire PRA model. The CRMP model that reflects the as-built and as-operated plant condition including credit for NFPA 805 modifications will be developed prior to implementation of the RICT Program. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the CRMP tool during RICT Program calculations.

Assessment of Internal Events PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty for RICT Program application, the internal events baseline PRA model uncertainty report was developed, based on the guidance in NUREG-1855 (Reference 2). As described in NUREG-1855, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the Farley Nuclear Plant (FNP) baseline PRA model aleatory uncertainty analysis as part of the baseline model development and quantification (Reference 3).

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. The assumptions are defined consistent with the definition provided in NUREG-1855. Plant-specific assumptions made for each of the FNP internal events PRA technical elements are collected from each portion of the PRA model development and quantification and evaluated for the base PRA.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E74

The evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. The Electric Power Research Institute (EPRI) compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (EPRI 1016737, Reference 5) and an evaluation of each generic source of modeling uncertainty was performed (Reference 4).

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the TSTF-505 application, based on the results of the internal events PRA and fire PRA peer reviews.

Based on following the methodology in Reference 5 for a review of sources of uncertainty, the potential sources of uncertainty and impact of these items on RICT program implementation are discussed in Table E7.1 relative to the need for consideration as key sources of uncertainty for the RICT application that might warrant treatment through additional RMAs. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.

Based on the evaluation summarized in Table E7.1, none of the evaluated sources represents a key source of uncertainty for the RICT application.

Although not addressed in Table E7.1 through review of the base model, the RICT process addresses possible uncertainty in the reliability of SSCs considered to be PRA Functional. In cases where SSC degradation may be the cause of inoperabilities, PRA Functionality determinations are performed consistent with the following NEI 06-09 guidance:

The PRA function may be considered in cases that involve SSC inoperabilities which, while degraded, do not involve a potential for further degrading component performance. In most cases, degrading SSCs may not be considered to be PRA functional while inoperable. For example, a pump which fails its surveillance test for required discharge pressure is declared inoperable. It cannot be considered functional for calculation of a RICT, since the cause of the degradation may be unknown, further degradation may occur, and since the safety margin established by the pump's operability requirements may no longer be met. As a counter example, a valve with a degrading stroke time may be considered PRA functional if the stroke time is not relevant to the performance of the safety function of the valve; for example, if the valve is required to close and is secured in the closed position."

As a result, the failure probability need not be increased depending on the failure mechanism causing the degraded condition. The SSC's nominal reliability remains applicable and consistent with the definition of PRA functionality in NEI 06-09 0-A, process requirement number 11.1.2 (i.e.,

further degradation that could impact PRA functionality is not expected during the RICT). Given an inoperable condition caused by a degraded condition, the FNP RlCT Program allows only two choices to be made in the CRM Tool:

Either a "PRA non-functional" or "PRA functional" condition to represent the TS degraded condition.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E75

o If the inoperability is evaluated as a "PRA non-functional" condition, CRM Tool will treat the SSC as failed, or o If the inoperability is evaluated as a "PRA functional" condition, CRM Tool will treat the SSC with the nominal base-case failure probability.

The rationale for using the nominal reliability for a PRA functional SSC includes the determination that the base case PRA results are still applicable, the degraded condition has been demonstrated to meet the PRA success criteria, and the SSC is considered fully available. No additional uncertainty or sensitivity analysis is planned to be performed during a RICT entry, which is consistent with the expectations of NEI 06-09 and the NRC SER on NEI 06-09.

The baseline PRA does not include seasonal variations from hazards but there are certain initiating events that can be affected by seasonal variations (e.g., loss of offsite power). The assumptions involve applying the generic industry frequency for the loss of offsite power event developed in NUREG/CR-6890 (Reference 14). The RICT Program will include a qualitative consideration of weather events as part of the RMA decision process when LCO 3.8.1 CTs are extended to address this source of uncertainty.

Assessment of Translation Uncertainty Impacts Modification of the baseline PRA models is required to create the CRMP model used for RICT Program calculations. These modifications, described in Enclosure 6, may introduce new sources of model translation uncertainty. Table E7.2 provides a description of the model changes and dispositions of whether any of the model changes made represent possible new sources of model uncertainty that must be addressed.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E76

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Loss Of Offsite Power (LOSP) frequency and fail to recover offsite power probabilities LCOs for which LOSP scenarios have an effect on the RICT The LOSP frequency and fail to recover offsite power probabilities are based on available industry data.

The overall approach for the LOSP frequency and fail to recover probabilities utilized is consistent with industry practice.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations. However, the RICT Program will include a qualitative consideration of weather events as part of the RMA decision process when LCO 3.8.1 CTs are extended to address this source of uncertainty.

Reactor coolant pump (RCP) seal LOCA modeling Potentially all LCOs in the RICT program The plant has been modified to install the RCP shutdown seals developed by Westinghouse to reduce the likelihood of RCP seal leakage beyond normal values. The shutdown seal is modeled consistent with WCAP-17100 (Reference 8).

Consequential RCP Seal failure as a result of loss of seal cooling is treated through the fault tree structure.

Because a consensus industry seal LOCA model endorsed by the NRC is used, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E77

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Failure of core cooling following containment failure is not explicitly modeled LCOs for which loss of containment heat removal scenarios have an effect on the RICT A combination of generic and plant-specific analyses are used to evaluate the impact of containment failure on ECCS recirculation. Failure of ECCS recirculation as a consequence of containment overpressure or isolation failure is not modeled. Since the Farley design basis does not credit containment overpressure in the RHR pump NPSH analysis, and the Farley PRA requires operable cooling through the RHR heat exchangers or containment fan coolers for success of ECCS recirculation, the loss of NPSH due to steam release from an unisolated containment is considered unlikely.

Therefore, this is not a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E78

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition The diesel generator switchgear room coolers are not included in the PRA model LCOs for which the availability of on-site ac power have an effect on the RICT Room heat up calculations performed for the diesel generator switchgear rooms shows that the realistic equipment operability temperature limit appropriate for the switchgear rooms was not exceeded after 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months loss of ventilation (Reference 16)

This may represent a source of model uncertainty because the TS equipment operability limit is lower than the realistic operability limit. The contribution of room cooling failures to DG switchgear failure will not be an issue for delta risk applications, i.e., including the room coolers in the model would affect the baseline and RICT configuration in the same manner and not significantly impact the delta risk calculations.

Further, the modeling is conservative for RICT in the sense that if the DG or DG switchgear were declared inoperable due to room cooling issues, a PRA functionality determination could not be made without appropriately including the room coolers and associated support equipment, and any necessary operator actions into the model. Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E79

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Credit for battery life out to two hours based on conservative FSAR analysis without explicit representation of or credit for successful load shedding LCOs for which the availability of on-site ac power have an effect on the RICT The two hour battery life assumes procedurally-directed load shedding has not been implemented.

Without recovery of DC power at two hours, equipment requiring DC power (e.g., turbine-driven AFW pump (TDAFW)) is assumed unavailable after battery depletion. However, realistically assessing battery life involves other uncertainties and is complex.

Although this may represent a source of model uncertainty, it is unlikely to be an issue for delta risk applications, since the DC supply to the TDAFW pump has a four-hour rating and manual action could be taken to maintain the steam admission valves open beyond 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (Reference 15). Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E710

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition The use of a single value in the PRA model for unrecoverable failure due to sump screen plugging for all sequences.

Potentially all LCOs in the RICT program There is not a consistent method for the treatment of ECCS sump performance. Unrecoverable failure of recirculation due to sump screen plugging is included in the model for each sump intake based on NUREG/CR-4550 (Reference 9). Although this may represent a moderate source of model uncertainty, it is not an issue for delta risk applications since sump screen plugging is not TS-specific so that the assumption affects both the baseline and RICT calculations equally.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

Assumption that failure of pressure relief (if required) is negligible and can be ignored in the success criteria for all sequences except ATWS.

Potentially all LCOs in the RICT program For transients other than ATWS, there is significant redundancy in RCS pressure relief capability, such that the likelihood of pressure relief failure is small and is unlikely to be an issue for delta risk applications.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E711

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Treatment of thermally-induced SGTR, and no credit for RCS depressurization by induced hot leg or surge line failure and subsequent in-vessel injection.

LCOs for which the LERF results may have some effect on the RICT During high-pressure core damage scenarios, a "race" occurs to determine where the RCS will first fail. While the reactor vessel will eventually fail as the molten core degrades the lower vessel head, failures may also occur in the steam generator tubes (discussed below) or in the hot leg or surge line of the reactor coolant system. For high-pressure, station-blackout-like scenarios which tend to occur on this branch, the likelihood of hot leg failure is very high. Pressure induced and thermally induced SGTR are modeled as separate events in the Level 2 event tree. If an induced SGTR does not occur then hot leg/surge line failure is evaluated in the event tree. The approach used is consistent with industry practice, in accordance with WCAP-16341-P (Reference 10).

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E712

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Interfacing Systems LOCA (ISLOCA) frequencies Potentially all LCOs in the RICT program A detailed ISLOCA analyses was performed that involved screening of potential ISLOCA pathways, calculation of the frequency of failure of the high pressure/low pressure interface of each unscreened interfacing system, and calculation of the probability of piping or component failure in the interfacing system as a result of the exposure to high pressure.

Calculations were performed to assess the failure frequency of each scenario based on its specific configuration. These calculations are based on NSAC-154 (Reference 11) and NUREG/CR-5102 (Reference

12) with modifications as appropriate to represent differences in the Farley configuration. The impacts of overpressure on each of the above ISLOCA scenario pathways were evaluated using the guidelines of NUREG/CR-5862 (Reference 13).

The approach for the ISLOCA frequency determination applies state-of-the art methods.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E713

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Treatment of flow diversion paths Potentially all LCOs in the RICT program In the PRA model, diverted flow paths in fluid systems are removed if the cross-sectional area of the diversion path is less than ten percent of the cross-sectional area of the main process flow path, and potential flow diversion paths that are greater than one third (1/3) the diameter of the main flow path should be further evaluated. This approach does not explicitly treat pressure effects of flow diversions from high pressure to low pressure, and no supporting thermal hydraulic analyses are performed to assess the validity of this assumption for these cases.

This should not be an important source of model uncertainty in most applications, particularly delta-risk applications, since the flow diversion assumptions are not TS-specific, and the assumption affects both the baseline and RICT calculations equally. Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E714

Table E7.1 Assessment of Internal Events PRA Epistemic Uncertainty Impacts Epistemic Uncertainty and Assumptions TS LCOs Model Sensitivity and Disposition Human Error Probabilities (HEPs): Uncertainties associated with the assumptions and method of calculation of HEPs for the Human Reliability Analysis (HRA) may introduce uncertainty.

Detailed evaluations of HEPs are performed for the risk significant human failure events (HFEs) using industry consensus methods. Mean values are used for the modeled HEPs. Uncertainty associated with the mean values can have an impact on CDF and LERF results.

Potentially all LCOs in the RICT program The FNP PRA model is based on industry consensus modeling approaches for its HEP calculations, so this is not considered a significant source of epistemic uncertainty.

Therefore, this does not represent a key source of uncertainty and will not be an issue for RICT calculations.

Refer to Enclosure 10 for additional discussion on risk management actions (RMAs).

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E715

Table E7.2 Assessment of Translation Uncertainty Impacts EOOS or Similar CRMP Model Part of Model Affected Impact on Model Disposition Model logic structure optimized if required to increase solution speed.

Analysis Assumptions: None Event trees, one-top model structure, inserted fire initiating events The restructured model is logically equivalent and produces results comparable to the baseline PRA logic model Since the restructured model produces comparable numerical results, this is not a source of uncertainty.

Incorporation of seismic bias to support RICT Program risk assessment calculations as FNP does not include a seismic PRA.

Analysis Assumptions: A conservative value for seismic delta CDF is applicable.

Calculation of RICT and RMAT within EOOS or similar CRMP model The addition of a bounding impact for seismic events has no impact on baseline PRA or CRMP model since it is added as an additional delta risk contribution. Impact is reflected in calculation of RICT and RMAT.

Since this is a bounding approach for addressing seismic risk in the RICT Program, it is not a source of uncertainty, and RICT Program calculations are not impacted, so no mandatory RMAs are required.

The use of bounding approach is acceptable per NEI 06-09 guidance.

Set plant availability (PAV) basic event to 1.0.

Analysis Assumptions: None Basic event PAV Since the CRMP model evaluates specific configurations during at-power conditions, the use of a PAV factor less than 1.0 is not appropriate. This change allows the CRMP model to produce accurate results for specific at-power configuration.

This change is consistent with CRMP tool practice; therefore this change does not represent a source of uncertainty, and RICT Program calculations are not impacted, so no mandatory RMAs are required.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E716

Assessment of Supplementary Fire PRA (FPRA) Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the FNP FPRA (Reference 6). The FNP FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA and because the state of knowledge in these elements continues to evolve. The Farley FPRA was developed using consensus methods outlined in NUREG/CR-6850 (Reference 7) and interpretations of technical approaches as required by NRC for approval of the NFPA-805 application. Enclosure 2 provides a detailed discussion of the Peer Review F&Os and the resolutions.

FNP used guidance provided in NUREG-1855 (Reference 2) to address uncertainties associated with FPRA for the RICT Program application. As stated in Section 1.5 of NUREG-1855:

Although the guidance does not currently address all sources of uncertainty, the guidance provided on the process for their identification and characterization and for how to factor the results into the decision making is generic and is independent of the specific source.

Consequently, the process is applicable for other sources such as internal fire, external events, and low power and shutdown.

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It defines:

A source of model uncertainty is one that is related to an issue in which no consensus approach or model exists and where the choice of approach or model is known to have an effect on the PRA (e.g., introduction of a new basic event, changes to basic event probabilities, change in success criterion and introduction of a new initiating event).

NUREG-1855 defines consensus model as:

A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRC has utilized or accepted for the specific risk-informed application for which it is proposed.

The potential sources of model uncertainty in the FPRA model were characterized for the 16 tasks identified by NUREG/CR-6850. This framework was used to organize the assessment of baseline FPRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations. Table E7.3 outlines sources of uncertainties by task and their disposition.

The results of this assessment concluded that no sensitivity analyses were needed.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E717

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 1

Analysis boundary and partitioning This task establishes the overall spatial scope of the analysis and provides a framework for organizing the data for the analysis. The partitioning features credited are required to satisfy established industry standards.

The methodology for the Analysis Boundary and Partitioning task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

2 Component Selection This task involves the selection of components to be treated in the analysis in the context of initiating events and mitigation. The potential sources of uncertainty include those inherent in the internal events PRA model as that model provides the foundation for the FPRA.

In the context of the FPRA, the uncertainty that is unique to the analysis is related to initiating event identification. However, that impact is minimized though use of the PWROG Generic MSO list and the process used to identify and assess potential MSOs.

The methodology for the Component Selection task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

3 Cable Selection The selection of cables to be considered in the analysis is identified using industry guidance documents. Some systems are not credited in the FPRA and are therefore treated as being failed everywhere. The overall process is essentially the same as that used to perform the analyses to demonstrate compliance with 10 CFR 50.48.

The methodology for the Cable Selection task does not introduce any epistemic uncertainties that would require sensitivity treatment.

Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E718

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 4

Qualitative Screening Qualitative screening was not performed; however, some structures (locations) were eliminated from the global analysis boundary and ignition sources deemed to have no impact on the FPRA (based on industry guidance and criteria) were excluded from the quantification based on qualitative screening criteria. The only criterion subject to uncertainty is the potential for plant trip. However, such locations would not contain any features (equipment or cables) identified in the prior two tasks and consequently are expected to have a low risk contribution.

In the event a structure (location) which could result in a plant trip was incorrectly excluded, its contribution to CDF would be small (with a CCDP commensurate with base risk). Such a location would have a negligible risk contribution to the overall FPRA.

Based on the discussion of sources of uncertainty and the discussion above, it is concluded that the methodology for the Qualitative Screening task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

5 Fire-Induced Risk Model A reactor trip is assumed as the initiating event for all quantification. The FPRA does not consider any special initiators (like loss of Service Water or Instrument Air) and does not consider turbine trip/MSIV closure events even though they may occur in a limited number of fire scenarios.

The identified source of uncertainty could result in the over-estimation of fire risk. In general, the FPRA development process has reviewed all significant fire initiating events and performed supplemental assessments to address this possible source of uncertainty.

Based on the discussion of sources of uncertainty and the discussion above, it is concluded that the methodology for the Fire-Induced Risk Model task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E719

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 6

Fire Ignition Frequency Fire ignition frequency is an area with inherent uncertainty. Part of this uncertainty arises due to the counting and related partitioning methodology.

However, the resulting frequency is not particularly sensitive to changes in ignition source counts. The primary source of uncertainty for this task is associated with the industry generic frequency values used for the FPRA. This is because there is no specific treatment for variability among plants along with some significant conservatism in defining the frequencies, and their associated heat release rates.

Based on the discussion of sources of uncertainty, it is concluded that the methodology for the Fire Ignition Frequency task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

7 Quantitative Screening Other than screening out potentially risk significant scenarios (ignition sources), this task is not a source of uncertainty.

The Farley FPRA development did not screen out any fire initiating events based on low CDF/LERF contribution.

The methodology for the Quantitative Screening task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

8 Scoping Fire Modeling The framework of NUREG/CR-6850 includes two tasks related to fire scenario development. These two tasks are 8 and 11. The discussion of uncertainty for both tasks is provided in the discussion for Task 11.

See Task 11 discussion.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E720

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 9

Detailed Circuit Failure Analysis The circuit analysis is performed using standard electrical engineering principles. However, the behavior of electrical insulation properties and the response of electrical circuits to fire induced failures is a potential source of uncertainty. This uncertainty is associated with the dynamics of fire and the inability to ascertain the relative timing of circuit failures. The analysis methodology assumes failures would occur in the worst possible configuration, or if multiple circuits are involved, at whatever relative timing is required to cause a bounding worst-case outcome. This results in a skewing of the risk estimates such that they are over-estimated.

Circuit analysis was performed as part of the deterministic post fire safe shutdown analysis.

Refinements in the application of the circuit analysis results to the FPRA were performed on a case-by-case basis where the scenario risk quantification was large enough to warrant further detailed analysis. The uncertainty (conservatism) which may remain in the FPRA is associated with scenarios that do not contribute significantly to the overall fire risk.

The methodology for the Detailed Circuit Failure Analysis task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E721

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 10 Circuit Failure Mode Likelihood Analysis One of the failure modes for a circuit (cable) given fire induced failure is a hot short. A conditional probability is assigned using industry guidance such as that published in NUREG/CR-6850. The uncertainty associated with the applied conditional failure probabilities poses competing considerations.

On the one hand, a failure probability for spurious operation could be applied based solely on cable scope without consideration of less direct fire affects (e.g., a 0.3 failure likelihood applied to the spurious operation of a motor-operated valve (MOV) without consideration of the fire-induced generation of spurious signal to close or open the MOV). The analysis has biased the treatment such that it is assumed the spurious signal will always drive the valve in the unsafe direction. In addition, for those valves that might have multiple desired functions -

consideration of spurious closure and consideration of failure to open on demand, the non-spurious failure state is treated with a logical TRUE rather than the complement of the spurious probability. For those valves that only have an active function, the potential for a spurious signal to drive the valve in the desired direction is ignored.

The treatment results in skewing of the results such that the resulting risk is over-estimated.

Uncertainty in the circuit failure mode likelihood analysis could lead to assumed failures of related components and related system functions. This would generate conservative results and that would typically be acceptable for most applications. Furthermore, a consensus modeling approach is used for Circuit Failure Mode Likelihood Analysis.

Circuit failure mode likelihood analysis was generally limited to those components where spurious operation could not be caused by the generation of a spurious signal. This approach limited the introduction of non-conservative uncertainties. For the simple cases, the potential exists for assuming a failure likelihood greater than 0 in some areas where the cables capable of causing spurious operation are not located. Additional refinement to this approach was performed, as necessary, on risk significant scenarios. So the application of circuit failure probabilities is considered to have minimal impact on the results.

The methodology for the Circuit Failure Mode Likelihood Analysis task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E722

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 11 Detailed Fire Modeling The application of fire modeling technology is used in the FPRA to translate a fire initiating event into a set of consequences (fire induced failures). The performance of the analysis requires a number of key input parameters. These input parameters include the heat release rate (HRR) for the fire, the growth rate, the damage threshold for the targets, and the response of plant staff (detection, fire control, and fire suppression).

The fire modeling methodology itself is largely empirical in some respects and consequently is another source of uncertainty. For a given set of input parameters, the fire modeling results (temperatures as a function of distance from the fire) are characterized as having some distribution (aleatory uncertainty). The epistemic uncertainty arises from the selection of the input parameters (specifically the HRR and growth rate) and how the parameters are related to the fire initiating event.

While industry guidance is available, that guidance is derived from laboratory tests and may not necessarily be representative of randomly occurring events.

The fire modeling results using these input parameters are used to identify a zone of influence (ZOI) for the fire and cables/equipment within that ZOI are assumed to be damaged. In general, the guidance provided for the treatment of fires is conservative and the application of that guidance retains that conservatism. The resulting risk estimates are also conservative.

Consensus modeling approach is used for the Detailed Fire Modeling. Detailed fire modeling was performed only on those scenarios which otherwise would have been notable risk contributors and only where removal of conservatism in the generic fire modeling solution was likely to provide benefit either via a smaller zone of influence or to credit automatic suppression. Fire modeling was used to evaluate the time to abandonment for control room fire scenarios for a range of fire heat release rates.

The analysis methodology conservatism is primarily associated with conservatism in the heat release rates specified in NUREG/CR-6850.

A review of the generic fire modeling treatment summary zone of influence data indicates that the reduction in zone of influence is possible for smaller fires, through additional refinement of fire scenarios can be pursued using multi-point analysis of the heat release rates as opposed to the use of a bounding fire, is not significant. The potential for this slightly reduced zone of influence to reduce the consequences associated with the smaller fire is very small. Without a reduction in consequences a multi-point treatment of the heat release rate curves would have no impact on results. The methodology for the Detailed Fire Modeling task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E723

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 12 Post-Fire Human Reliability Analysis There are relatively few HFEs of high importance in the FPRA model. Conservative human error probability (HEP) adjustments were made to the nominal HEP values used in the FPIE model then revisited to address unique fire considerations. Given the methodology used, the impact of any remaining uncertainties is expected to be small.

The human error probabilities were calculated using the EPRI HRAC and included the consideration of loss of necessary cues due to fire. The impact of any remaining uncertainties is expected to be small.

The methodology for the Post-Fire Human Reliability Analysis task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

13 Seismic-Fire Interactions Assessment Since this is a qualitative evaluation, there is no quantitative impact with respect to the uncertainty of this task.

The qualitative assessment of seismic induced fires should not be a source of model uncertainty as it is not expected to provide changes to the quantified FPRA model.

The methodology for the Seismic-Fire Interactions Assessment task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E724

Table E7.3 Assessment of Supplementary FPRA Epistemic Uncertainty Impacts Task #

Description Sources of Uncertainty Disposition 14 Fire Risk Quantification As the culmination of other tasks, most of the uncertainty associated with quantification has already been addressed. The other source of uncertainty is the selection of the truncation limit. However, the selected truncation limit is several orders of magnitude below the typical CDF value calculated, and is consistent with the requirements of the PRA Standard.

The selected truncation was confirmed to be consistent with the requirements of the PRA Standard.

The methodology for the Fire Risk Quantification task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

15 Uncertainty and Sensitivity Analyses This task does not introduce any new uncertainties.

This task is intended to address how the fire risk assessment could be impacted by the various sources of uncertainty.

This task does not introduce any new uncertainties. This task is intended to address how the fire risk assessment could be impacted by the various sources of uncertainty.

The methodology for the Uncertainty and Sensitivity Analyses task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

16 FPRA Documentation This task does not introduce any new uncertainties to the fire risk.

This task does not introduce any new uncertainties to the fire risk as it outlines documentation requirements.

The methodology for the FPRA documentation task does not introduce any epistemic uncertainties that would require sensitivity treatment. Therefore, RICT Program calculations are not impacted, and no mandatory RMAs are required.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E725

As noted above, the FNP FPRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC for approval of the NFPA-805 application. Therefore, consistent with NUREG-1855 guidance, FPRA modeling does not introduce any epistemic uncertainties that would require sensitivity treatment to the RICT Program risk assessment calculations.

References

1. Topical Report NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Revision 0-A, November 2006.

2. NUREG-1855, Guidance on the treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report, March 2009.

3. Farley Nuclear Plant Units 1 and 2 Internal Events PRA Model: Revision 9 Version 3, PRA-BC-F-14-001, January 9, 2014

4. Appendix D to F-RIE-IEIF-U00-013, Characterizing the Sources of Model Uncertainty for Farley Nuclear Plant, September 2011.

5. TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, Electric Power Research Institute, Final Report, December 2008.

6. Farley Nuclear Plant Unit 1 Fire Probabilistic Risk Assessment Summary Report:

Revision 5, PRA-BC-F-11-017, August 2014.

7. EPRI/NRC-RES, Fire PRA Methodology for Nuclear Power Facilities, EPRI1011089-NUREG/CR-6850, August 2005.

8. WCAP-1700-NP, PRA Model for the Westinghouse Shut Down Seal, Revision 1, Non-proprietary, Westinghouse Electric Company, January 2010.

9. NUREG/CR-4550, Analysis of Core Damage Frequency From Internal Events:

Methodology Guidelines, Revision 1, Sandia National Laboratory for U.S. NRC, 1989

10. WCAP-16341-P, Revision 0, Simplified Level 2 Modeling Guidelines, Westinghouse Electric Company, November 2005.

11. NSAC-154, ISLOCA Evaluation Guidelines, ERIN Engineering and Research, Inc.

(prepared for Electric Power Research Institute), September 1991.

12. NUREG/CR-5102, Interfacing Systems LOCA: Pressurized Water Reactors, Brookhaven National Laboratory for U.S. NRC, February 1989.

13. NUREG/CR-5862, Screening Methods for Developing Internal Pressure Capacities for Components in Systems Interfacing with Nuclear Power Plant Reactor Coolant Systems, U.S. NRC, May 1992.

DRAFT

to NL-18-0039 Disposition of PRA Modeling Epistemic Uncertainty

E726

14. NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants,"

U.S. NRC, December 2005

15. Joseph M. Farley Nuclear Plant Units 1 and 2, Accident Sequence Notebook PRA Model Revision 9, Version 1.2, September 2010.

16. NAI-1551-006, Revision 1, Farley Nuclear Plant Units 1 and 2 Auxiliary and Control Building GOTHIC Room Heat-up Analysis PRA cases, August 2014.

DRAFT

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Program Implementation DRAFT to NL-18-0039 Program Implementation E8-2 Table of Contents

1.0 INTRODUCTION

.................................................................................................. 3 2.0 RICT PROGRAM PROCEDURES....................................................................... 3 2.1 On-Line Configuration Risk Management Program................................... 4 2.2 Risk Management Actions for the Risk Informed Completion Time Program..................................................................................................... 4 2.3 Calculation of RMAT and RICT for the RICT Program:.............................. 5 2.4 PRA Functionality Determination............................................................... 6 2.5 Recording LCOs........................................................................................ 7 3.0 RICT PROGRAM TRAINING................................................................................ 8 3.1 Level 1 Training......................................................................................... 9 3.2 Level 2 Training......................................................................................... 9 3.3 Level 3 Training......................................................................................... 9

4.0 REFERENCES

................................................................................................... 10 DRAFT to NL-18-0039 Program Implementation E8-3 1.0 Introduction This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk Informed Completion Time (RICT) Program including training of the personnel required for implementation of the RICT Program. Several procedures and processes are detailed in Enclosures 5, 9, and 10; those discussions are not repeated as part of this enclosure. Those topics include Probabilistic Risk Assessment (PRA) Maintenance and Update process (Enclosure 5), Cumulative Risk Assessment and Performance Monitoring Program (Enclosure 9), and Risk Management Actions (Enclosure 10).

2.0 RICT Program Procedures The procedures discussed below were developed for implementing the RICT Program for the SNC fleet, and are currently in effect for Vogtle Electric Generating Plant. They will be adopted for use in implementing the FNP RICT program. They provide guidance to the appropriate SNC personnel on the following topics:

On-Line Configuration Risk Management Program (CRMP, Reference 2):

This procedure provides requirements for Implementation of the RICT program while in Modes 1 & 2. In addition, it provides requirements for outlining planning and scheduling strategies to minimize risk (in terms of core damage frequency (CDF, ICDP) and large early release frequency (LERF,ILERP)), and meeting requirements necessary for maintaining and retaining a chronological history of configuration changes and their risk impacts (in terms of CDF,ICDP,LERF, and ILERP) throughout the operating cycle Risk Management Actions (RMAs) for the RICT Program (Reference 3):

This instruction provides requirements for development and implementation of RMAs for the RICT program.

Calculation of RMAT and RICT for the RICT Program (Reference 4):

This procedure provides detailed requirements and limitations of the RICT Program at Southern Nuclear Company. It includes the calculation of RICT and RISK MANAGEMENT ACTION TIMES (RMAT). This procedure is applicable to sites that have an approved license amendment to use the RICT Program.

PRA Functionality Determination (Reference 5):

This procedure provides requirements for determining whether structures, systems and components (SSCs) that are declared inoperable can be considered PRA FUNCTIONAL in RICT calculations.

Recording Limiting Conditions for Operation (Reference 6):

This procedure provides instructions to the control room operator for using the interface between the control room electronic narrative log and CRMP.

DRAFT to NL-18-0039 Program Implementation E8-4 The procedures discussed above may be revised or supplemented by other procedures, as deemed necessary to implement the RICT Program effectively at FNP Units 1 and 2. They are described in more detail below.

2.1 On-Line Configuration Risk Management Program This procedure (Reference 2) describes, in general terms, the CRMP, as it pertains to the RICT Program as well as parts of the 10 CFR 50.65(a)(4) program. It is the parent procedure for both these programs.

With respect to the RICT Program, this procedure has the following attributes:

Identifies the plant management individual with the authority to approve entry into the RICT Program.

Details the plant conditions under which the RICT Program is applicable.

Acts as the overarching guidance for the SNC risk assessment and risk management procedures.

Contains important definitions for the RICT Program.

Details many of the requirements, per NEI 06-09 Revision 0-A (Reference 1), for the RICT Program.

Identifies departmental and position responsibilities within the RICT program.

Outlines the requirement to identify and implement Risk Management Actions (RMAs) when the RMAT is exceeded or is anticipated to be exceeded.

Describes the necessary attributes for the SNC CRMP tool.

The above guidance is consistent with NEI-06-09 (Reference 1).

The CRMP procedure is maintained as a SNC procedure. It is managed by the Fleet Work Control Manager and is under the ownership of Fleet Work Management (FWM). The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.2 Risk Management Actions for the Risk Informed Completion Time Program This procedure (Reference 3) describes the risk assessment and management processes for the SNC fleet of nuclear plants. It provides general guidelines for the risk assessment and management of maintenance activities, both planned and emergent. This procedure is a sub-tier procedure to the On-Line CRMP, described above.

Risk Management Actions are targeted toward RMA candidates in order to manage and control increases in CDF/LERF attributed to internal events, fire events, and other hazards modeled in CRMP which include the following:

Identify RMA candidates which identify SSCs, initiating events and fire zone considered important for a given plant configuration when a RICT is implemented.

Develop RMAs using RMA candidates and develop additional RMAs, as appropriate.

Communicate RMAs to Operations, Fire Protection personnel, and other affected departments to facilitate RMA planning and RMA implementation.

DRAFT to NL-18-0039 Program Implementation E8-5 Implement RMAs for conditions which require RMA implementation as required prior reaching RMAT.

Document implementation of RMAs in the Control Room Narrative Log. The time of actual implementation and removal of RMAs should be documented. This may be accomplished in multiple log entries.

The risk management procedure also indicates that while the Outage and Scheduling department is responsible for the planning, scheduling and assessing planned maintenance items, the site Operations department is primarily responsible for the evaluation of emergent work for the RICT Program. This evaluation includes the risk assessments and the calculation of the RMATs and RICTs.

The Risk Management Actions program guidance is maintained as a SNC procedure. It is primarily utilized by the Outage and Scheduling and Operations Departments under the ownership of Fleet Work Management. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.3 Calculation of RMAT and RICT for the RICT Program:

This procedure (Reference 4) provides requirements and limitations of the RICT program at SNC. It includes the guidance necessary for the calculation of RMATs and RICTs for the RICT Program. It provides the steps necessary to perform the automated calculation using the CRMP tool, as well as providing the necessary steps for a manual calculation.

For planned maintenance, personnel from the Outage and Scheduling department will calculate the RICT Program values. For emergent work, the calculation will be performed by the Operations department. If plant conditions demand that the Operations department is unable to perform the calculations, this responsibility is delegated to the Outage and Scheduling department personnel. However, entry into a Technical Specification Limiting Condition for Operation (LCO) Action statement is the responsibility of the licensed operators; this is also true for the RICT Program. Consequently, even though Outage and Scheduling may calculate a RICT in anticipation of some future entry into the RICT Program, the actual RICT will be put into place by the control room staff. In other words, the on-shift licensed operators and shift management will be generating the paperwork necessary for entry into the RICT Program, just as they do for entry into an LCO Action statement. Additionally, the Plant Manager is responsible for approving entry into the RICT Program and approving changes to RICT Maintenance States.

The RMAT and the RICT risk levels are referenced to the Core Damage Frequency (CDF) and the Large Early Release Frequency (LERF) associated with the zero-maintenance state. The actual calculation evaluates the Incremental CDF (ICDF) and the Incremental LERF (ILERF) to determine the RMAT and RICT values. The evaluation is performed using the single top internal events PRA model, Fire PRA model, a bounding seismic analysis, and a bounding control room abandonment fire analysis that will be used until detailed fire modeling has been completed for these scenarios and is incorporated into the CRMP model.

The procedure contains the following guidance, restrictions and limitations, which are based on, and consistent with, NEI 06-09 (Reference 1):

DRAFT to NL-18-0039 Program Implementation E8-6 Prohibitions from entering the RICT Program voluntarily during a TS Loss of Function (LOF) Condition or when all trains or subsystems of equipment required by the TS LCO would be inoperable, unless PRA functionality has been established.

Guidance on the use of RMAs, including the conditions under which they may be credited in calculations.

Conditions under which a RICT Program may not be used.

States that a RICT may not go beyond the 30 day back stop limit.

States that a RICT may not go beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for a Loss of Function (LOF) Condition.

Guidance on plant configuration changes, for example, the procedure requires recalculating the RICT and RMAT within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of the change.

Conditions for exiting the RICT Program.

The above procedural guidance is maintained in a SNC procedure, as well as in the FNP Technical Specifications. As already mentioned, the calculation of RICT Program values are the responsibility of the Operations department (emergent conditions) and the Outage and Scheduling group (planned conditions). The procedure is managed by Fleet Work Management (FWM) and is under the direction of the FWM Manager. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.4 PRA Functionality Determination This procedure (Reference 5) provides requirements for determining whether structures, systems and components (SSCs) that are declared inoperable can be considered PRA functional in RICT calculations. This procedure lists three specific conditions under which an inoperable SSC is considered PRA Functional, based NEI 06-09 guidance (Reference 1).

They are as follows:

1) Condition 1: If the SSC is declared inoperable due to degraded performance parameters and the PRA success criteria are met, then the component may be considered PRA functional, subject to the following:

The degraded condition must be identified, and there is a reasonable expectation that additional degradation will not occur during the RICT.

For example, a valve fails its in-service testing stroke time acceptance criteria, but the response time of the valve is not relevant to the ability of the valve to provide its mitigation function as required in the PRA; therefore, the valve may be considered PRA functional.

2) Condition 2: If the condition causing the inoperability impacts one or more functions modeled in CRMP, and the inoperable SSC is still capable of supporting one or more functions modeled in CRMP, then the unaffected function(s) may be considered PRA functional.

For example, a valve is inoperable but secured in the closed position. Supported functions of the valve listed in a FNP RICT System Guideline require the valve to open and close. The condition can be addressed in CRMP by failing functions which require an open valve, but the valve may be considered PRA functional for functions which require a closed valve.

DRAFT to NL-18-0039 Program Implementation E8-7

3) Condition 3: If the condition causing the inoperability impacts only function(s) that are not modeled in CRMP and the FNP RICT System Guideline states the affected function(s) has no risk impact, then the SSC may be considered PRA functional.

For example, a pump backup start feature is inoperable and the feature is not credited in the PRA model (assumed failed); the RICT calculation may assume availability of the associated pump since the risk of the nonfunctional backup start feature is part of the baseline risk.

If the RICT program determines an SSC is not PRA Functional, the SSC will be treated as failed for the RICT calculation.

The following additional conditions are applicable when a PRA Functionality evaluation is performed when a RICT is applied to a TS LOF Condition:

1) One train is required to be PRA Functional.

2) Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the Technical Specifications safety function, i.e., alternative SSCs cannot replace the SSCs covered by the TSs.

3) Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality during a Technical Specifications loss of function condition where a RICT is applied.

4) A 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months RICT backstop applies.

5) A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria When a situation arises requiring a PRA Functional assessment, site Operations department will perform the assessment and determine whether or not a specific SSC may be considered PRA Functional. RIE personnel will support the Operations personnel on an as-needed basis during the PRA Functional assessment. If the Technical Specification Front Stop will be exceeded in less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the formal evaluation will be performed as soon as possible.

The above guidance is maintained in SNC procedures. It is used primarily by Operations and RIE personnel with Operations personnel having the primary responsibility for making PRA Functionality determinations. The procedure is managed by the Administrative department and is under the direction of the FWM Manager. The ownership of this procedure is subject to change if deemed appropriate. This procedure is currently designated as applicable only to Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

2.5 Recording LCOs This procedure (Reference 6) provides the Operations department with the guidance for maintaining Control Room Operator narrative logs and LCO logs as well as other control room documentation. It will be revised to address the RICT Program in a manner consistent with the DRAFT to NL-18-0039 Program Implementation E8-8 existing equivalent guidance for Vogtle Units 1 and 2 (Reference 7) prior to implementation of the RICT program at FNP. The Recording LCOs procedure provides the guidance necessary for the operation of the interface tool between the operator narrative log and LCO log with the CRMP monitor.

A software interface facilitates updating CRMP when the Control Room Operators remove (or return) a component to service that affects the risk profile. The procedure provides the steps for the Operators to perform when updating their electronic narrative log and LCO log to ensure the updated status is adequately transferred to CRMP. A RICT can still be entered, managed and exited by manually entering equipment service status and LCO conditions into CRMP at the discretion of the user if the automated interfaces are unavailable, or if the user elects to not use the automatic interface capability. The Control Room Operators and the Shift Supervisor have responsibility for maintaining their respective logs. Information entry for the narrative log and LCO log (or the CRMP interface) is primarily the responsibility of the Control Room Operator at-the-controls.

The above procedural guidance is maintained as a FNP Operations departmental procedure. It is used by the FNP Operations department, and Operations management is responsible for its content and maintenance. The ownership of this procedure is subject to change if deemed appropriate.

3.0 RICT Program Training The scope of the training for the RICT Program will include training on rules for the new TS program, CRMP modifications, TS Actions included in the program, and procedures. This training will be conducted for SNC site and corporate personnel. The personnel that will require training are as follows:

Site Personnel Corporate Personnel Operations Site Functional Area Manager Operations Personnel (Licensed and Non-Licensed)

Operations Training Outage & Scheduling Site Functional Area Manager Outage & Scheduling Personnel Work Week Managers Nuclear Licensing Site Personnel Selected Maintenance Personnel Site Engineering Risk Informed Engineering Site Risk Analyst and Backups Other Management Operations Corporate Functional Area Manager Outage & Scheduling Corporate Functional Area Manager Nuclear Licensing Corporate Functional Area Manager and Site Functional Area Manager Nuclear Licensing Personnel Risk Informed Engineering Management Selected Risk Informed Engineering Personnel Other Management Training will be carried out in accordance with SNC training procedures and processes (e.g.,

Reference 8). These procedures were written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training. SNC has developed three levels of training for implementation of the RICT Program at Vogtle Units 1 and 2, and these will be adopted for DRAFT to NL-18-0039 Program Implementation E8-9 training for implementation of the RICT Program at FNP once the FNP RICT program is approved. They are described below:

3.1 Level 1 Training This is the most detailed training. It is intended for the individuals who will be directly involved in the implementation of the RICT Program. This level of training includes the following attributes:

Specific training on the revised Technical Specifications New Record Keeping Requirements Case Studies Hands-on time with the CRMP monitor o Calculating a RMAT and RICT Identifying appropriate Risk Management Actions (RMA)

Determining PRA Functionality Common Cause Failure Considerations 3.2 Level 2 Training This training is geared towards Supervisors, Managers, and individual contributors who need to understand the RICT Program. It is significantly more detailed than Level 3 Training (described below), but it is different from Level 1 Training in that hands-on time with the CRMP monitor and Case Studies are not included. The concepts of the RICT Program will be taught, but this group of personnel will not be qualified to perform the tasks of the Control Room Operators or the Work Week Managers.

3.3 Level 3 Training This training will be intended for the remaining personnel who should have an awareness of the RICT Program. These employees need basic knowledge of RICT Program requirements and procedures, but they do not need working knowledge of these requirements and procedures.

This training will cover RICT Program concepts that are important to disseminate throughout the organization.

All of the above training will be conducted within the procedural guidance set forth in SNCs Training and Qualification procedures (e.g., References 9 and 10).

DRAFT to NL-18-0039 Program Implementation E8-10 4.0 References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322)

2. Southern Nuclear Company NMP-GM-031, On-Line Configuration Risk Management Program

3. Southern Nuclear Company NMP-GM-031-003, Risk Management Actions for 10 CFR 50.65(a)(4) and the Risk Informed Completion Time Program, Version 4.0, October 2017.

4. Southern Nuclear Company NMP-GM-031-002, Calculation of RMAT and RICT for the RICT Program, Version 2.0, October 2017.

5. Southern Nuclear Company NMP-GM-031-004, PRA Functionality Determination, Version 2.0, October 2017.

6. Farley Nuclear Plant FNP-0-SOP-0.13, Recording Limiting Conditions for Operation, Version 34, May 2017

7. Vogtle Electric Generating Plant Units 1 and 2, 10008-C, Recording Limiting Conditions for Operation, Version 31, October 2017

8. Southern Nuclear Company NMP-TR-104, SNC Training Committees, Version 15.0

9. Southern Nuclear Company NMP-TR-415, Systems Operator Initial and Continuing Training Program, Version 5.0

10. Southern Nuclear Company NMP-TR-416, Licensed Operator Continuing Training Program Administration, Version 8.0 DRAFT

Farley Nuclear Plant Units 1 and 2 License Amendment Request to Revise Technical Specifications to Implement NEI 06-09, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" Cumulative Risk and Performance Monitoring Program DRAFT toNL180039 CumulativeRiskandPerformanceMonitoringPrograms

E91

Table of Contents

1.0 INTRODUCTION

.................................................................................................. 2 2.0 RISK INFORMED APPLICATIONS...................................................................... 2 3.0 PERFORMANCE MONITORING PROGRAM...................................................... 2

4.0 REFERENCES

..................................................................................................... 3 DRAFT toNL180039 CumulativeRiskandPerformanceMonitoringPrograms

E92

1.0 Introduction This Enclosure provides summaries of the three procedures that govern the implementation of the Southern Nuclear Operating Company (SNC) Risk-Informed Completion Time (RICT)

Programs Calculation of Cumulative Risk and Performance Monitoring.

Calculation of cumulative risk for the RICT Program is discussed in step 14 of Section 2.3.1 and step 7.1 of Section 2.3.2 of Topical Report NEI 06-09, Revision 0-A (Reference 1). The Performance Monitoring Program is discussed in Section 2.3, Element 3 of Regulatory Guide (RG) 1.174 (Reference 2). Further elaboration on the Performance Monitoring Program is found in Section 3 of RG 1.177 (Reference 3). The NRCs Safety Evaluation of NEI 06-09 (Reference

1) requests that the above procedures be discussed in the License Amendment Request.

The procedures referred to are currently effective with respect to the approved Vogtle RICT program and will be made effective for FNP once the RICT program is approved for implementation at FNP.

2.0 Risk Informed Applications This procedure contains the instructions for the calculation of cumulative risk. The Risk Informed Engineering (RIE) Department is the procedure owner and the RIE site engineer is responsible for executing the procedure. The procedure requires the calculation of cumulative risk at least every fuel cycle, not to exceed 24 months.

The procedure requires gathering historical data with respect to RICT Program entries for an assessment period which, as previously mentioned, is one fuel cycle, not to exceed 24 months.

The procedure provides the method for calculating the cumulative Incremental Core Damage Probability (ICDP) and Incremental Large Early Release Probability (ILERP). These values are then converted into average annual values which are then compared to the limits of RG 1.174 (Reference 2).

If any limits are exceeded, a Condition Report (CR) is written to ensure the data is reviewed to assess the cause and to implement any necessary corrective actions to ensure future plant operation is within the guidance. This evaluation assures that RMTS program implementation meets RG 1.174 (Reference 2) guidance for small risk increases.

The procedure further instructs personnel to document the periodic assessment in a calculation including the cumulative risk, the method of monitoring the cumulative risk, comparison with RG 1.174 limits (Reference 2), and any condition reports issued including references to items that track development and/or completion of corrective actions. This procedure is under the oversight of the RIE department.

3.0 Performance Monitoring Program Performance Monitoring is described in the Maintenance Rule implementation procedure as well as the On-Line Configuration Management procedure. This procedure is currently applicable to DRAFT toNL180039 CumulativeRiskandPerformanceMonitoringPrograms

E93

Vogtle Units 1 and 2. Upon approval of the RICT program for FNP, the procedure will be revised to note that it is also applicable to FNP Units 1 and 2.

The purpose of performance monitoring is to monitor the effects of the RICT on a particular SSCs performance which has had its Completion Time (CT) extended by the RICT Program. In other words, this program is used to ensure that the use of the RICT program, for a specified SSC, does not degrade the performance of that SSC over time. The SSCs in the scope of the RICT program are also in the scope of the Maintenance Rule. Additionally, it does not alter the system or train Operability requirements with respect to the number of systems and trains required to be Operable nor does it change the stated TS performance criteria (e.g. flow rate, response times, stroke times, setpoints, etc.).

These procedures are under the oversight of the Engineering Systems Department (Maintenance Rule Implementation) and Work Management (On-Line Configuration Risk Management Program). The RIE site engineer has the primary responsibility for the execution of performance monitoring program for the Risk Informed Completion Time Program. The ownership of these procedures is subject to change as deemed appropriate.

Monitoring the actual performance of a component under the Maintenance Rule is done on a monthly basis. Consequently, if it is determined that the RICT was the cause, or a contributing factor, in exceeding Maintenance Rule performance criteria, corrective actions are initiated.

Although others are possible, these actions may include a moratorium on future entries into pre-planned RICTs for a period of time, or restricting the use of a RICT for specific configurations or components. Whatever the corrective actions, they are communicated to the site RIE Engineer for his or her evaluation.

4.0 References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"

Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322

2. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis, US Nuclear Regulatory Commission, Revision 2, May 2011.

3. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, US Nuclear Regulatory Commission, Revision 1, May 2011.

DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-2 Introduction This enclosure describes the process for identification of Risk Management Actions (RMAs) applicable during extended Completion Times and provides examples of RMAs. RMAs for the Farley Nuclear Plant (FNP) Risk Informed Completion Time (RICT) Program are governed by an SNC fleet wide procedure. This procedure contains guidance for the determination and implementation of RMAs when entering the RICT Program and is consistent with the guidance provided in Topical Report NEI 06-09, Revision 0-A (Reference 1).

Responsibilities The Outage and Scheduling group is responsible for developing the RMAs with support from the Risk Informed Engineering (RIE) site engineer and the Operations department on an as-needed basis. The Operations department is responsible for the implementation of RMAs. For example, if it is anticipated that a planned activity will exceed its Risk Management Action Time (RMAT), the Outage and Scheduling department will propose and develop RMAs. However, the Operations department will ultimately approve or disapprove such actions and, if approved, implement them. The same is the case for emergent activities (although in those cases it may be necessary for the Operations department to develop and implement the RMAs).

Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the RMAT will be exceeded. The RMAs are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. RMAs may also be required to address the potential for a common cause failure. Additionally, if an emergent event occurs, requiring re-calculation of a RMAT already in place, the procedure requires a re-evaluation of the existing RMAs for the new plant configuration to determine if new RMAs are appropriate.

RMAs are put in place no later than the point at which an incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. Furthermore, if (as the result of an emergent event) the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1E-3 or 1E-4 events per year, respectively, RMAs are required to be implemented. These requirements are consistent with the guidelines provided in NEI 06-09 (Reference 1). Also for emergent activities, if a high degree of confidence cannot be established that a common cause failure has not occurred, RMAs shall be implemented prior to the front stop being reached, specifically to address the common cause possibility. RMAs to address the potential for common cause are not required if the RICT is numerically adjusted to account for the possibility of the common cause failure.

The RIE site engineer, or other designated risk analyst, will provide support on an as-needed basis for determining which RMAs are appropriate for minimizing the impact of changes in core damage risk. By determining which SSCs are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be identified and implemented to protect these SSCs. Additionally, the CRMP-generated Remain in Service list is an important information source for determining these important SSCs. The Remain in Service list provides a list of in-service SSCs that have a high impact on risk for a particular plant configuration. This listing is obtained on-demand by the CRMP user.

DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-3 It is also possible to credit RMAs to affect the RICT Program calculations. However, such quantification of RMAs is not required. As stated in the procedure, omission of such a computation will result in conservative RICT Program values. However, if RMAs are to be credited, the procedure provides guidance on determining the risk impact of the RMA on RICT calculations. These include, but are not limited to, determination of RMA risk impacts on new temporary equipment functions and new or modified human actions. In addition, actions credited are required to be proceduralized and the implementing staff must be trained.

Types of Risk Management Actions Topical Report NEI 06-09 (Reference 1) classifies RMAs into three categories. These three categories are each addressed in the SNC RMA fleet-wide procedure. They are described below:

1) Actions to increase awareness and control.

A good example of this is a shift brief or a pre-job brief. Additionally, training (formal or informal) can serve to increase awareness.

To increase control, the procedure suggests having the system engineer, or other system expert, present for the duration of the activity or certain portions of the activity. Also, a special purpose procedure may be written and used which includes the identification of the associated risk and also includes contingency plans in case of unexpected occurrences, including approaching the end of a RICT.

2) Actions to reduce the duration of maintenance activities.

This may be accomplished by pre-staging materials, conducting training on mock-ups, performing the activity around the clock, and performing walk downs on the actual system(s) to be worked on prior to beginning work.

3) Actions to minimize the magnitude of the risk increase.

The previously mentioned CRMP generated Remain in Service list is used to assist in determining these actions. For example, work may be stopped or minimized on safety systems redundant to the system or component being removed from service, or maintenance minimized on other systems that adversely affect the CDF or LERF.

Minimizing work on systems that may cause a trip or transient would also be a prudent action to take to minimize the likelihood of an initiating event that the out of service component is designed to mitigate.

Other measures that serve to minimize risk include actions like establishing temporary systems to supply power or ventilation and rescheduling or shortening other risk significant work, if possible.

4) Actions to minimize the risk of a common cause failure Many of these RMAs are similar to those presented above. This could include precluding activities that increase the likelihood of the type of event the inoperable component is intended to mitigate. Prohibiting switchyard work is an example of this type of RMA. Also, DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-4 systems redundant to the inoperable component could be protected, as well as redundant components within the same inoperable system.

Examples The RMA procedure provides examples of types of RMAs. Examples of RMAs that are considered during a RICT Program entry are provided in the items below:

A. Examples of RMAs that are considered during a diesel generator (DG) RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions; (2)

Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit; (3)

Deferral of maintenance that affects the reliability of the trains associated with the operable DGs; (4)

Deferral of planned maintenance activities on station blackout mitigating systems, and treating those systems as protected equipment; (5)

Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.

B. Examples of RMAs that are considered during a safety related battery RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the immediate discharge of the affected battery, if possible; (2)

Recharge the affected battery to float voltage conditions using a spare battery charger, if possible; (3)

Evaluate the remaining battery capacity and protect its ability to perform its safety function; and (4)

Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries.

C. Examples of RMAs that are considered during a two required offsite circuits RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance.

DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-5 (3)

Maintain availability of offsite power to defer any planned activities with the potential to generate a grid disturbance.

(4)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

(5)

Consider staging a portable generator per procedure NMP-OS-019-361, which would accelerate connection to a 4160 VAC bus in the event of a station blackout.

D. Examples of RMAs that are considered during a required offsite circuit and DG RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit.

(2)

Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance.

(3)

Maintain availability of offsite power to/from RAT A, maintain Operability of both DGs, and maintain Operability of 4160 V safety buses.

(4)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

(5)

Consider staging a portable generator per procedure NMP-OS-019-361, which would accelerate connection to a 4160 VAC bus in the event of a station blackout.

(6)

The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions.

(7)

Deferral of maintenance that affects the reliability of the trains associated with the operable DGs.

(8)

Deferral of planned maintenance activities on station blackout mitigating systems, and treating those systems as protected equipment.

(9)

Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.

E. Examples of RMAs that are considered during a loss of a DC train RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Establish 24/7 staffing and response teams to ensure prompt restoration of operability of the chargers DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-6 (3)

Work to establish alternate power to the 125 V DC bus by temporary modification or by implementation of FLEX procedures (4)

Maintain Operability and availability of redundant and diverse electrical systems.

(5)

Maintain/establish Operability/availability of important mitigating SSCs.

(6)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

F. Examples of RMAs that are considered during RICT for load sequencer A, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Notify the Power Control Center to defer any planned activities with the potential to generate a grid disturbance (3)

Establish 24/7 staffing and response teams to ensure prompt restoration to operability of sequencer A.

(4)

Perform a beginning of shift brief that focuses on actions operators will take in response to a loss of offsite power or safety injection. Include review of local emergency start of DG A per procedure 13145-1, manual tie to bus 1AA02 per procedure 13427-1, and manual bus loading.

(5)

Maintain Operability and availability of redundant and diverse electrical systems by performing the following actions:

a. Establish protection of the following SSCs against inadvertent operation or contact that may impede the SSC from fulfilling its design function: RAT A, RAT B, DG A, sequencer B, bus 1AA02, and bus 1BA03, and

b. Terminate any in-progress testing or maintenance activities with the potential to impact the aforementioned SSCs, and

c. Defer any scheduled testing or maintenance activities with the potential to impact the aforementioned SSCs.

(6)

Maintain/establish Operability/availability of additional important mitigating SSCs.

Identify risk-significant SSCs, either from a pre-plan or by real-time use of CRMP importance reports. Perform the following actions:

a. Terminate any in-progress testing or maintenance activities with the potential to impact the availability of important in-service SSCs, and

b. Defer any scheduled testing or maintenance activities with the potential to impact important in-service SSCs,

c. Promptly return to service any important out-of-service SSCs.

DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-7 G. Examples of RMAs that are considered during an AC subsystem RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Terminate any in-progress maintenance/testing activities and defer any scheduled maintenance/testing activities with the potential to cause loss of 4160 V AC bus.

Also, avoid unnecessary switching (e.g., breaker manipulations on B train AC and DC electrical systems).

(2)

Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable AC bus.

(3)

If power cannot be readily restored through the inoperable AC bus, work to establish temporary modifications providing power to important loads fed from the inoperable bus.

(4)

Maintain operability and availability of inoperable subsystems remaining electrical SSCs, as well as the other subsystems electrical SSCs.

H. Examples of RMAs that are considered during an AC vital subsystem RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Maintain operability and availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.

(3)

Maintain/establish Operability/availability of important mitigating SSCs.

(4)

Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable SSC.

(5)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

I. Examples of RMAs that are considered during an DC subsystem RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Maintain operability and availability of redundant and diverse electrical systems.

(3)

Maintain/establish Operability/availability of important mitigating SSCs.

(4)

Work to establish alternate power to the 125 V DC bus by temporary modification or by implementation of FLEX procedures.

(5)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

DRAFT 0 to NL-18-0039 Risk Management Action Examples E10-8 J. Examples of RMAs that are considered during an inverter RICT, so that the increased risk is reduced and to ensure adequate defense in depth, are:

(1)

Limit the potential for a loss of offsite power by terminating all activities in the low voltage and high voltage switchyard.

(2)

Maintain operability and availability of DC electrical systems in the subsystem within the same train and the redundant subsystem in the other train (e.g. if the inverter in subsystem A is inoperable, maintain operability in the subsystems B and C),

associated 480 V bus, and associated regulating transformer.

(3)

Maintain/establish Operability/availability of important mitigating SSCs.

(4)

Establish 24/7 staffing and response teams to ensure prompt restoration of operability of inoperable inverter.

(5)

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

References

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A, October 2012 (ADAMS Accession No. ML12286A322).

DRAFT

ML18065A025

Text

1.0 INTRODUCTION

6.0 REFERENCES

1.0 INTRODUCTION

4.0 REFERENCES

1.0 INTRODUCTION

4.0 REFERENCES

Navigation menu

Search