ML18099A130

Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors

ML18099A130
Person / Time
Site:	Robinson
Issue date:	04/05/2018
From:	Kapopoulos E Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RNP-RA/18- 0013
Download: ML18099A130 (53)

Text

(., DUKE ENERGYQD Serial: RNP-RA/18- 0013 APR O 5.. 2018 Attn: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 H. 8. Robinson Steam Electric Plant, Unit 2 Ernest J. Kapopoulos, Jr.

H.B. Robinson Steam Electric Plant Unit 2 Site Vice President Duke Energy 3581 West Entrance Road Hartsville, SC 29550 0: 843 9511701 F: 843 9511319 Ernie. Kapopou/os@duke-energy.com 10 CFR 50.90 10 CFR 50.69 Docket No. 50-261/Renewed Facility Operating License No. DPR-23

Subject:

Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors" In accordance with the provisions of 1 O CFR 50.69 and 10 CFR 50.90, Duke Energy Progress, LLC (Duke Energy) is requesting an amendment to the license of H. 8. Robinson Steam Electric Plant, Unit 2 (HBRSEP2).

The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors." The provisions of 1 O CFR 50.69 allow adjustment of the scope of equipment subject To special treatment controls (e.g.;"quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The enclosure to this letter provides the basis for the proposed change to the HBRSEP2 Operating License. The categorization process being implemented through this change is consistent with NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, July 2005, which was endorsed by the NRG in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance", Revision 1, May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met.

U.S. Nuclear Regulatory Commission RNP-RA/18-0013 Page 2 The NRG has previously reviewed the technical adequacy of the HBRSEP2 Probabilistic Risk Assessment (PRA) models identified in this application, with routine maintenance updates applied, for:

Letter from NRG to HBRSEP2, Issuance of Amendment to Technical Specification 5.5.16 for the Adoption of Option B of 10 CFR 50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak rate testing Frequency", November 19, 2015, (ADAMS Accession No. ML15323A085)

Letter from NRG to HBRSEP2, " Issuance of Amendment Regarding National Fire Protection Association Standard 805, February 3, 2017, (ADAMS Accession No. ML16337A264)

Duke Energy requests that the NRG utilize the review of the PRA technical adequacy for those applications when performing the review for this application.

Duke Energy requests approval of the proposed license amendment by one year from completion of the acceptance review, with the amendment being implemented within 60 days.

In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated South Carolina Official.

This letter contains no regulatory commitments.

Please refer any questions regarding this submittal to Art Zaremba at (980) 373-2062.

I declare under penalty of perjury that the foregoing is true and correct. Executed on y/ ) /701 ~

SincerelW

~

l-Ernest J. Kapopoulos, Jr.

Site Vice President

Enclosure:

1. Evaluation of the Proposed Change

U.S. Nuclear Regulatory Commission RNP-RA/18-0013 Page 3 cc (with enclosure):

C. Haney, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 D. J. Gavin, Project Manager (HBRSEP) (Electronic Copy only)

U. S. Nuclear Regulatory Commission One White Flint North, Mail Stop 8 G9A 11555 Rockville Pike Rockville, MD 20852-2738 J. Rotton NRC Senior Resident Inspector HBRSEP2 Steam Electric Plant, Unit 2 S.E. Jenkins, Manager, Radioactive & Infectious Waste Management Division of Waste Management South Carolina Department of Health and Environmental Control 2600 Bull Street Columbia, SC 29201 jenkinse@dhec.sc.gov A. Gantt, Chief Bureau of Radiological Health (SC) 2600 Bull Street Columbia, SC 29201 ganttaa@dhec.sc.gov

ENCLOSURE RNP-RA/ 18-0013 i

Evaluation of the Proposed Change TABLE OF CONTENTS 1

SUMMARY

DESCRIPTION.................................................................................................. 1 2

DETAILED DESCRIPTION.................................................................................................. 1 2.1 CURRENT REGULATORY REQUIREMENTS............................................................ 1 2.2 REASON FOR PROPOSED CHANGE........................................................................ 2

2.3 DESCRIPTION

OF THE PROPOSED CHANGE......................................................... 3 3

TECHNICAL EVALUATION................................................................................................. 3 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))................... 4 3.1.1 Overall Categorization Process.................................................................. 4 3.1.2 Passive Categorization Process................................................................. 8 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))............................ 9 3.2.1 Internal Events and Internal Flooding........................................................ 9 3.2.2 Fire Hazards.................................................................................................. 9 3.2.3 Seismic Hazards........................................................................................... 9 3.2.4 Other External Hazards.............................................................................. 10 3.2.5 Low Power & Shutdown............................................................................ 10 3.2.6 PRA Maintenance and Updates................................................................ 11 3.2.7 PRA Uncertainty Evaluations.................................................................... 11 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))................................ 12 3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))....................................................... 12 4

REGULATORY EVALUATION.......................................................................................... 13 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA.................................. 13 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS................................. 13

4.3 CONCLUSION

S......................................................................................................... 15 5

ENVIRONMENTAL CONSIDERATION............................................................................. 15 6

REFERENCES................................................................................................................... 16

ENCLOSURE RNP-RA/18-0013 ii LIST OF ATTACHMENTS

List of Categorization Prerequisites.............................................................. 18 : Description of PRA Models Used in Categorization..................................... 19 : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items............................................................................................ 20 : External Hazards Screening........................................................................... 40 : Progressive Screening Approach for Addressing External Hazards.......... 43 : Disposition of Key Assumptions/Sources of Uncertainty........................... 45

ENCLOSURE RNP-RA/18-0013 1

1

SUMMARY

DESCRIPTION The proposed amendment modifies the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The NRC has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. The Structures, Systems and Components (SSCs) necessary to defend against the DBEs are defined as "safety-related," and these SSCs are the subject of many regulatory requirements, herein referred to as special treatments, designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations.

The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the general design criteria of Appendix A to 10 CFR Part 50, is not explicitly defined.

ENCLOSURE RNP-RA/18-0013 2

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow Duke Energy to improve focus on equipment that has safety significance resulting in improved plant safety.

ENCLOSURE RNP-RA/18-0013 3

2.3 DESCRIPTION

OF THE PROPOSED CHANGE Duke Energy proposes the addition of the following condition to the renewed operating license of HBRSEP2 to document the NRC's approval of the use 10 CFR 50.69.

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 SSCs specified in the license amendment request dated March 22, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under 10 CFR 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet 10 CFR 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements are addressed in the following sections.

The NRC has previously reviewed the technical adequacy of the HBRSEP2 Probabilistic Risk Assessment (PRA) models identified in this application, with routine maintenance updates applied, for:

License Amendment regarding 10CFR50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak Rate Testing Frequency (Reference 10)

ENCLOSURE RNP-RA/18-0013 4

License Amendment Request to Adopt NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (Reference 9)

Duke Energy requests that the NRC utilize the review of the PRA technical adequacy for those applications when performing the review for this application.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

3.1.1 Overall Categorization Process Duke Energy will implement the risk categorization process in accordance with NEI 00-04, Revision 0 (Reference 1), as endorsed by Regulatory Guide (RG) 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1 (Reference 2). NEI 00-04 Section 1.5 states Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant. A separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

The process to categorize each system will be consistent with the guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by RG 1.201. RG 1.201 states that the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv).

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible and as long as they are all completed they may even be performed in parallel. Note that NEI 00-04 only requires the seven qualitative criteria in Section 9.2 of NEI 00-04 (Item 3 in the list below) to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires the defense-in-depth assessment (Item 4 in the list below) to be completed for safety related active components/functions categorized as LSS by all other elements.

1.

PRA-based evaluations (e.g., the internal events, internal flooding, and fire PRAs)

2.

non-PRA approaches (e.g., seismic safe shutdown equipment list (SSEL), other external events screening, and shutdown assessment)

3.

Seven qualitative criteria in Section 9.2 of NEI 00-04

4.

the defense-in-depth assessment

5.

the passive categorization methodology Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., High Safety Significant (HSS) or Low Safety Significant (LSS))

that is presented to the Integrated Decision-Making Panel (IDP). Note: the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 1 below. The safety significance determination of each element, identified above, is independent of each other and therefore the sequence of the elements does not impact the resulting preliminary categorization of each

ENCLOSURE RNP-RA/18-0013 5

component or function. Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Table 3-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in the Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

Table 3-1: IDP Changes from Preliminary HSS to LSS Element Categorization Step -

NEI 00-04 Section Evaluation Level IDP Change HSS to LSS Drives Associated Functions Risk (PRA Modeled)

Internal Events Base Case - Section 5.1 Component Not Allowed Yes Fire, Seismic and Other External Events Base Case Allowable No PRA Sensitivity Studies Allowable No Integral PRA Assessment -

Section 5.6 Not Allowed Yes Risk (Non-modeled)

Fire, Seismic and Other External Hazards -

Component Not Allowed No Shutdown - Section 5.5 Function/Component Not Allowed No Defense-in-Depth Core Damage -

Section 6.1 Function/Component Not Allowed Yes Containment -

Section 6.2 Component Not Allowed Yes Qualitative Criteria Considerations -

Section 9.2 Function Allowable N/A Passive Passive - Section 4 Segment/Component Not Allowed No

ENCLOSURE RNP-RA/18-0013 6

The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal events PRA or Integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS; and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with a HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g. Passive, Non-PRA-modeled hazards - see Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped.

Therefore, if a HSS component is mapped to a LSS function, that component will remain HSS.

If an LSS component is mapped to an HSS function, that component may be driven HSS based on Table 1 above, or may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

The Integrated Decision Making Panel (IDP) will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for DBEs; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to 10 CFR 50.69(f)(1) will be documented in Duke Energy procedures.

Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. If a resolution cannot be achieved concerning the safety significance of an SSC, then the SSC will be classified as safety-significant.

Passive characterization will be performed using the processes described in Section 3.1.2.

Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen as it is representative of the typical error factor of basic events used in the PRA model.

NEI 00-04 Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based

ENCLOSURE RNP-RA/18-0013 7

assessment in Section 5 or the defense in depth assessment in Section 6, but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5. This position was accepted by the NRC staff in the Vogtle Safety Evaluation (SE) (Reference 17) which states if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-

04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.

Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The Integrated Decision-making Panel (IDP) must intervene to assign any of these HSS Function components to low safety significance (LSS).

With regard to the criteria that considers whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, Duke Energy will not take credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator Training.

The risk analysis to be implemented for each hazard is described below:

Internal Event Risks: Internal events PRA model version MOR 15, June 2015. The NRC has previously reviewed the technical adequacy of previous versions of the HBRSEP2 PRA model identified in this application for the following applications:

Adoption of Option B of 10 CFR 50, Appendix J for Type B and Type C Testing and the Permanent Change in 10 CFR 50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak Rate Testing Frequency (Reference 10),

License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (Reference 9).

Internal Flood PRA model version 12Fh_s1, January 2017. The NRC has previously reviewed the technical adequacy of previous versions of the HBRSEP2 PRA model identified in this application for the following applications:

Adoption of Option B of 10 CFR 50, Appendix J for Type B and Type C Testing and the Permanent Change in 10 CFR 50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak Rate Testing Frequency (Reference 10),

License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (Reference 9).

Fire Risks: Fire PRA model version RNP_12Fh, July 2017. The NRC has previously reviewed the technical adequacy of previous versions of the HBRSEP2 PRA model identified in this application for the following applications:

License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (Reference 9).

ENCLOSURE RNP-RA/18-0013 8

Seismic Risks: Seismic Safe Shutdown Equipment List (SSEL) from the Individual Plant Evaluation External Events (IPEEE) seismic analysis accepted by NRC Safety Evaluation Report (SER) dated September 28, 2000, ML003755856 (Reference 11).

Other External Risks (e.g., tornados, external floods, etc.): Using the IPEEE screening process as approved by NRC SER dated September 28, 2000, ML003755856 (Reference

11) the other external hazards were determined to be insignificant contributors to plant risk.

Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, Guidance for Industry Actions to Assess Shutdown Management (Reference 3), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above (e.g.,

change from a seismic margins approach to a seismic probabilistic risk assessment approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs

9. Results of period reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the SE issued by the Office of Nuclear Reactor Regulation (Reference 4).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., defense in depth, safety margins) in determining safety significance.

Component supports are assigned the same safety significance as the highest passively ranked segment within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final SE for Vogtle dated December 17, 2014 (Reference 12). The RI-RRA method

ENCLOSURE RNP-RA/18-0013 9

as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. The passive categorization process is intended to apply the same risk-informed process accepted in the ANO2-R&R-004 for the passive categorization of Class 2, 3, and non-class components.

Consistent with ANO2-R&R-004, Class 1 pressure retaining SSCs in the scope of the system being categorized will be assigned HSS and cannot be changed by the IDP. Therefore, the RI-RRA methodology for passive categorization is acceptable and appropriate for use at HBRSEP2 for 10 CFR 50.69.

3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in the following applications, with routine maintenance updates applied:

License Amendment regarding 10 CFR 50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak Rate Testing Frequency (Reference 10)

License Amendment Request to Adopt NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (Reference 9) 3.2.1 Internal Events and Internal Flooding The HBRSEP2 categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for the HBRSEP2 unit. at the end of this enclosure identifies the applicable internal events and internal flooding PRA models.

3.2.2 Fire Hazards The HBRSEP2 categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes methods previously accepted by the NRC. The Duke Energy risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for HBRSEP2. Attachment 2 at the end of this enclosure identifies the applicable Fire PRA model.

3.2.3 Seismic Hazards The HBRSEP2 categorization process will use the seismic margins analysis (SMA) performed for the IPEEE in response to GL 88-20, Supplement 4 (Reference 5) for evaluation of safety significance related to seismic hazards. No plant specific approaches were utilized in

ENCLOSURE RNP-RA/18-0013 10 development of the SMA. The NEI 00-04 approved use of the SMA SSEL as a screening process identifies all system functions and associated SSCs that are involved in the seismic margin success path as HSS. Since the analysis is being used as a screening tool, importance measures are not used to determine safety significance. The NEI 00-04 approach using the SSEL would identify credited equipment as HSS regardless of their capacity, frequency of challenge or level of functional diversity.

An evaluation was performed of the as-built, as-operated plant against the SMA SSEL. The evaluation was a comparison of the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences were reviewed to identify any potential impacts to the equipment credited on the SSEL. Appropriate changes to the credited equipment were identified and documented. This documentation is available for audit. The Duke Energy risk management program ensures that future changes to the plant will be evaluated to determine their impact on the SMA and risk categorization process.

3.2.4 Other External Hazards The HBRSEP2 categorization process will use screening results from the IPEEE in response to Generic Letter (GL) 88-20 (Reference 5) for evaluation of safety significance related to the following external hazards:

Extreme Wind or Tornado Figure 5-6 in Section 5.4 of NEI 00-04 illustrates the process that will be used to determine safety significance related to the above hazards.

All other external hazards were screened from applicability to HBRSEP2 per a plant-specific evaluation in accordance with GL 88-20 (Reference 5) and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Attachment 4 provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards.

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS.

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

3.2.5 Low Power & Shutdown Consistent with NEI 00-04, the HBRSEP2 categorization process will use the shutdown safety management plan described in NUMARC 91-06, for evaluation of safety significance related to low power and shutdown conditions. The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function. The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs.

ENCLOSURE RNP-RA/18-0013 11 SSCs that meet the two criteria (i.e., considered part of a primary shutdown safety system or a failure would initiate an event during shutdown conditions) described in Section 5.5 NEI 00-04 will be considered preliminary HSS.

3.2.6 PRA Maintenance and Updates The Duke Energy risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for HBRSEP2. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files.

The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, Duke Energy will implement a process that addresses the requirements in NEI 00-04, Section 11, Program Documentation and Change Control. The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization.

3.2.7 PRA Uncertainty Evaluations Uncertainty evaluations associated with any applicable baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in Section 8 and in the prescribed sensitivity studies discussed in Section 5 of NEI 00-04.

In the overall risk sensitivity studies Duke Energy will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle in Reference 12. Consistent with the NEI 00-04 guidance, Duke Energy will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

ENCLOSURE RNP-RA/18-0013 12 The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737 (Reference 8). The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the HBRSEP2 PRA model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application.

Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

Key HBRSEP2 PRA model specific assumptions and sources of uncertainty for this application are identified and dispositioned in Attachment 6. The conclusion of this review is that no additional sensitivity analyses are required to address HBRSEP2 PRA model specific assumptions or sources of uncertainty.

3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

The PRA models described in Section 3.2 has been assessed against RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 6) consistent with NRC RIS 2007-06.

The HBRSEP2 internal events PRA model was subject to a self-assessment and a full-scope peer review conducted in May 2010. This peer review covered all applicable SRs except internal flooding, which was assessed at a later date.

The HBRSEP2 internal flood PRA model was subject to a self-assessment and full-scope peer review conducted in August 2015.

The HBRSEP2 Fire PRA model was subject to a self-assessment and full-scope peer review conducted in May 2013, and a focused scope peer review in August 2013, and a focused scope peer review in February 2018.

Closed findings were reviewed and closed in August 2017 for HBRSEP2 Internal Events, internal Flood, and Fire models using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os) (Reference 13) as accepted by NRC in the letter dated May 3, 2017 (ML17079A427) (Reference 14). The results of this review have been documented and are available for NRC audit.

provides a summary of open findings and disposition of the HBRSEP2 peer reviews. The attachments identified above demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The HBRSEP2 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04.

The overall risk evaluation process described in the NEI guidance addresses both known

ENCLOSURE RNP-RA/18-0013 13 degradation mechanisms and common cause interactions, and meets the requirements of 10 CFR 50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF). The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, and human errors). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

4 REGULATORY EVALUATION 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

The regulations in Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

NRC RG 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006.

RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, April 2015.

RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Duke Energy proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Duke Energy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

ENCLOSURE RNP-RA/18-0013 14

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC.

Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin.

The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results.

ENCLOSURE RNP-RA/18-0013 15 Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Duke Energy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5 ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

ENCLOSURE RNP-RA/18-0013 16 6 REFERENCES

1.

NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005.

2.

NRC Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, Revision 1, May 2006.

3.

NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, December, 1991.

4.

USNRC Letter to Entergy Operations, Inc., "ANO SER Arkansas Nuclear One, Unit 2 -

Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, April 22, 2009, (ADAMS Accession No. ML090930246).

5.

NRC Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, June 1991.

6.

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

7.

NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

8.

EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

9.

USNRC Letter to HBRSEP2 "Issuance of Amendment Regarding National Fire Protection Association Standard 805," February 3, 2017, (ADAMS Accession No. ML16337A264)

10. HBRSEP2 Letter to NRC, " Proposed Amendment to Technical Specification 5.5.16 for the Adoption of Option B of 10 CFR 50, Appendix J for Type B and Type C Testing and the Permanent Change in 10 CFR 50, Appendix J, Integrated Leak Rate Test Interval and Type C Leak Rate Testing Frequency," November 19, 2015, (ADAMS Accession No. ML15323A085)

11. USNRC Letter to HBRSEP2 - Completion of Licensing Action for Generic Letter (GL) 88-20

-- Individual Plant Examination of External Events (IPEE) for Severe Accident Vulnerabilities, September 28, 2000, ( ADAMS Accession No. ML003755856)

12. USNRC Letter to Southern Nuclear Operating Company, Inc., "Vogtle Electric Generating Plant, Units 1 and 2 -Issuance of Amendments Re: Use of 10 CFR 50.69," December 17, 2014, (ADAMS Accession No. ML14237A034)

13. NEI Letter to USNRC, Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out

ENCLOSURE RNP-RA/18-0013 17 of Facts and Observations (F&Os), February 21, 2017, (ADAMS Accession No. ML17086A431).

14. NRC Letter to NEI, U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os), May 3, 2017, (ADAMS Accession Number ML17079A427).

ENCLOSURE RNP-RA/18-0013 18 Duke Energy will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision Making Panel (IDP) member qualification requirements Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary High Safety Significant (HSS) or Low Safety Significant (LSS) based on the seven criteria in Section 9 of NEI 00-04 (see Section 3.2). Any component supporting an HSS function is categorized as preliminary HSS.

Components supporting, an LSS function are categorized as preliminary LSS.

Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.

Assessment of defense in depth and safety margin. Components that are categorized* as preliminary LSS are evaluated for their role in providing defense-in-depth and safety margin and, if appropriate, upgraded to HSS.

Review by the Integrated Decision-making Panel. The categorization results are presented to the lDP for review and approval. The lDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of RG 1.174.

Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.

Documentation requirements per Section 3.1.1.

List of Categorization Prerequisites

ENCLOSURE RNP-RA/18-0013 19 Units Model Baseline CDF Baseline LERF Comments 1

Internal Events and MOR15 3.42E-6 5.76E-7 This model represents the current FPIE PRA Model of Record (MOR).

1 Internal Flood 12Fh_s1 1.69E-6 3.15E-7 This model represents the current IF PRA Model of Record (MOR).

1 Fire PRA RNP_12Fh 4.60E-05 5.39E-06 This model represents the current Fire PRA Model of Record (MOR).

Description of PRA Models Used in Categorization

ENCLOSURE RNP-RA/18-0013 20 Finding Number Supporting Requirement(s)

Capability Category (CC)

Description Disposition for 50.69 AS-A5-3 Internal Events AS-A5 AS-B3 I/II/III HBRSEP2-F/PSA-0043, Section 4.8, Consequential Pressure-induced SGTR not considered. "Consequential tube ruptures due to high primary-to-secondary differential pressures (e.g.,

due to secondary line breaks or ATWS events) are not explicitly considered in the model. Secondary line breaks can result in a primary-to-secondary differential pressure equivalent to RCS pressure."

An Induced SGTR model, based on the guidance in NUREG-1570, Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture, USNRC, March 1998, has been developed and is included in the PRA. Therefore, the impact of Induced SGTR is already considered for the 10 CFR 50.69 application. : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items

ENCLOSURE, Continued RNP-RA/18-0013 21 DA-E2-1 Internal Events DA-E2 I/II/III The PRA documentation does not show the probabilities or basis for the probabilities for the following basic events (note that the basic events are assigned probabilities in the fault tree): #ACRDMF (control rod fails due to mechanical binding),

1. CRDMF (insufficient rod insertion),

1. RPS (failure of reactor trip),

EAMSAC (AMSAC failure), ESFAS (ESFAS fails), CCVENT (performing CV purge), and GINRDOORSL (personnel hatch door gasket). No evidence was found that these basic event values are not appropriate.

Development and discussion of the occurrences represented by the basic events cited in the F&O may be found in the Westinghouse Owners Group document WOG Risk-Informed ATWS Assessment and Licensing Implementation Process (WCAP-15831-P) which is cited in the HBRSEP2 Success Criteria calculation (RNP-F/PSA-0075). Two of the events cited in this F&O are included as part of the Level 2 analysis (RNP-F/PSA-0046, RNP-F/PSA-0047).

This is a documentation issue only and is not a technical issue.

Therefore, it has no impact on the 10 CFR 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 22 LE-E1-1 Internal Events LE-E1 I/II/III The system level data are documented in the Level 1 analysis and some Level 2-specific parameters are documented in Attachment 2 of RNP-F/PSA-0047.

The basis for some of the values was subjective (e.g., see Table 8-10) and others are based primarily on the IPE submittal and supporting MAAP runs for the Level 2 analysis (e.g., Table 8-35). Although it is understood that the approach for estimating probabilities for some Level 2 parameters is soft, using IPE results without additional justification may not be as realistic as required for a CC II classification.

The latest revision of RNP-F/PSA-0047 (Revision 2) uses Section 8.3 to discuss at length the analysis used to produce the Level 2 values that are summarized in Table 8-36.

Literature references, MAAP runs, human reliability analysis, and the use of engineering judgement were applied to build the Level 2 values.

This finding determined that the SR LE-E1 is met, but is left open asking to improve the documentation of sources and traceability, as well as add to the summary table a column briefly stating the values source or method of determination. However, with the calculation discussing how each value has been realistically determined and documented in Section 8.3, the resulting Plant Damage States are credible and accurately support the PRA models results. Therefore, this documentation concern has no effect on the 10 CFR 50.69 application

ENCLOSURE, Continued RNP-RA/18-0013 23 LE-D5-1 Internal Events LE-D5 Not Met Based on a review of a number of calculation files, SGTR event tree, and fault tree for #RW, it appears that a realistic secondary side isolation capability analysis is performed.

However, there are a number of important issues that their resolutions may impact this conclusion. These issues include a) A justification for the assumed number of cycles for the PORVs on the faulted SG (which is 10) is not provided. Also, it seems that only 'fail to close' of one SRV is considered in the fault tree.

b) Additionally, it appears that Operator action to isolate the faulted SG is not included as a potential contributor to the secondary side isolation failure probability. Given that in the current model

1) fail to isolate probability is dominated by the probability of a PORV sticking open, and

1) In response to this F&O, the assumed number of SG PORV/SRV cycles on the ruptured S/G was increased from 10 to 40.

This value is considered reasonable and is within the range of cycles described in section 2.3.3 of NUREG-1570. As such, this portion of the F&O is considered addressed and has no impact the 10 CFR 50.69 application.

A sensitivity study has been performed to assess the impact of adding a Human Failure Event (HFE) to the model for isolating the ruptured SG. The HFE was developed and dependency between it and the other HFEs in the model has been assessed. The sensitivity study revealed a reduction in the system importances (Fussell-Vesely (F-V) and Risk Achievement Worth (RAW)) for the modeled systems of 1% to 4% for CDF. The majority of the systems saw a less than 0.5%

reduction in importance for LERF.

The exceptions to this being the Engineered Safeguards Actuation

ENCLOSURE, Continued RNP-RA/18-0013 24 LE-D5-1, Continued

2) the SGTR IE is one of the highest contributors to the LERF figure of merit, it is important to ensure that the above apparent issues are fully resolved.

System, which saw a slight increase in importance (4% for F-V and 1% for RAW), and the Containment Isolation system, which saw a slight increase in importance (3% for both F-V and RAW). Since the addition of the HFE has a minimal impact on the PRA model results, the impact on the 10 CFR 50.69 application

ENCLOSURE, Continued RNP-RA/18-0013 25 LE-C4-1 Internal Events LE-C4 I

The accident sequences are based on generic references and on plant specific MAAP analysis. Important mitigation actions in significant accident progression sequences, such as SG isolation for SGTR are not modeled.

Evidence of technical justification for demonstrating the feasibility of mitigating actions was not provided.

Scrubbing is discussed for release categories in RNP2-F/PSA-0048 and brief rationale is provided when it is credited. Inclusion of beneficial failures was not observed.

A sensitivity study has been performed to assess the impact of adding a Human Failure Event (HFE) to the model for isolating the ruptured SG. The HFE was developed and dependency between it and the other HFEs in the model has been assessed. The sensitivity study revealed a reduction in the system importances (Fussell-Vesely (F-V) and Risk Achievement Worth (RAW)) for the modeled systems of 1% to 4% for CDF. The majority of the systems saw a less than 0.5%

reduction in importance for LERF.

The exceptions to this being the Engineered Safeguards Actuation System (ESFAS), which saw a slight increase in importance (4%

for F-V and 1% for RAW), and the Containment Isolation system, which saw a slight increase in importance (3% for both F-V and RAW). Since the addition of the HFE has a minimal impact on the PRA model results, the impact on the 10 CFR 50.69 application is minimal as well, and the differences are considered to be acceptable.

ENCLOSURE, Continued RNP-RA/18-0013 26 LE-C4-1, Continued Level 2 operator actions were assessed in more detail using industry-standard methodologies via the EPRI HRA calculator, including assessment of feasibility due to post-accident environmental conditions. The SI System Engineer and the HBRSEP2 MOV Program engineer were consulted to determine the maximum differential pressure against which the RWST Outlet MOVs (SI-864A and B) could be manually closed during an ISLOCA event and it was determined that their closure is feasible. Based on the more detailed assessment of these Level 2 HFEs, this portion of the F&O has been addressed in the PRA and does not impact the 10 CFR 50.69 Application.

ENCLOSURE, Continued RNP-RA/18-0013 27 QU-D4-1 Internal Events QU-D4 II/III RNP-F/PSA-0077 Section 3.4, Similar Plant Review, Table 7 shows a comparison of Robinson CDF and LERF values to Turkey Point and Beaver Valley. Plant systems differences are compared. However, the comparison is inadequate and sources of specific differences (e.g.,

LOCA contribution) are not identified.

With Capability Category II - III for QU-D4 not met, the results from the Model of Record are still valid and have been compared to two similar plants with their final results being within an order of magnitude of each other. Robinson PRA also contains documentation that compares the plants in terms of system and plant capability differences. As recommended by the finding, Beaver Valleys CDF contributions were compared to that of Robinsons. LOCA, SGTR, and Loss of Service Water contributions to CDF are nearly the same between the two plants, noting that the overall CDF values are within 1E-6 of each other.

Steam Generator Tube Rupture, Internal Flood, and Loss of Offsite Power contributions to LERF have similar ratios for both plants. Other contributions, such as a reactor trip and loss of feedwater, were more different between the two plants, but not enough to warrant any concern of the validity of Robinsons model. Therefore, this documentation concern of comparing models has no effect on the 10 CFR 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 28 IFEV-A7-1 Internal Flood IFEV-A7 I/II Human-induced flood events are considered as potential flood sources but all such events are screened with potentially non-conservative screening.

The following issues were identified:

(a) Of the 160 generic human-induced event identified as significant operational events involving inadvertent or accidental release of significant quantities of process medium outside the plant containment structure can be defined for the industry, only 50 were included as related to human errors in maintenance resulting in flooding. It is not clear that the other 110 events were properly screened out (e.g., is spurious fire suppression operation considered maintenance?).

(b) The events were identified only by originating system, with no identification of size, duration, cause, etc. that would allow these events to be used to represent specific flood scenarios; The sensitivity study performed was overly conservative and attempted to apply all industry human induced failure events on a per piping frequency. This led to a largely over conservative value.

Human induced flooding events are not risk significant for this application as on the whole human induced flooding events in the industry have largely been occurring less often. This evident by analyzing the industry data on maintenance-induced flooding events which spans a timeframe from 1971 to 2011. The vast majority of the events occurred in the 1970s and 1980s with significantly fewer events occurring in the 1990s and 2000s. This trend can be attributed to fewer infant mortality issues as the plants age and improved maintenance practices. Therefore, not including them specifically in the IFPRA model would not affect results in a manner that would impact the 10 CFR 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 29 IFEV-A7-1, Contd (c) The frequencies were apportioned by linear pipe length per flood area, but it is not clear that human induced flood frequency is proportional to pipe length.

Specifically, such floods in Fire Protection systems is likely to be inadvertent actuation of fire systems, which can only occur in areas with sprinkler systems.

(d) Human-induced flood frequencies are screened out if they are considered small contributors, i.e., less that the total system flood frequency based on random pipe break frequencies. Since this could double the frequencies, it is not clear that screening is appropriate.

Subsuming (adding the frequencies and modeling with bounding impacts) would be more appropriate.

ENCLOSURE, Continued RNP-RA/18-0013 30 IFEV-A7-1, Contd (e) For Human-induced floods with frequencies larger than the corresponding system's random pipe break frequency, all the floods were screened out qualitatively, with justification such as "at-power maintenance is not expected in this internal flood zone, and consequentially, human errors in maintenance resulting in flooding in this internal flood zone are not postulated".

However, these events apparently occurred in the generic database.

Unless Robinson can identify design or operational differences that make the generic data not applicable, the generic data should be use. At least for the most important human-induced flood events (highest frequencies, systems with the greatest risk impact), such events should be explicitly modeled with the corresponding flood mitigation action to isolate the flood (expected to be more reliable than for random pipe break events). (This F&O originated from SR IFEV-A7)

ENCLOSURE, Continued RNP-RA/18-0013 31 IFSN-A12-1 Internal Flood IFSN-A12 I/II/III Flood area screening is performed in Section 5.0. The qualitative screening process is described in Figure 11. The flood events are potentially modeled with an assumed reactor trip (manual or automatic) where this may be overly conservative. Also, it is not clear how the screening criteria define a flood event that would not require an immediate plant shutdown. This may be especially true for spray events where the flood can be managed without tripping the plant.

It is acknowledged that the HBRSEP2 documented process for internal flooding area screening is lacking in detail. Based on the description of the finding and the recommended resolution this is a documentation issue that may be addressed by calculation revision to better detail and clarify the process of screening. This supporting requirement was assessed as being MET. Although a better presentation for the screening process of internal flooding areas at HBRSEP2 would more clearly satisfy the requirements of IFSN-A12 there is negligible impact on the quantified values for CDF or LERF and therefore no impact on the 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 32 IFSN-A8-1 Internal Flood IFSN-A8 I

Use of EPRI door failure criteria of 1ft /

3ft may not be appropriate depending on the actual door attributes and flooding scenario.

Door failure height was evaluated and found to be acceptable for the current IFPRA. The current IFPRA assumes that the majority of the components would fail at or around 1 ft to 3 ft, which are the current door failure heights used. As this was the failure height used varying the minimum door failure height to something greater than 1 foot or 3 feet would not impact the IFPRA in a meaningful manner. Therefore this open F&O is not expected to impact the risk results.

The flood propagation and estimated door height failure effects of this open F&O are minimal on modeling results and therefore will have no impact on the quantified values with regard to the 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 33 IFSN-A8-2 Internal Flood IFSN-A8 I

Flood propagation via door gaps is assumed to be minimal and handled by the floor drain system. The potential for propagation via door gap flows should be addressed in the flooding scenarios.

Flow under door gaps was evaluated for applicable flood areas. Door gaps exist in a select number of flood areas but these flood areas are not risk significant with the exception of one flood area. This flood area is adjacent to other areas that are of limited floor area and the scenario fails equipment a low critical height.

Therefore flow underneath door gaps would be limited due to the limiting ability for the flood to develop any sort of significant hydrostatic head. Crediting flow underneath door gaps would increase the time that operators would be able to potentially isolate the scenario. Therefore as it is currently modeled, scenarios for this flood area are conservative but modeled in manner consistent with CC II IFPRA modeling. The timing effects of this open F&O is minimal on modeling results and therefore will have no impact on the quantified values with regard to the 50.69 application.

ENCLOSURE, Continued RNP-RA/18-0013 34 CS-C1-01 Fire CS-C1 Not Met There is no notebook encompassing Task 3 (Cable Selection) making review and update difficult. There are numerous change packages, and a database (FSSPMD) which is a repository for the cable routing information; however, there is not a single document which compiles the tasks performed, procedures followed or guidelines employed.

This is a documentation only issue.

Cable selection and circuit analysis data are developed and maintained by the Fire Protection/NSCA team at HBRSEP2. This data is then referenced as inputs to the Component Selection and Quantification FPRA calculations.

This process and associated results are easily reviewable, has been peer reviewed multiple times for our other sites and found to be acceptable. There is no requirement to have a separate PRA notebook. However, adding references to current documentation regarding circuit analysis performance (ex.

procedure) would provide the necessary documentation linkage between the process and the end results (FSSPMD).

There is no impact on the application.

ENCLOSURE, Continued RNP-RA/18-0013 35 FQ-F1-01 Fire FQ-F1 I/II/III The contents of the elements of applicable SRs of Part 2 were addressed in the FQ and associated documents; however, no explicit connections were established in the documents to associate with the "back-references" requirements LE-G2, LE-G4 and LE-G5 This is a documentation only issue.

The HBRSEP2 Fire PRA was developed using the Internal Events PRA as an input. Therefore, the back-references associated with requirements LE-G2, LEG4 and LE-G5 are considered to be met.

There is no impact on the application.

ENCLOSURE, Continued RNP-RA/18-0013 36 FSS-D7-01 Fire FSS-D7 Not Met There is a failure to meet the Category I requirement of having systems installed and maintained in accordance with applicable codes and standards.

The Main Turbine Lube Oil Deluge system must be replaced to account for system deficiencies identified in NCR-425437 where a simultaneous actuation of the Turbine Lube Oil suppression system, along with the mezzanine and ground level sprinkler systems, could place a higher system demand on the water supply than can be provided by a single fire pump. This was not identified, nor is a comparison provided in the Fire PRA of all installed detection and suppression systems vs.

the corresponding Code Compliance calculation. Review plant-specific information, and ensure that the use of generic data from NUREG/CR-6850 is reasonable for use in the HBRSEP2 Fire PRA.

Recent review of calculations and data support the following:

• As shown in the NFPA 805 code compliance evaluations, the credited suppression and detection systems are installed and maintained in accordance with applicable codes and standards.

• Based on preliminary NFPA monitoring and maintenance rule data unavailability and unreliability of significant suppression and detection systems are green, indicating no operational issues of concern or outlier behavior on those systems. This insight is further supported by a separate study of suppression and detection systems which show minimal failures for these systems over the past few years.

Therefore, there is no impact on this application.

ENCLOSURE, Continued RNP-RA/18-0013 37 FSS-D7-03 Fire FSS-D7 Not Met Evidence needs to be provided to support that credited detection/suppressions systems are installed and maintained in accordance with applicable codes and standards.

System health report for period Q2-2013 for systems 6185/6181/6175/6195/6205/6180 notes that age, obsolescence and replacement part procurement is an issue for multiple fire protection systems. This system health report also notes that "There are LTAMs budgeted for 2014 and 2015 which study and replace the detection, CO2, and Halon Systems." This report suggests that some of the fire protection systems at HBRSEP2 may be experiencing outlier behavior relative to system unavailability and may not be in a fully operable state during plant operation Recent review of calculations and data support the following:

• As shown in the NFPA 805 code compliance evaluations, the credited suppression and detection systems are installed and maintained in accordance with applicable codes and standards.

• Based on preliminary NFPA monitoring and maintenance rule data unavailability and unreliability of significant suppression and detection systems are green, indicating no operational issues of concern or outlier behavior on those systems. This insight is further supported by a separate study of suppression and detection systems which show minimal failures for these systems over the past few years.

Therefore, there is no impact on this application.

ENCLOSURE, Continued RNP-RA/18-0013 38 FSS-E1-01 Fire FSS-E1 I/II/III Section 4.3 of Calculation No. P2217-2100-00, Fire Scenario Data, RNP-F/PSA-0079, Revision 0, dated January 2013 contains information about fire modeling parameters that were used. However, Section 4.4 through 4.7 should be completed because they are missing information about other relevant fire modeling parameters. Sections 4.3 through 4.7 still make reference to databases for the parameters used in the fire modeling. These parameters should be added to the report.

This is a documentation only issue.

No issues are identified with the modeling parameters that were used. Therefore there is no impact on this application.

ENCLOSURE, Continued RNP-RA/18-0013 39 FSS-E3-01 Fire FSS-E3 I

No statistical representation of uncertainty intervals (e.g., NUREG/CR-6850 Table E-1 or G-1 for HRR, Tables E-2 through E-9 for severity factor) is documented for the mean values of parameter estimates used for fire modeling the significant fire scenarios.

HBRSEP2 used the HRRs and applied them using the guidance found in NUREG/CR-6850. As NUREG/CR-6850 is the consensus methodology, a detailed uncertainty analysis on these parameters is not needed and does not add to the credibility of the results. The majority of applied values are based on the 98th and 75th percentile fires from NUREG/CR-6850, and the ZOIs are applied conservatively. It is not believed that reducing these values would allow the use of reduced impacts for the applications being pursued.

Although no change has yet been made that would improve the Capability Category assessments, HBRSEP2 considers the risk results from the Fire PRA to be creditable for this application because documenting the statistical representation of uncertainty intervals will not change the quantified risk metrics.

There is no impact on the application.

ENCLOSURE RNP-RA/18-0013 40 External Hazard Screening Result Screened?

(Y/N)

Screening Criterion (Note a)

Comment Aircraft Impact Y

PS4 Aircraft impact analysis is assessed to be <1E-06 Avalanche Y

C3 Not applicable because of site topography.

Biological Event Y

C5 Biological influxes are slowly developing and can be detected and mitigated by surveillance.

Coastal Erosion Y

C3 Event cannot occur close enough to affect the plant.

Drought Y

C1, C5 No worse consequences than other events.

Develops slowly.

External Flooding Y

PS4 Site is not vulnerable to the effects of external flooding from prolonged precipitation or local intense precipitation.

Extreme Wind or Tornado N

IPEEE The frequency of core damage from high winds was estimated in the IPEEE to be on the order of 2E-06 per year, with equal contributions from tornados and non-tornadic winds. SSCs credited in the IPEEE for accident mitigation will be retained as HSS components. Credited SSCs are listed in the IPEEE similar to SSEL.

Fog Y

C1 Negligible impact on the plant.

Forest or Range Fire Y

C3 Event cannot occur close enough to the plant.

Frost Y

C1 Negligible impact on the plant.

Hail Y

C1 Negligible impact on the plant.

High Summer Temperature Y

C2, C5 Damage potential is lower than for other events for which the plant is designed. Impacts are slow to develop.

High Tide, Lake Level, or River Stage Y

C1, C4 Damage potential is lower than for other events for which the plant is designed. Included in external flooding assessment.

Hurricane Y

C4 Included in Extreme Wind and External Flood analysis. : External Hazards Screening

ENCLOSURE, Continued RNP-RA/18-0013 41 Ice Cover Y

C3, C5 Event cant occur close enough to affect the plant.

Impacts are slow to develop.

Industrial or Military Facility Accident Y

C3 No facilities close enough to affect the plant.

Internal Flooding N

Detailed PRA An internal flooding PRA that meets the requirements of ASME/ANS RA-Sa-2009 has been developed and will be used for 10 CFR 50.69 categorization Internal Fire N

Detailed PRA The fire PRA developed for NFPA 805 meets the requirements of ASME/ANS RA-Sa-2009 will be used for 10 CFR 50.69 categorization.

Landslide Y

C3 Not applicable to the site because of topography.

Lightning Y

C4 Lightning strikes causing loss of offsite power or turbine trip are included as one contributor to the initiating event frequencies. The impacts already modeled in the internal events PRA.

Low Lake Level or River Stage Y

C4, C2 Frequency of dam failure in IPEEE is much less than loss of service water initiator included in internal events PRA. SSCs credited in for mitigation in the IPEEE (e.g., the deepwell pumps) will be retained as HSS in the categorization.

Low Winter Temperature Y

C1, C5 Extended freezing temperatures are rare, the plant is designed for such events, and their impacts are slow to develop.

Meteorite or Satellite Impact Y

C2 Negligible impact to the site.

Pipeline Accident Y

PS4 Likelihood of core damage or other hazards from natural gas pipelines in the vicinity of the plant were assessed to be negligible.

Release of Chemicals in Onsite Storage Y

PS4 Onsite storage of hazardous chemicals is limited and not a concern to the site.

River Diversion Y

C2, C5 Lower mean frequency and no worse consequence than dam failure. Event would be slow to develop.

Sand or Dust Storm Y

C3 Not applicable to the site.

Seiche Y

C3 Not applicable to the site.

ENCLOSURE, Continued RNP-RA/18-0013 42 Seismic Activity N

SMA The Seismic Margins Assessment (SMA) developed for the IPEEE will be used for categorization.

Snow Y

C1 Major snow events are unlikely, and they last for a short period of time. The event damage potential is less than other events for which the plant is designed.

Soil Shrink-Swell Consolidation Y

C1 The potential for this hazard is low at the site, and the plant design considers this hazard.

Storm Surge Y

C3 Not applicable to the site.

Toxic Gas Y

C4 Included in assessment of industrial facility accidents.

Transportation Accident Y

PS4 Transportation of chemicals in proximity to the plant do not create a hazard for the plant.

Tsunami Y

C3 Not applicable to the site.

Turbine-Generated Missiles Y

C2, C4 Has lower mean frequency and no worse consequences than tornado-generated or extreme wind-generated missiles.

Volcanic Activity Y

C3 Not applicable to the site.

Waves Y

C3 Not applicable to the site.

Note a - See Attachment 5 for descriptions of the screening criteria.

ENCLOSURE RNP-RA/18-0013 43 Event Analysis Criterion Source Comments Initial Preliminary Screening C1. Event damage potential is

< events for which plant is designed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse consequences than other events analyzed.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the plant to affect it.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of another event.

NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 Not used to screen.

Used only to include within another event.

C5. Event develops slowly, allowing adequate time to eliminate or mitigate the threat.

ASME/ANS Standard Progressive Screening PS1. Design basis hazard cannot cause a core damage accident.

ASME/ANS Standard RA-Sa-2009 PS2. Design basis for the event meets the criteria in the NRC 1975 Standard Review Plan (SRP).

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the mean conditional core damage probability is < 0.1.

NUREG-1407 as modified in ASME/ANS Standard RA-Sa-2009

Progressive Screening Approach for Addressing External Hazards

ENCLOSURE, Continued RNP-RA/18-0013 44 PS4. Bounding mean CDF is < 1E-6/y.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009 Detailed PRA Screening not successful. PRA needs to meet requirements in the ASME/ANS PRA Standard.

NUREG-1407 and ASME/ANS Standard RA-Sa-2009

ENCLOSURE RNP-RA/18-0013 45 : Disposition of Key Assumptions/Sources of Uncertainty Assumption/Uncertainty Discussion Disposition 1

Reactor Coolant Pump (RCP)

Seal Failure The HBRSEP2 PRA model uses the WOG 2000 RCP seal failure model, and it assumes RCP seal leakage every time both Seal Injection and Thermal Barrier cooling are lost. This is an Industry consensus model. For risk applications this is one of the most important areas of uncertainty.

The approach utilized for modeling RCP seal LOCA frequencies is consistent with industry practice.

In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to the component being safety significant. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

2 Loss of Off-Site Power (LOOP) Frequencies Loss of off-site power (LOOP) initiating events have been shown to be important contributors to CDF due to the potential for station blackout and the reliance of many frontline systems on AC power. The LOOP initiator was separated into plant, grid, switchyard, and weather induced LOOPs, which allowed the model to apply recovery actions to the higher frequency events (i.e.,

plant and switchyard). HBRSEP2 used generic industry data to calculate LOOP frequencies.

The approach utilized for modeling the LOOP frequencies and the recovery probabilities is consistent with industry practice. In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to component being safety significant. The assessment of the uncertainties, therefore, is appropriately included in this risk-informed application.

3 Fire Modeling The HBRSEP2 Fire PRA (FPRA) model complies with the NUREG/CR-6850 methodology that includes uncertainties from the inherent randomness in elements that comprise the FPRA model, and from the state of knowledge in these elements as the FPRA technology continues to evolve. These include the fire ignition frequencies, heat release rates, fire growth curves, fire suppression failure probabilities, severity factors, and post-initiator human failure event probabilities.

While the approaches used in the HBRSEP2 FPRA are NRC-approved methodologies, they are still Updated, NRC-approved FPRA technologies will be incorporated in the HBRSEP2 FPRA model as they become available in accordance with the normal PRA maintenance and update (MU) procedures. In accordance with NEI 00-04, sensitivity studies will be used to determine whether other conditions might lead to component being safety significant. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

ENCLOSURE, Continued RNP-RA/18-0013 46 Assumption/Uncertainty Discussion Disposition constrained by the relatively limited data on fire events at Nuclear Power Plants.

4 Incipient Detection sensitivity for the very early warning fire detection system The HBRSEP2 Fire PRA assumes Incipient Detection System functions as outlined in NUREG 2180. Industry data supports a much more sensitive response such that fires in cabinets with this system installed have a much lower probability of a fire.

The current method of crediting Incipient Detection at RNP is similar to NUREG 2180 with more credit for operators to prevent fires based upon actual plant experience and plant procedures.

If future research is completed that shows a more effective system, those results would be applied. The impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

5 HVAC Modeling for AFW System Loss of all HVAC room cooling for the motor driven AFW pumps results in their failure. Motor driven pumps may run in some loss of HVAC scenarios, but a basis for every scenario isnt available, so the pumps are modeled to fail without HVAC.

This results in the HVAC system potentially having slightly more risk significance than it would if the detailed modeling of different scenarios was performed.

However, the impact is conservative and expected to be insignificant. The impact of this uncertainty, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

ENCLOSURE, Continued RNP-RA/18-0013 47 Assumption/Uncertainty Discussion Disposition 6

No Credit for Ruptured steam generators taken Ruptured steam generators (SG) are assumed not capable of supporting the success criteria for cooling down the RCS. The plant EOPs do allow use of ruptured SG if there are no intact SG is available.

The exclusion of a ruptured SG is conservative and could result in some SSCs being credited as HSS, when that may not be the case. However, the impact is conservative and expected to be insignificant since the likelihood of having a SGTR with no heat removal capability from either intact steam generator, while still having the ability to cool down using the ruptured generator is extremely small. The impact of this uncertainty, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

7 Operator Action Recovery and initiator fault tree dependency There is complete independence between an initiator human error (Type B) and a mitigation human error (Type C). The paradigm for the crew responding to an event would be reset upon the reactor trip and the entering of the emergency operating procedures (EOPs).

Any dependency between pre-initiator and post-initiator HFEs would be very minimal.

Additionally, there are only 3 pre-initiator HFEs in the model, such that any dependency would have a very small impact on SSC importances. The impact of this uncertainty, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.

8 Operator Action Recovery lower-bound dependency value applied A lower-bound value is used in place of the calculated results for very low probabilities; a lower bound is established at 1E-05 for any individual HFE. Characterizing human response probabilistically isnt advanced enough to be confident in the credibility of very low post-initiator probabilities.

The NEI 00-04 sensitivity studies explicitly require setting human error basic events to the 5th and 95th percentile values as a sensitivity. The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

ENCLOSURE, Continued RNP-RA/18-0013 48 Assumption/Uncertainty Discussion Disposition 9

Operator Action recovery dependency analysis Not all potential dependencies for recovery actions have been completed. This is conservative because all HRA recovery actions are set to 1.0 unless a recovery analysis was completed for the combination. In some cases a partial HRA combination may be applied. This dependency analysis was performed to low enough truncation that further efforts in the base PRA model yielded little CDF improvement. In cases where equipment is assumed less available or reliable this lack of full dependency analysis may result in conservative results.

Given that a floor value is applied to HFE combinations, including additional HFEs into existing dependency combinations is expected to have a negligible impact. Additionally the NEI 00-04 sensitivity studies explicitly require setting human error basic events to the 5th and 95th percentile values as a sensitivity.

The assessment of the uncertainties, therefore, is appropriately addressed by the sensitivity studies required by this risk-informed application.

10 Feed and Bleed Success Criteria for loss of secondary heat removal is potentially conservative The Feed and Bleed success criteria is one HPSI and two PORVs for loss of all secondary heat removal scenarios, and assumes the loss of heat removal occurs at T=0. Thermal Hydraulic Analysis shows that if approximately 50 minutes of AFW cooling is provided prior to its failure, the feed and bleed is successful with one PORV instead of two as assumed in the Success Criteria.

This results in some SSCs (AFW pumps, PORVs) potentially having slightly more risk significance than they would be if the detailed modeling of the PORV requirements based on AFW failure time was performed.

However, the impact is conservative and expected to be insignificant. The impact of the uncertainties, therefore, is appropriately understood in this risk-informed application and no further sensitivities are required.