ML18129A448

APS Response to Request for Additional Information for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components

ML18129A448
Person / Time
Site:	Palo Verde
Issue date:	05/09/2018
From:	Lacal M Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-07690-MLL/MDD
Download: ML18129A448 (117)

Text

10 CFR 50.69 10 CFR 50.90 MARIA L. LACAL Senior Vice President Nuclear Regulatory and Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 Tel 623.393.6491 102-07690-MLL/MDD May 9, 2018 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

References:

1. Arizona Public Service Company (APS), License Amendment Request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, for Palo Verde Nuclear Generating Station, Units 1, 2, and 3, dated July 19, 2017, Agencywide Documents Access and Management System (ADAMS) No. ML17200D162

2. NRC Letter, Request for Additional Information License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components, dated April 13, 2018, ADAMS No.

ML18099A007

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 APS Response to Request for Additional Information for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components On July 19, 2017, APS submitted a license amendment request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment Of Structures, Systems, and Components for Nuclear Power Reactors, Reference 1. During the week of February 20, 2018, the NRC staff conducted an audit at the Palo Verde Nuclear Generating Station (PVNGS) to gain an understanding of the risk-informed categorization process and to review the probabilistic risk assessment model that will be used by APS for this risk-informed LAR. The NRC staff determined A member of the STARS Alliance Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

102-07690-MLL/MDD ATTN: Document Control Desk U.S. Nuclear Regulatory Commission APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Page 2 that additional information is required in order to complete their review and a clarifying phone call was held with APS to discuss the information needed. The NRC questions and the APS responses to the Request for Additional Information (RAI) questions are provided in the enclosure to this letter.

Several of the responses by APS refer to additional work that will be completed subsequent to this response letter. This work will be completed prior to implementation of the 10 CFR 50.69 process at PVNGS. As described in Attachment 1 to the enclosure, a new license condition is proposed to address this work required to be completed prior to implementation of the 10 CFR 50.69 categorization process at PVNGS.

APS has reviewed the information supporting a finding of no significant hazards consideration that were previously provided to the NRC in the enclosure of Reference 1. APS has concluded that the information provided in this response does not affect the basis for concluding that the proposed license amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92.

Should you need further information regarding this letter, please contact Michael DiLorenzo, Nuclear Regulatory Affairs, at (623) 393-3495.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on______May 9, 2018 (Date)

Sincerely, MLL/MDD/PJH/sa

Enclosure:

Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components

102-07690-MLL/MDD ATTN: Document Control Desk U.S. Nuclear Regulatory Commission APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Page 3 cc: K. M. Kennedy NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS C. A. Peabody NRC Senior Resident Inspector for PVNGS M. D. Orenak NRC NRR Project Manager for PVNGS

ENCLOSURE Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components

Table of Contents Enclosure - Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components - Palo Verde 10 CFR 50.69 PRA Implementation Items - Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models - Disposition of Key Assumptions/Sources of Uncertainty - IDP Changes from Candidate HSS to LSS - Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding, and Internal Fire Models - Other External Hazards Screening Peer Review Findings - Internal Fire Focused Scope PRA Peer Review - PRA Risk Criteria per NEI 00-04

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Introduction On July 19, 2017, APS submitted a license amendment request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment Of Structures, Systems, and Components For Nuclear Power Reactors. To support its safety evaluations, the NRC staff conducted an audit at the Palo Verde Nuclear Generating Station (PVNGS) in Tonopah, Arizona, from February 20-23, 2018. The NRC staff has reviewed the LAR and determined that additional information is required in order to complete the review. These request for additional information (RAI) responses are provided in this enclosure. The APS response is provided after each RAI.

Request for Additional Information (RAI) 01 APLA RG 1.200, Revision 2, PRA Acceptability, F&O Closure

a. Regulatory Guide (RG) 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (ADAMS Accession No. ML090410014), provides guidance for addressing probabilistic risk assessment (PRA) acceptability including addressing the need for the PRA model to represent the as-designed or as-built, as-operated plant through: (1) a discussion of the resolution of the peer review (or self-assessment, for peer reviews performed using the criteria in Nuclear Energy Institute (NEI) 00-02, Revision 1, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, May 2006 (ADAMS Accession No. ML061510619),

findings and observations that are applicable to the parts of the PRA required for the application; and (2) documenting the use of the parts of the PRA that conform to capability categories or grades lower than deemed required for the given application.

Without the described information above, the NRC staff is unable to complete its review. Please provide the following:

i. For the PRA quality requirements addressed in the self-assessment, please confirm the scope of the facts and observation (F&O) closure review included review of the self-assessment findings of the internal events PRA (IEPRA) against the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, supporting requirements (SRs) at Capability Category II (CC- II), as qualified by RG 1.200, Revision 2.

ii. If the F&O closure review did not include review of findings from the self-assessment of the IEPRA against the ASME/ANS RA-Sa-2009 SRs at CC-II, as qualified by RG 1.200, Revision 2, then please provide all the self-assessment findings and a disposition for each finding as it pertains to this application.

Page 1 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

b. Section 3.3, PRA Review Process Results [10 CFR 50.69(b)(2)(iii)], of the LAR, the licensee stated that a F&O closure review was performed in June 2017 to assess the closure of all finding level F&Os from these peer reviews.

Additionally, the NRC staff determined that APS performed a self-assessment of the IEPRA model in March 2011 to address the PRA quality requirements not considered in the Combustion Engineering Owners Group (CEOG) peer review.

Appendix B, NRC Position on the NEI Peer Review Process (NEI 00-02), of RG 1.200, Revision 2, provides guidance that states the results of the self-assessment are used to demonstrate the technical adequacy of a PRA for an application, differences between the current version of the standard (i.e.,

ASME/ANS Ra-Sa-2009) as endorsed in RG 1.200, Appendix A, and the earlier version (i.e., ASME RA-Sb-2005) be identified and addressed. The licensees peer review performed in 1999 was performed using the CEOG peer review process prior to the inception of the ASME/ANS RA-Sb-2005 PRA Standard.

i. For the self-assessment, please clarify how the 1999 Peer Review performed was assessed against the current version of the ASME/ANS PRA standard, as qualified by RG 1.200, Revision 2. Please provide the date to confirm when the self-assessment was performed.

APS Response to RAI 01

a. The self-assessment of the internal events PRA (IEPRA) (Engineering Evaluation 3579223, Revision 1) was performed in March 2011 against the requirements in ASME/ANS RA-Sa-2009 and NRC clarifications in RG 1.200, Revision 2, Appendix A. The self-assessment identified four supporting requirements (SRs) as not met to Capability Category (CC) II: IE-A8, SY-A4, SY-C1, and SY-C2.

The F&O closure review in June 2017 included a review of the issues associated with the four not met SRs from the self-assessment (page A-34 of the F&O closure review report). An augmented F&O closure review will be conducted as described in Attachment 1 to better document the scope of the F&O closure review as including the self-assessment results.

b. A self-assessment of the IEPRA model was completed by APS in March 2011 to assess the gaps between the CEOG peer review results and the current version of the ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. The self-assessment reviewed all IEPRA SRs in the ASME/ANS RA-Sa-2009 and RG 1.200, Revision 2, guidance to Capability Category II. The results of the self-assessment were documented in Engineering Evaluation 3579223, Revision 1.

Page 2 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 02 APLB - Seismic PRA RG 1.200, Revision 2, PRA Acceptability, NEI 12-13 Section 3.2.3, Seismic Hazards, of the LAR states, in part, that [t]he categorization process for seismic hazards will use a peer reviewed plant-specific Seismic PRA [SPRA] model in accordance with RG 1.200, Revision 2. The NRC staff was unable to determine, which peer review guidance was used. Please indicate, which guidance document was used to perform the SPRA peer review.

If the peer review was performed using guidance not described in RG 1.200, Revision 2, such as NEI 12-13, External Hazards PRA Peer Review Process Guidelines (ADAMS Package Accession No. ML122400044), please provide the following additional information to justify the use of NEI 12-13:

a. Please describe how the qualifications of the SPRA peer review team comply with the peer review requirements in ASME/ANS RA-Sa-2009, Sections 1-6.2 and 5-3.2, as endorsed in RG 1.200, Revision 2.

b. Please identify any unreviewed analysis methods (UAMs) used in the SPRA, as determined by the peer review team, and describe each UAM with a level of detail appropriate for the NRC staff to evaluate its acceptability.

c. Please describe if the SPRA relies on expert judgment to meet any SR and, if so, demonstrate conformance to the expert judgment requirements of ASME/ANS RA-Sa-2009, Section 1-4.3. Also, please cite any information from the peer review report related to the evaluation of the use of expert judgment by the peer review team and whether the peer review team found the use of expert judgment to be appropriate.

d. Please clarify whether the SPRA was reviewed against CC-I for any SR.

Provide a list of all SRs that were reviewed against CC-I or found to meet only CC-I without an associated finding. For each such SR, please justify why not meeting the SR at CC-II does not impact this application.

e. Please clarify whether an in-process peer review was performed for the SPRA. If an in-process approach was utilized, confirm that (i) the approach met the requirements for an independent peer review as stated in ASME/ANS RA-Sa-2009 and the process described in NEI 12-13; (ii) a final review by the entire peer review team occurred after the completion of the SPRA; and (iii) peer reviewers remained independent throughout the PRA development activity as discussed in the enclosure to the letter dated November 16, 2012, from Mr. Donald G. Harrison, NRC to Mr. Biff Bradley, NEI (ADAMS Accession No. ML12321A280).

Page 3 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 02 The PVNGS Seismic PRA (SPRA) peer review was performed using the process defined in Nuclear Energy Institute (NEI) 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012 (Reference 14).

a. The peer review team was made up of five members that were fully qualified to meet the experience expectations of ASME/ANS RA-Sa-2009, Part 5, Section 5-3, Peer Review for Seismic Events At-Power. Each of the peer review team members has extensive knowledge of the technical requirements of the ASME/ANS RA-Sa-2009 Standard in their area of review.

Three of the five team members each have over 20 years of experience in the nuclear power field specializing in probabilistic risk assessment. The remaining two team members each have over 25 years of experience performing seismological investigations which includes probabilistic seismic hazards and at least one member completed Seismic Qualification Utility Group (SQUG) walkdown screening and seismic evaluation training. As such, the peer review team fully complies with Section 1-6.2 of ASME/ANS RA-Sa-2009.

Furthermore, the peer review team has the combined experience to meet the requirement of Section 5-3.2 of ASME/ANS RA-Sa-2009. Each member is an expert in their field as demonstrated by holding Manager level positions such as technical leads of PRA development, lead seismic scientist, or principal investigator.

b. There were no Supporting Requirements (SRs) classified as unreviewed analysis methods (UAMs).

c. There was no need for the use of expert judgment outside of the PRA analysis team to meet any SR. There was no need to obtain broader perspectives on any aspect of the development of the SPRA.

d. Two seismic hazard analysis (SHA) SRs (SHA-E1 and SHA-E2) were evaluated as CC-I. Findings were assessed for both SHA-E1-01 and SHA-E2-

01. Therefore, in accordance with the NRC comment, a finding was written for any SR receiving a CC-I. An F&O closure review performed in June 2017 reviewed both SHA findings and verified finding SHA-E1-01 meets Capability Category II. However, finding SHA-E2-01 needed additional actions to be considered as meeting Capability Category II. SHA-E2-01 will be resolved as described in Attachment 1.

e. The PVNGS SPRA was peer reviewed all-at-once and not an in-process approach.

Page 4 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 03 APLB - [SPRA] RG 1.200, Revision 2, PRA Acceptability, FPIE as Basis for SPRA ASME/ANS RA-Sa-2009, Section 5-2.3, Part 5, Requirements for Seismic Events At-Power PRA, assumes that full-scope internal-events at-power Level 1 and Level 2 large early release frequency (LERF) PRAs exist and that those PRAs are used as the basis for the SPRA systems analysis. Please provide the following information to establish the technical adequacy of the IEPRA model, which was used as the foundation for the SPRA.

a. Please identify the version of the IEPRA which was used as the foundation for the SPRA and any finding-level F&Os that had not been closed in accordance with an NRC-accepted process at the time it was used.

b. For each finding-level F&O, please describe the disposition and the impact of the F&O on the SPRA as it pertains to this application.

c. Please identify any IEPRA upgrades that were incorporated into the IEPRA, which was used as the foundation for the SPRA, but had not been peer-reviewed prior to the development of the SPRA.

APS Response to RAI 03

a. The SPRA peer review judged supporting requirement (SR) SPR-B1 as Not Met and is described by finding SPR-B1-01. The basis for this finding is a self-assessment of the internal events PRA (IEPRA) (Engineering Evaluation 3579223) performed in March 2011 which identified open findings following a 1999 peer review of the internal events model. The self-assessment identified four SRs as not met to Capability Category II: IE-A8, SY-A4, SY-C1, and SY-C2. Internal events plant walkdowns, interviews, and documentation have since been performed. The F&O closure review in June 2017 included a review of the issues associated with the four not met SRs from the self-assessment (page A-34 of the F&O closure review report).

b. Each of these internal events findings have been verified closed in an F&O Closure Review. Therefore, SPR-B1-01 was evaluated as closed based on the closure of the internal events findings closure.

c. There are three IEPRA upgrades that were subsequently identified for a focused scope peer review: Common cause methodology change (Multiple Greek Letter Method to Alpha Factor Method), Human Reliability Analysis (HRA) methodology change (Systematic Human Action Reliability Procedure (SHARP) model to the EPRI HRA Calculator Software), and PRA Impact 2003-301 that incorporated new modeling for pressure-induced steam generator tube rupture (SGTR) using CE NPSD-1124 Methodology for Modeling Main Steam Line Breaks, Revision 0. These upgrades were not previously determined to be upgrades since they were already reflected in the internal flood, internal fire, and seismic PRA models at the time of those peer reviews. A focused scoped peer review will be conducted as described in Attachment 1.

Page 5 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 04 APLB - RG 1.200, Revision 2, PRA Maintenance and Update:

Configuration Control Section 3.2.6, PRA Maintenance and Updates, of the LAR states that the licensees risk management process ensures that the applicable PRA models used, continue to reflect the as-built and as-operated plant for each of the PVNGS units. NEI 00-04, Revision 0, 10 CFR 50.69 SSC [Structure, System, and Component] Categorization Guideline (ADAMS Accession No. ML052910035), Section 12.1, states that the assessment of new technical information should be performed during the normally scheduled periodic review cycle. However, based on the information provided in the LAR, it was not clear to the NRC staff how the site-specific seismic hazard information would be evaluated to ensure that the SPRA continues to reflect the as-built, as-operated plant.

Please summarize the process that will be used to review seismic hazard information, including: the frequency of the review if it is to be performed periodically, the sources of information that will be used to perform the reviews, and the criteria that will be used to determine when new hazard results will be incorporated into the SPRA. Please include a description of the approach that will be taken to propagate updated site-specific hazard information throughout the SPRA model that could impact the categorization results.

APS Response to RAI 04 The Palo Verde PRA configuration control process is documented in procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15. The as-built, as-operated plant is monitored with respect to all PRA model hazards (internal events, internal flooding, fire, and seismic). Monthly, PRA staff review new or revised plant documents to identify impacts that would require a change to the PRA model. In addition, at least once every two refueling outages, which is 36 months for Palo Verde, changes in PRA methods as documented in various industry reports are reviewed to identify impacts. Updates to the seismic hazard evaluation will rely on industry guidance and common practice to determine the need to incorporate new information into hazard results. Once a need is identified, the update will follow the configuration control process of identifying the impacted model, providing a change description, assigning a priority, modifying the model, and then updating the applications and documents listed in Appendix B of 70DP-0RA03.

In addition, PVNGS Design Civil Department participates in the EPRI Risk and Safety Management - Supplemental Program 7.1m External Hazards Data Collection. By participating in this program, APS ensures that information pertaining to external hazards are tracked and considered in maintaining the safe operation of the plant. EPRI serves as a focal point for tracking and disseminating new hazard information as it becomes available. EPRI tracks evolving information related to external hazards and compiles periodic reports. The benefits of this program include:

Page 6 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• An efficient, shared resource for understanding changes in external hazards and for making consistent evaluations of whether new information is credible and relevant

• Regular reporting of relevant updates to inform decisions regarding preparations for external hazards

• Interpretation and analysis of information to identify technical insights and to clarify potential uncertainties This information can then be used by PVNGS Design Civil and PRA to inform evaluations and decisions affecting plant design, operation, and maintenance.

Page 7 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 05 APLA(B) - RG 1.200, Revision 2, PRA Acceptability, F&O Closure Process Section 3.3 of the LAR states, in part, [a]n F&O closure peer review was performed in June 2017, in accordance with NRC letter dated May 3, 2017. Furthermore, it states, in part, [t]he F&O closure review was conducted to ensure the findings had been satisfactorily resolved to meet the ASME PRA Standard RA-Sa-2009 to Capability Category II, the sub-element criteria for the CEOG from Internal Events PRA peer review, and RG 1.200, Revision 2.

Please provide the following information to clarify and confirm that the F&O closure review was performed consistent with Appendix X to NEI 05-04/07-12/12-06 guidance (ADAMS Accession No. ML16158A035) governing the process for Close-out of Facts and Observations that the NRC staff accepted, with conditions, in the letter dated May 3, 2017, from Joseph Giitter and Mary Jane Ross-Lee, NRC to Greg Krueger, NEI (ADAMS Accession No. ML17079A427).

a. Please clarify whether a focused scope peer review was performed concurrently with the F&O closure process. If so, please provide a brief summary of the focused scope peer review that includes:

i. Discussion of the scope of F&Os reviewed (e.g., which peer review(s) generated F&Os, self-assessment finding(s), external hazards peer review(s), etc.).

ii. Discussion of any new findings generated from the concurrent focused scope peer review performed and the associated dispositions as it pertains to this application.

iii. Summary of the peer review teams conclusion(s) and comments on the concurrent focused scope peer review performed.

b. Please confirm that the closure review team was provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constitutes a PRA upgrade or maintenance update, as defined in ASME/ANS RA-Sa-2009 and qualified by RG 1.200, Revision 2. If the written assessment and justification for the determination of each F&O was not performed and reviewed by the F&O closure review team, please discuss how this aspect of the F&O closure process was met consistent with the NRC staffs acceptance and conditions provided in the letter dated May 3, 2017.

c. Appendix X,Section X.1.3, includes the following five criteria for selecting members of the closure review team.

i. Every member of the independent assessment team should be independent of the PRA associated with the F&Os being reviewed, per the criteria of independent in the ASME/ANS PRA Standard. These members may be contractors, utility personnel, or employees of other utilities, and may include members of peer review teams that previously reviewed the models being assessed.

Page 8 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 ii. Every member of the independent assessment group should meet the relevant peer reviewer qualifications as stated in the ASME/ANS PRA Standard for the technical elements associated with the F&Os being reviewed.

iii. The overall review team experience includes two qualified reviewers for each F&O. An exception to this is allowed for the closure of an F&O related to a single SR, in which case, a single independent reviewer is acceptable, in alignment with the peer review guidance in the main body of this document and in accordance with the ASME/ANS PRA Standard.

iv. Each member of the independent assessment team should be knowledgeable about the F&O independent assessment process used to assess the adequacy of the F&O resolution.

v. The total number of reviewers is a function of the scope and number of finding F&Os to be reviewed for closure.

Please describe how the selection of members for the June 2017 independent assessment met the above criteria. Please explain how closure of the F&Os was assessed to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements, associated with the closed F&Os now meet ASME/ANS RA-Sa-2009 SRs at CC-II.

d. Please discuss whether the F&O closure review scope included all finding-level F&Os, including those finding-level F&Os that are associated with Met SRs at CC-II. If not, please identify and describe those findings that were excluded from the F&O closure review scope. For each identified finding-level F&O, please describe the disposition and the impact of the F&O on PRA as it pertains to this application.

APS Response to RAI 05

a. ABS Consulting report R-3882824-2037, Palo Verde Generating Station PRA Finding Level Fact and Observation Closure Review, section 2.2 states the following:

The review team found that some Findings should remain open since their closure was deemed incomplete or did not address the issue. The review team shared any new issues identified during the course review, but such items were not considered new Finding level F&Os since, with the exception of two F&Os (i.e., one IEPRA F&O and one associated with the SPRA seismic hazard analysis element), the review did not involve an embedded focused scope peer review. For the two F&Os for which a concurrent focus peer review was performed, no new F&Os were identified. The host utility PRA team was prepared to generate actions for follow-up investigation of such new issues as appropriate.

As noted, the focused scope peer review reviewed the resolution of two existing F&Os determined to be upgrades. The focused scope peer review did not generate any new F&Os against any Palo Verde PRA models. Per Page 9 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 section 3.3 of ABS report R-3882824-2037, the F&Os reviewed as part of the embedded focused scope peer review are as follows:

During the period of onsite closure review, concurrent focused scope peer review was also performed for two separate F&Os; i.e., IEPRA F&O HR-03 and SPRA F&O SHA-E1-01.

b. The F&O closure review team was not provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constituted a PRA upgrade or maintenance update as defined in ASME/ANS RA-Sa-2009. Attachment 1 identifies the items that are required to be completed prior to implementation of the 10 CFR 50.69 categorization process at PVNGS.

c. APS reviewed the resumes for each proposed F&O closure review team member to ensure the criteria of Appendix X to NEI 05-04/07-12/12-06, the staffs acceptance and conditions provided in the letter dated May 3, 2017 (ADAMS Accession Number ML17079A427), Regulatory Guide 1.200, Revision 2, and ASME/ANS RA-Sa-2009 were met. The selected team members were confirmed by Palo Verde to be independent and meet the relevant peer reviewer qualifications as defined in ASME/ANS RA-Sa-2009. Each F&O resolution was reviewed by at least two qualified reviewers. F&O closure review team members were knowledgeable about the F&O independent assessment process as defined in Appendix X to NEI 05-04/07-12/12-06.

APS ensured the team was large enough to ensure that each F&O resolution was reviewed by at least two qualified reviewers during the week allotted to the F&O closure review. APS will follow this same process with the augmented F&O closure review.

ABS Consulting report R-3882824-2037, section 2.2, states the following:

The Finding F&O Closure Technical Review Team decided if the Finding F&Os in question were adequately addressed and could be closed out via consensus. Additionally, once all of the Finding F&Os that were associated with a given SR assessed as less than Capability Category II had been closed out, the capability category of the affected SRs was also considered changed per the discussion in Section 2.4.

ABS Consulting report R-3882824-2037, section 2.4, outlines the criteria used by the F&O closure review team to assign the revised capability categories:

The guidance in NEI 05-04 Section 3, NEI 07-12 Section 3.3, and NEI 12-13 Section 3.3 regarding assignment of capability categories against the ASME/ANS PRA Standard was applicable in this review relative to re-categorization of SR capability categories.

Therefore, upon closure of all F&Os associated with a given SR:

• If the SR was originally considered NOT MET, the SR shall be considered MET at CC-II.

• If the SR was originally considered MET at CC-I and the F&O provided a path to CC-II, the SR shall be considered MET at CC-II.

Page 10 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• If the SR was originally considered MET with F&Os that qualified that ranking, those qualifications shall be removed.

The re-categorization of the status of the subelement criteria/requirement for the IEPRA (which used the CEOG peer review process) is similar. If the status of the subelement criteria was originally considered Marginal or Inadequate, it shall be considered Meets upon closure of all associated F&Os. If the subelement requirement was originally considered Meets with qualifying F&Os, the qualifications shall be removed once all associated F&Os are closed.

In short, the F&O closure team reviewed each F&O resolution against any associated ASME/ANS RA-Sa-2009 SR(s) and revised the Met/Not Met status based on satisfactory closure of the F&O. The updated SR status is documented in ABS Consulting report R-3882824-2037, tables 4-2, 4-3, 4-4, and 4-5. This same process will be followed for the augmented F&O closure review.

d. The F&O closure review scope included all finding-level F&O resolutions associated with Not Met to capability category (CC) II ASME/ANS RA-Sa-2009 Supporting Requirements (SRs) written against the Palo Verde internal events, internal flooding, internal fire, and seismic PRA models. Other findings associated with Met to CC II SRs were not believed to be in the required scope since the affected SRs were met regardless of the findings.

To address this question, APS will include all F&O findings associated with Met Supporting Requirements at CC II in an augmented F&O closure review.

The augmented F&O closure review will be conducted as described in Attachment 1.

Page 11 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 06 APLA(B) - RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review Attachment 3, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process, of the LAR provides dispositions for the self-assessment open items and the F&Os from the peer review of the IEPRA (including internal flooding) and SPRA that were not closed by the June 2017 F&O closure review. These dispositions state that the closure review team recommendations will be addressed or implemented and that

[t]hese [PRA] changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a prerequisite to categorization.

Please propose a mechanism that ensures these activities and changes will be completed and appropriately reviewed in accordance with an NRC-accepted process (e.g., full-scope peer review, focused scope peer review, or F&O closure review) and any issues resolved prior to implementing the categorization process. This mechanism should also include any additional finding-level F&Os identified in response to APLA(B) RAI 01, APLB RAI 03, APLA(B) RAI 05, APLA(B) RAI 09, APLA RAI 17, and APLA RAI 21 and specify, how the F&Os will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR). An example would be a table of listed implementation items referenced in a license condition.

As an alternative to providing an implementation item for an F&O, please demonstrate that the F&O will have no impact to the 10 CFR 50.69 categorization process results.

APS Response to RAI 06 The Not Met finding level F&Os from the peer review of the IEPRA (including internal flooding) and SPRA that were not closed by the June 2017 F&O closure review are being tracked via the PRA model impact database. Model and documentation updates necessary to address the F&O closure review panel recommendations are in progress and closure will be confirmed by the conduct of an additional NRC endorsed F&O Closure Review. In addition, this review will include six seismic PRA findings associated with supporting requirements determined Met to Capability Category II as identified in APLA(B) RAI 05. Finally, the review will also include three external hazards findings related to walkdowns and documentation identified in APLA RAI 17. No additional findings requiring a review were identified in APLA(B) RAI 01, APLB RAI 03, and APLA RAI 21.

For IEPRA changes determined to be PRA upgrades in APLB RAI 03 and APLA(B)

RAI 09, APS will conduct a focused scope peer review as described in Attachment 1.

Finding level F&Os identified as a result of the focused scope peer review will be resolved prior to implementation of the 10 CFR 50.69 application. Finding level F&Os will be reviewed by an F&O closure review team to verify closure through the NRC endorsed F&O Closure Review.

Page 12 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 07 EMIB/ESEB - [SPRA] RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review Finding-level F&O SFR-F3-01 in Attachment 3 of the LAR noted that the detailed fragility evaluation for dominant relay contributors should demonstrate that the seismic demand is an appropriate median-based response, and that the important uncertainties are included in obtaining log standard deviations. The closure review team recommended that the following be incorporated into the calculation to provide the basis for potential resolution and closure of the finding:

1. Justify the use of Best Estimate [BE] ISRS [in-structure response spectra] as the median. In our [closure review team]

opinion, the SSI [soil-structure interaction] analysis using BE soil properties, best estimate structure stiffness and a conservative estimate of best estimate structure damping results in a 84th percentile response.

2. The u associated with SSI is obtained using the BE, UB [upper bound] and LB [lower bound] [envelope] as the 84th and the BE alone as the median. Please explain the rationale that this results for the same building (Control Building) a wide range of SSI c from 0.09 to 0.22.

3. Explain why the uncertainties associated with structure stiffness and damping, time history simulation and earthquake component combination are ignored in the SOV [separation of variables) calculations.

The above closure team resolution recommendations appear to suggest that: (a) the ISRS, derived from the building SSI analysis, used as input for the seismic fragility evaluation of the equipment (relays in this case) may not be an appropriate median-centered response; and (b) that important uncertainties associated with the structure response may not have been included in the SOV calculations, such that the resulting equipment fragilities using the ISRS input are reasonably realistic.

Since fragility is the input to evaluate core damage frequency (CDF)/LERF the results of which are used for equipment categorization criterion, this finding may have the potential to impact the categorization results.

Describe the technical rationale for addressing the above closure review team recommendations that would justify that the building ISRS are an appropriate median response and that important uncertainties associated with the structure response were appropriately included, such that the resulting equipment fragility values are reasonably realistic. Alternatively, provide information that would demonstrate that the F&O will have no impact on the 10 CFR 50.69 categorization process results.

Page 13 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 07 Finding SFR-F3-01 has been addressed by a Westinghouse Electric Company seismic team per the recommendation provided by the F&O closure panel.

Subsequently, the completed resolutions will be evaluated in accordance with Attachment 1.

The technical rationale in response to the closure teams recommendations to be captured in the F&O closure process is summarized as follows:

1. Justification for use of BE soil, BE structure, and a conservative estimate of median structural damping as appropriate for median response at PVNGS:

a. Use of conservative estimate of median damping: The BE ISRS were judged appropriate as median input to fragility analysis because the building response is dominated by low-frequency soil-structure modes.

For these modes, the control building (CB) structural distortion is low compared to the rigid body motion resulting from soil compliance. As a result, seismic demand is not sensitive to structural damping. This is further justified by sensitivities demonstrating that applying higher levels of structural damping does not have a significant impact on response due to the relatively large amounts of soil damping due to the embedded structures on deep soil columns.

b. Use of BE properties (soil + structure) instead of averaging LB, BE, and UB properties for median demand: The approach taken is appropriate for the SPRA, specifically at PVNGS due to the stability of SSI results obtained. Soil stiffness variability, which at PVNGS dominates overall variability in response over structural stiffness variability, was determined by varying shear modulus by Cv per American Society of Civil Engineers (ASCE) 4-98, Seismic Analysis of Safety-related Nuclear Structures. Response analyses varying soil properties with BE structural stiffness and conservative median damping were run for one set of artificial time histories (with variability due to time history generation accounted for in the SOV calculation). The resulting SSI response analyses were reviewed and determined to be stable and without considerable deficiencies to conclude that the BE soil property SSI run appropriately represented the best estimate of median demand.

While an increasing number of recent SPRA response analyses may average LB, BE, and UB properties, this may be indicative of more complex response analyses with the probabilistic soil uncertainty evaluation and 5 sets of time histories. The resulting SSI response may not be stable, and averaging may be appropriate for median demand. It is noted that neither EPRI TR-103959, Methodology for Developing Seismic Fragilities, June 1994, EPRI NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin, Revision 1, nor EPRI 1019200, Seismic Fragility Applications Guide Update, December 2009 stipulate the use of response averaging to obtain median demand.

Page 14 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

2. The u associated with SSI varying for components in the same building (SSI c from 0.09 to 0.22 in the Control Building) is justified since the SSI uncertainty was directly computed by the location-specific component response. The components analyzed include items located at a low elevation of the control building (CB) (Elevation 100) where the demand contribution from the ground motion component of the total seismic motion is high. The ground motion component is independent from SSI and it is reasonable to expect that an item located at a low elevation will have a relatively low u value for SSI uncertainty, as was determined in the analysis.

3. The uncertainties associated with structure stiffness and damping, as well as time history simulation were updated for SOV calculations due to information from sensitivity studies.

By evaluating the PVNGS response to F&O SFR-F3-01, as summarized above, through a subsequent F&O closure process prior to 50.69 program implementation, PVNGS will demonstrate that the ISRS derived from SSI analysis are appropriate for median-centered response and that important uncertainties associated with structure response are included in SOV calculations, resulting in reasonably realistic equipment fragilities.

Page 15 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 08 RGS - [SPRA] RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review In Attachment 3 of the LAR, finding-level F&O SHA-E2-01 included a recommendation for the licensee to [d]emonstrate that the updated set of soil

[peak ground acceleration (PGA)] hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil [PGA] hazard curves used in the Seismic PRA model. If the updated set of soil [PGA] hazard curves is greater than those used in the Seismic PRA model, the impact on Seismic risk quantification should be assessed. This discussion indicates that the current version of the SPRA is based on a seismic hazard study performed prior to the 2015 study evaluated by the NRC staff as part of its 10 CFR 50.54(f) review (ADAMS Accession Nos. ML15076A073 and ML16221A604) and that the updated seismic hazard curves will be incorporated in a PRA update. Finding level F&O SHA-E2-01 states, in part, it is not clear if the seismic risk quantification using the [PGA] hazard curves from LCI [LCI Report 2211-PR-07-Rev. 4, Seismic Hazards Evaluation for Palo Verde Nuclear Generating Station] (2013) is appropriate.

Provide a comparison (e.g., a graph or table) of the seismic hazard currently used in performing the SPRA (LCI 2013) with the updated seismic hazard curves (LCI 2015b) to be incorporated in a PRA update. In addition, please provide a description of how fragility analyses performed using the 2013 seismic hazard curves will be reconciled with the updated seismic hazard. Alternatively, demonstrate that the F&O will have no impact to the 10 CFR 50.69 categorization process results.

APS Response to RAI 08 Finding SHA-E2-01 is currently being addressed per the recommendation provided by the F&O closure review team. The 2015 hazard developed for the 50.54(f) response is being used to update the SPRA, thus addressing the recommendation provided by the F&O closure panel. The completed resolutions will be resolved in accordance with Attachment 1.

Figure 8.1 shows a comparison between the 2013 uniform hazard response spectra (UHRS) [i.e., the Senior Seismic Hazard Analysis Committee (SSHAC) Level 2 hazard study] and the 2015 update (i.e., the SSHAC Level 3 study), which represent the old and updated input to the fragility analysis respectively. Figure 8.2 shows the comparison of the associated peak ground acceleration (PGA) hazard curves used for the SPRA quantification.

To support a full re-quantification of the SPRA, the hazard developed for the Near Term Task Force (NTTF) 2.1 in 2015 was post-processed to extract the needed uncertainty information. In particular, the 2015 seismic hazard was post-processed to obtain a suite of approximately 100 discrete total mean hazard curves with associated weighting factors, consistent with what was performed in support of the SPRA quantification for the 2013 hazard curves.

A scaling analysis of the fragility parameters developed in 2013 to make them consistent with the updated hazard is complete. As can be noted in Figure 8.1, the Page 16 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 energy content of the 2015 spectra is lower than the 2013 spectra in the low frequency range (i.e., lower than 2Hz). As a number of important fragilities for the PVNGS SPRA are sensitive to low frequency energy content, such decrease resulted in an overall improvement of the fragility data for the PVNGS SPRA.

The updated fragility values and the 2015 hazard or spectra are currently being used for an updated quantification of the SPRA. The quantification will be documented in the updated quantification notebook, CN-RAM-12-22, Palo Verde Seismic Probabilistic Risk Assessment - Quantification. See Figures 8-1 and 8-2.

UHRS Comparison Figure 8-1 Page 17 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 PGA hazard curves comparison Figure 8-2 Page 18 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 09 APLA(B) RAI 09 - RG 1.200, Revision 2, PRA Acceptability, PRA Upgrades Identified in F&O Closure Review Report Section 3.3 of the LAR states, in part, that [a]ll PRA upgrades (as defined by the ASME PRA Standard RA-Sa-2009) implemented since conduct of the CEOG peer review in 1999 have been peer reviewed. The LAR indicated that one full-scope peer review was performed on the IEPRA model in July 1999, Internal Flooding PRA (IFPRA) (2010), SPRA (2013), Fire PRA (FPRA) (2012 and 2014). The NRC staff requests that the licensee provide the following additional information to enable the NRC staff to evaluate if the guidance provided in RG 1.200, Revision 2, regarding PRA upgrades was followed:

a. Describe the changes made to the IEPRA since the full-scope peer review was conducted in 1999, including any changes that would impact the modeling framework for the PRA, such as converting the PRA to a one-top fault tree across all the PRA hazards. Provide the dates for when each change occurred. This description should be of sufficient detail for the NRC to determine whether the changes are considered PRA maintenance or PRA upgrades as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2. Include in your discussion: (1) any new methodologies (i.e., summarize the original method in the PRA and the new method); (2) changes in scope that impact the significant accident sequences or the significant accident progression sequences; (3) changes in capability that impact the significant accident sequences or the significant accident progression sequences.

b. For each change described in Part a above, indicate whether the determination for the change was PRA maintenance or a PRA upgrade as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2, along with justification for the determination.

c. Discuss any focused scope (or full-scope) peer reviews that have been performed for the PRA upgrades identified in Part b above, providing the timeline of when the peer reviews were performed and when the peer review reports were approved. For each upgrade identified, either:

i. Provide the findings of the peer review(s) performed on the upgrade and the disposition of the findings as it pertains to the impact on the 10 CFR 50.69 application, OR, ii. Confirm that the resulting F&Os from the peer review(s) on the upgrade were assessed in the F&O closure review in June 2017.

d. Describe the changes that have been made to the IFPRA, SPRA, and FPRA since their respective peer reviews on November 2010, February 2013, and December 2012, and December 2014, respectively. Provide information commensurate with that requested for the IEPRA in Parts (a), (b), and (c) which indicate and justify the determination of whether the changes were maintenance or an upgrade and, if an upgrade, provide information to support a technical acceptability determination.

Page 19 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 09 As requested, changes made to the Palo Verde Internal Events PRA, Internal Flooding PRA, Seismic PRA, Fire PRA, and External Events PRA since their respective peer reviews have been identified, documented, classified and justified as PRA maintenance or PRA Upgrade.

a. Changes made to the Palo Verde internal events PRA model since the 1999 Internal Events PRA Peer Review have been collected and documented in Engineering Evaluation EWR 18-00619-003. This evaluation provides details of the PRA model changes captured in the PRA Impact Database and F&O Resolution reports along with the date each change occurred. See Attachment 2, Table 2-1 for a listing of the significant changes made to the Palo Verde Internal Events PRA model.

b. As documented in EWR 18-00619-003, each PRA model change was reviewed against the PRA Maintenance or PRA Upgrade definitions provided in ASME/ANS RA-SA-2009 with consideration of the qualifications and clarifications provided in Regulatory Guide 1.200, Revision 2. See Attachment 2, Table 2-1, for a listing of the significant changes made to the Palo Verde Internal Events PRA model along with their classification and associated Basis.

Justifications for the assessment of a change being a PRA Upgrade included new methodologies, changes in scope impacting significant accident sequences or the significant accident progression sequences or changes in capability impacting significant accident sequences or the significant accident progression sequences.

Justifications for determining changes as PRA maintenance included specific reference to sections and PRA Maintenance examples provided in ASME/ANS PRA Standard Nonmandatory Appendix 1-A.

The majority of the changes were assessed to be PRA maintenance activities.

This included the conversion of the Risk Spectrum PRA model to CAFTA and development of the one top logic fault tree. With respect to the CAFTA software conversion, ASME Standard RA-Sa-2009 Appendix 1-A, section 1-A.3 Classification of PRA Changes, Example 11 clearly states that changing from fault tree linking code to another for quantification of sequences is classified as PRA Maintenance. All the items listed in the rationale provided for Example 11 being considered maintenance are met for the conversion from Risk Spectrum to CAFTA. Both codes use the same linked fault tree codes and are both well accepted in the PRA community. The conversion of the PVNGS Internal Events PRA model is well documented and includes disposition of code differences. In addition, in-depth reviews of cutsets from both codes were performed, as well as review of truncation, recoveries, importances, and resolution of modeling differences. The documented review also included comparison of results with various plant configurations of significant components out of service. Therefore, this change was determined to be PRA maintenance. Likewise, the one top logic fault tree developed for the risk-informed 10 CFR 50.69 application is also considered maintenance. Each hazard model placed under the single top fault tree has been peer reviewed against RG 1.200, Rev 2. The top gate of the fault tree acts as a simple OR gate allowing solution of individual hazards by solving a lower gate or all hazards together by solving the top gate. The same peer-Page 20 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 reviewed fault tree modeling methodology is used. The same basic events are used with appropriate overrides for hazard-specific operator actions. Resulting cutsets from the combined hazard model were compared to the individual hazard models and documented as part of the software quality assurance data qualification process for the Phoenix software. For these reasons, this change was determined to be PRA maintenance as well.

Attachment 2, Table 2-3 provides those Internal Events PRA changes that were determined to be PRA Upgrades.

c. Attachment 2, Table 2-4 provides the Internal Events PRA upgrades identified in Part (b) above. For each upgrade, the specific peer review evaluating the upgrade, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings, closure, etc.) are provided. It is noted that if an identified upgrade has not undergone a peer review, it will be included in the Focused scope Peer Review planned to be conducted as described in Attachment 1.

d. As documented in EWR 18-00619-003, the same process described in Parts (a) and (b) above was applied to the changes made to the Internal Flooding PRA, Seismic PRA, and Fire PRA since their respective peer reviews. Attachment 2, Table 2-5 provides those changes that were determined to be PRA Upgrades.

See Attachment 2, Table 2-2 for a listing of the significant changes made to the Palo Verde Internal Flooding, Seismic, and Fire PRA models.

Attachment 2, Table 2-6 provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings, closure, etc.). It is noted that if an identified upgrade has not undergone a peer review, it will be included in the Focused scope and augmented F&O Closure Peer Review planned to be conducted as described in Attachment 1.

As noted in Attachment 2, Table 2-6, a number of findings resulted from the review of the identified upgrades. New F&Os QLS-A1-01[14FS], PRM-A3-01[14FS], and FSS-D2-01[14FS] were received. Of these, only one, FSS-D2-01, was included in the 2017 F&O Closure Review which determined that this F&O was closed and SR FSS-D2 was met. The remaining findings will be verified closed and the Fire PRA SRs CS-C4 and ES-B3 will be reviewed by an augmented F&O closure review, as described in Attachment 1. Therefore, the disposition of these F&Os for Internal Fires and Seismic will have no impact on the risk-informed 10 CFR 50.69 application.

In summary, after reviewing all changes made to the PRA models, APS has identified four PRA model upgrades that will be reviewed in an upcoming focused scope peer review. The resolutions to any existing open F&O findings and any new F&O findings resulting from the upcoming focused scope peer review of upgrades will be resolved prior to implementation of the 10 CFR 50.69 applications, as described in Attachment 1.

Page 21 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 10 APLB - RG 1.200, Revision 2, PRA Acceptability, Key Assumptions and Key Sources of Uncertainty Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, states, in part, that [f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application. Further, RG 1.200, Revision 2, Section 4.2, Licensee Submittal Documentation, states, in part, that

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. RG 1.200, Revision 2, Section 3.3.2, defines the terms key assumption and key source of uncertainty.

Section 3.2.7, PRA Uncertainty Evaluations, of the LAR states, in part, that [t]he list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application These key assumptions and sources of uncertainty reviewed were previously submitted to the NRC in the application dated July 31, 2015. (ADAMS Accession No. ML15218A300).

a. Describe the approach used to identify and characterize the key assumptions and key sources of uncertainty in the SPRA for this application.

i. Discuss (1) whether all assumptions and sources of uncertainty (including relevant methods) related to all aspects of the models (e.g.,

hazard, fragility, and plant response analysis for the SPRA) were evaluated to determine whether they were key; and (2) the criteria that were used to determine whether the modeling assumptions and sources of uncertainty were considered key.

ii. Discuss whether any approaches or models were determined to be a consensus approach or model for the purposes of identifying the key assumptions and key sources of uncertainty. If a consensus model was used, discuss whether the determination was made in accordance with the guidance in NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking (ADAMS Accession No. ML090970525), which indicates that for risk-informed regulatory decisions, the consensus model approach is one that NRC has used or accepted for the specific risk-informed application for which it is proposed.

b. Describe each key assumption and key source of uncertainty identified in the SPRA. Provide this in sufficient detail to enable the NRC staff to identify whether the key assumptions and key sources of uncertainty used in the SPRA involve any changes to industry consensus approaches.

Page 22 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

c. Discuss how each key assumption and key source of uncertainty identified above was dispositioned for this application. If available, provide the results of any sensitivity studies that will be used to support the disposition for this application or use a qualitative discussion to justify why different reasonable alternative assumptions would not affect this application.

APS Response to RAI 10 a.i. During the development of the SPRA model, the assumptions and sources of uncertainty related to aspects of the model were reviewed to determine whether they were key and they were documented as such in the SPRA reports. Those that were determined to be key met the following criteria in NRC RG 1.174, Revision 2:

...when it could impact the PRA results that are being used in a decision, and consequently, may influence the decision being made.

Sources of model uncertainty and assumptions have been identified using the guidance of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making.

a.ii. Methods used in the development of the different elements of PVNGS SPRA (i.e., hazard, fragility and plant response modeling) are documented and summarized in the relevant documentation and are established methods used in multiple SPRAs in the industry. No specific deviations have been made from these established methods, which can be considered consensus methods in the industry.

1) The Hazard assessment addresses assumptions and associated uncertainties explicitly in the SSHAC process and in the resulting probabilistic seismic hazard analysis (PSHA) calculation.

Epistemic uncertainties are therefore quantitatively translated in the spread of a full family of hazard curves with associated weight factors (96 individual hazard curves have been developed from the entire PSHA decision tree). No specific assumption has been identified in the hazard assessment that required a specific sensitivity in the final quantification of the SPRA. The final quantification of the SPRA used all 96 curves for the final SPRA uncertainty assessment for both CDF and LERF.

The technique used for the uncertainty propagation in the PVNGS SPRA allowed for a decomposition of the uncertainties between hazard, fragility, and system.

2) In the final quantification of the SPRA, two sensitivities were run to address the importance of fragility-related modeling assumptions, one addressing the fragility of the non-safety auxiliary feedwater (AFN) pump, and one addressing the impact of surrogate fragilities. In both cases, the model showed little sensitivity to these modeling assumptions.

Page 23 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

3) The plant response analysis including seismic modifications to the HRA follows established methods, mainly documented in the Electric Power Research Institute (EPRI) SPRA Implementation Guidance or the EPRI SPRA Surry report. Key assumptions associated with the modeling of the plant response are identified during the development of the analysis and are then summarized and documented in Section 4.4 of the SPRA modeling notebook (i.e., CN-RAM-12-15, Palo Verde Seismic Probabilistic Risk Assessment - Model Development, Revision 1) and in Section 4.4 of the Seismic HRA notebook (i.e., CN-RAM-12-24, Palo Verde Seismic PRA - Human Reliability Analysis, Revision 2). Those assumptions are then re-addressed for their potential modeling uncertainties and ad-hoc sensitivities are performed when suitable modeling alternatives are available.

b. The following major assumptions are adopted in the development of the PVNGS SPRA and are consistent with the general guidance discussed in the above mentioned established methods:

i. During the SPRA analysis, major assumptions associated with success criteria (on a system and sequence basis) are reviewed to identify potential inconsistencies with a seismically induced accident. If not otherwise specified, the success criteria associated with the IEPRA logic are considered valid and applicable to accident sequences initiated by a seismic event. This assumption implies that all the success criteria runs performed in support of the internal events accident sequences are applicable and are not replicated for the SPRA.

A significant limitation of this assumption concerns the potentially different mission time of the SPRA, compared with an IEPRA. Explicit discussion on this topic is presented in Section 5.1 of the modeling notebook (CN-RAM-12-15) and a dedicated sensitivity case is performed to address the epistemic uncertainties associated with this assumption in the quantification notebook (CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1). This reflects an industry consensus approach for SPRAs.

ii. Seismic failures are assumed to be completely correlated. This assumption implies that a single basic event is used to model the seismic failure of components that are identified as pertaining to the same fragility group by the fragility team. The validity of the assumption of complete correlation is still being discussed at the industry level. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

One significant exception to this general assumption is where failures in the steam path in the turbine building are not considered correlated with failures of the feedwater lines.

iii. The seismically induced Loss of Offsite Power (LOOP) is assumed to bound the fragility of non-seismic class systems. This assumption implies that a number of non-seismic class systems are not addressed Page 24 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 with a specific seismic failure. The basis for this assumption is that seismically induced LOOP has a generally low seismic capacity.

Scenarios where the non-seismic support systems include seismically induced failures while offsite power is still available are considered realistic only for a very low magnitude seismic event. Some exceptions include the instrument air (IA) system and the station blackout generator (SBOG), for which system specific fragility considerations are made. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

iv. The PVNGS IEPRA credits recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after a LOOP. In the PVNGS SPRA, LOOP recovery is not credited for any seismic event above the safe shutdown earthquake (SSE), while it is credited with unchanged probability for a seismic event below the SSE. This assumption is based on the consideration that it is realistic to consider that offsite power recovery is available for low magnitude seismic event. As the magnitude of a seismic event increases, the recovery time is expected to increase (i.e., probability of recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> decreases). The potential to recover is lost for longer time frames (potentially over 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) for larger magnitude events. The selection of the SSE as a threshold between recovery/no-recovery of offsite power is arbitrary.

v. Screening of equipment in the Seismic Equipment List (SEL) is based on fragility analysis. Equipment screened by the fragility team as inherently rugged is not modeled in the SPRA for their seismic induced failure. In order to quantitatively capture the impact of screened out equipment, the fragility team provided generic fragility values for screened out equipment on a location basis (i.e., fragility parameters based on building). The screened equipment is then not explicitly modeled but rather modeled through surrogate basic events at a system level that address seismic induced failure of a system due to a combination of seismic failures of equipment within the system. A sensitivity case is explicitly discussed to address the impact of this modeling approach.

vi. It is assumed that the operators will always trip the reactor in case of a seismic event above the Operating Basis Earthquake (OBE) even if plant procedures allow for the option of a controlled shutdown. This is considered a conservative assumption although it is not expected to have a significant impact on the overall risk profile of the plant. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

vii. Assumption #4 in Section 6 of the fragility analysis report (11C4043-RPT-003, Seismic Fragility Analysis of PVNGS Unit 1 Structures, Systems and Components, Revision 1) states that AFN pump is assumed to remain functional with small leaks in instrument lines. The listed AFN pump fragility does not include instrument line failure as the fragility analysis did not address the entire flow path for the AFN Page 25 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 pump. Nevertheless, tubing to flow transmitters was found to be vulnerable to seismic motion and interaction. A tube break could not be ruled out and is a potential low capacity failure mode (small break leak). Following the recommendation of the fragility analysis report (11C4043-RPT-003 Rev. 1), the uncertainty associated with this assumption is addressed through a sensitivity case in the quantification notebook (CN-RAM-12-022) that changes the fragility parameters of the AFN pump into the same fragility values used for the system level fragility for the IA system.

viii. Main steam line relief valves have not been explicitly included in the SEL but are nevertheless screened out by the analysis on the basis that the steam generator and related piping & valves are normally considered very rugged. For this reason the seismic failure of the relief valve is not modeled (this assumption has been supported by a discussion with the fragility team). A sensitivity case was developed to assess the impact of this assumption. In the sensitivity case, a fully dependent seismic failure across all 20 relief valves is modeled with a fragility dataset given per the screened out equipment in the Main Steam Support Structure (MSSS) (11C4043-RPT-003 Rev.1).

ix. Structural failures of buildings are assumed to result in major collapse and failure of all equipment housed inside the building (e.g., structural failure of containment will result in failure of reactor coolant system (RCS) lines, structural failure of auxiliary building will result in failure of all pumps and valves in the structure, structural failure of the MSSS will result in failure of all pumps and valves in the structure, structural failure of the control building will result in failure of all cabinets, etc.).

This is a conservative assumption since the fragility parameters provided are addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The level of detail in the fragility analysis of the building does not allow for crediting partial failure and therefore all equipment in the building is assumed lost. A similar consideration is made for the soil failure underneath the buildings.

The most significant example of this assumption is the structural failure of the turbine building assumed to be also impacting and failing the condensate storage tank (CST) tunnel.

There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. A more refined fragility analysis of the structures can be done to reduce this conservatism, although this is currently not within the scope of the analysis.

x. The anticipated transient without scram (ATWS) logic for seismic PRA assumes that the RCS pressure will be above the high pressure safety injection (HPSI) shutoff head for only a short period of time. In this case, injection following the pressure decrease is expected to be sufficient to provide inventory and boron. The assumption is needed Page 26 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 because all ATWS event trees show that, given success of steam generator (SG) heat removal and failure of the pressurizer safety valve (PSV) to reseat, high pressure injection and high pressure recirculation is sufficient to terminate the transient successfully. However, depending on the moderator temperature coefficient (MTC) and other parameters, the RCS pressure may exceed the HPSI pump shutoff head for a sufficient period of time to lead to core damage before the pressure drops below the shutoff head. This is expected to be the case for a short period of time early in core life, i.e., the success criteria for injection cannot be met because the RCS pressure will be well above the shutoff head for the HPSI pumps. If the high pressure endures for long enough, core damage is guaranteed and vessel failure will occur at high pressure. MTC and ATWS pressure transient are not influenced by the fact that the event is initiated by a seismic event rather than a spurious failure and therefore the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. This is a specific case of the more generic Assumption i. above. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

xi. Accessibility for completion of non-screened human failure event (HFE) actions during a seismic event is assumed possible for all non-screened HFEs besides those which are assumed to fail in the case where the corridor building or turbine building (east) collapses (i.e.,

CN-RAM-12-24). Non-accessibility to equipment in the field would likely result in the associated human error probability (HEP) being set to 1.0; a sensitivity case is developed in the quantification notebook (CN-RAM-12-022) that sets all the HEP to 1.0. Such a sensitivity case is used to address the impact of this assumption on the PVNGS SPRA model.

xii. In the consideration of seismic-induced floods, it is assumed that the seismic performance shaping factors (PSFs) applied to the internal events HEPs will override the flooding PSFs, based on the consideration that the seismic events are more global events than the specific flooding events (i.e., CN-RAM-12-24). There are no specific sensitivity cases that have been designed in the quantification notebook (CN-RAM-12-022) that address the epistemic uncertainty of this assumption.

xiii. The SPRA dependency analysis assumes that once an accident sequence is initiated, the operator action timing for a seismically induced event is similar to that of an internally induced event for main control room actions. The combinations are qualitatively assessed to ensure sufficient time is available to account for operators potentially requiring extra time to navigate through the plant following a seismic event. The modification of the timing available due to seismic considerations may result in a longer response or identification time and consequentially a higher HEP. A specific sensitivity analysis on this has not been defined; the sensitivity analysis which sets HEPs to 1.0 Page 27 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 (see Assumption xi. above), is bounding but it does not reflect an increase to specific individual HEPs which reflect timing available changes due to seismic considerations.

xiv. The weighting factors applied to the three approaches, specified in Section 4.3.2.4 of the Seismic HRA notebook (i.e., CN-RAM-12-24),

assume Surry to be the most accepted and applicable approach due to Surry being the most recent approach of the three implemented in this analysis. A specific sensitivity analysis that adjusts the weighting factors applied to the three approaches is documented in the quantification notebook (CN-RAM-12-022).

c. The Attachment 3, Table 3-1 describes the disposition of key assumptions and sources of uncertainty identified in the SPRA.

Page 28 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 11 APLA(B) - Overall Categorization Process Section 3.1.1, Overall Categorization Process, of the LAR has two different sets of bulleted elements and concludes with an additional list of ten elements. The elements discuss: training that will be provided, the different hazard models, and PRA model results. However, it is not clear to the NRC staff what the sequence of evaluations will be in the categorization process, what information will be developed and used, and what guidance on acceptable decisions by the Integrated Decision-Making Panel (IDP) will be followed during the categorization of each system.

a. Summarize, in the order they will be performed, the sequence of elements or steps that will be followed to categorize a respective system. A flow chart, such as that provided in the NEI presentation (ADAMS Accession No. ML17249A072) for the September 6, 2017, public meeting with NEI regarding 10 CFR 50.69 LARs (ADAMS Accession No. ML17265A020), may be provided instead of a description. The steps should include:

i. The input from all PRA evaluations such as use of the results from the internal events, internal flooding, seismic, and fire PRAs; ii. The input from non-PRA approaches (other external events, and shutdown);

iii. The input from the responses to the seven qualitative questions in NEI 00-04, Section 9.2; iv. The input from the defense-in-depth (DID) matrix;

v. The input from the passive categorization methodology.

b. Clarify the difference between preliminary high safety significant (HSS) and assigned HSS and identify, which inputs can, and which cannot, be changed from preliminary HSS to low safety significant (LSS) by the IDP. Confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance (ADAMS Accession No. ML061090627).

c. Clarify, which steps of the process are performed at the function level and which steps are performed at the component level. Describe how the categorization of the component impacts the categorization of the function, and vice-versa. Describe any instances in which the final safety significance of the function would differ from the safety significance of the component(s) that support the function, and confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1.

d. Section 7.1, Engineering Categorization, of Section 7, Preliminary Engineering Categorization of Functions, of NEI 00-04, states, in part, that if any SSC is safety significant, from either the PRA-based component safety significance assessment (Section 5) or the defense-in-depth assessment (Section 6), then the associated system function is preliminary safety significant. Describe whether your categorization process is consistent with Page 29 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 or differs from the guidance in NEI 00-04, Section 7, where functions supported by any HSS component(s) will be assigned as HSS. If the licensees categorization process differs from the guidance in Section 7 of NEI 00-04 cited above where functions supported by any HSS component(s) will be assigned HSS, justify the approach.

e. Section 9.2.2, Review of Safety Related Low Safety-Significant Functions/SSCs, of NEI 00-04, which is performed by the IDP, states, in part, in making their assessment, the IDP should consider the impact of loss of the function/SSC against the remaining capability to perform the basic safety functions. This section also provides seven specific questions that should be considered by the IDP for making the final determination of the safety-significance for each function/SSC. However, it is unclear in the LAR how the IDP will collectively assess these seven specific questions. For example, is a function/SSC considered HSS when the answer to any one question is false (e.g., failure of the function/SSC will directly cause an initiating event or adversely affect the DID remaining to perform the function). Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS.

f. Section 7.1 of NEI 00-04, states, in part, [d]ue to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC or part thereof should be assigned the highest risk significance for any function that the SSC or part thereof supports. Clarify at what point during the licensees risk categorization process will assessment of the risk significance of SSCs that support multiple functions be identified to ensure they are assigned the highest risk significance given all SSCs that may overlap, may not be categorized.

g. The industry flow chart presented at the September 6, 2017, public meeting, shows that the passive categorization would be undertaken separately from the active categorization. Furthermore, in the LAR Section 3.1.2, Passive Categorization Process, the licensee states, in part, that [p]assive components and the passive function of active components will be evaluated using the Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the Safety Evaluation (SE) by the Office of Nuclear Reactor Regulation for Arkansas Nuclear One, Unit 2, regarding their Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, dated April 22, 2009 [ADAMS Accession No. ML090930246]. The NRC staff notes that this methodology has been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequence of pressure boundary failure for Class 1 SSCs may be different than for Class 2 and Class 3, and therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

The LAR does not justify how the ANO-2 methodology can be applied to Class 1 SSCs and how sufficient DID and safety margins are maintained. A Page 30 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 technical justification for Class 1 SSCs should address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: justification of the appropriateness of the conditional core damage probability (CCDP) numerical criteria used to assign High, Medium, and Low safety significance to these loss-of-coolant initiating events; identification and justification of the adequacy of the additional qualitative considerations to assign Medium safety significance (based on the CCDP) to High safety significance; justification for crediting operator actions for success and failure of pressure boundary; guidelines and justification for selecting the appropriate break size (e.g. double ended guillotine break or smaller break); and include supporting examples of types of Class 1 SSCs that would be assigned low safety significance, etc.

As mentioned in the meeting summary from the February 20, 2018, Risk-Informed Steering Committee (RISC) meeting (ADAMS Accession No. ML18072A301), the NRC staff understands that the industry is planning to limit the scope to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle license amendment (ADAMS Accession No. ML14237A034).

Please provide the requested technical justification, or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 equipment.

APS Response to RAI 11 a) The process to categorize each system will be consistent with the guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by RG 1.201. RG 1.201 states that:

the implementation of all processes described in NEI 00-04 (i.e.,

Sections 2 through 12) is integral to providing reasonable confidence and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by

§50.69(c)(1)(iv).

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible, and as long as they are all completed, they may even be performed in parallel. Note that NEI 00-04 only requires Item 3 to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires Item 4 to be completed for safety related active components/functions categorized as LSS by all other elements.

1. PRA-based evaluations (e.g., the internal events, internal flooding, and fire PRAs)

Page 31 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

2. Non-PRA approaches (e.g., seismic safe shutdown equipment list (SSEL), other external events screening, and shutdown assessment)

3. Seven qualitative criteria in Section 9.2 of NEI 00-04

4. The defense-in-depth assessment

5. The passive categorization methodology Figure 11-1 is an example of the major steps of the categorization process described in NEI 00-04:

Categorization Process Overview Figure 11-1 b) Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., HSS or LSS) that is presented to the Integrated Decision-Making Panel (IDP). Note: the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Attachment 4, Table 4-1. The safety significance determination of each element, identified above in Figure 11-1, is independent of each other and therefore the sequence of the elements does not impact the resulting preliminary categorization of each component or function.

Page 32 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04, Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however, the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Attachment 4, Table 4-1, summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in Attachment 4, Table 4-1. A component is assigned its final RISC category upon approval by the IDP.

c) The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal Events PRA or Integrated PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04, Section 10.2, allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with an HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g. Passive, Non-PRA-modeled hazards). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped. Therefore, if an HSS component is mapped to an LSS function, that component will remain HSS. If an LSS component is mapped to an HSS function, that component may be driven to HSS based on Attachment 4, Table 4-1 or may remain LSS.

d) NEI 00-04, Section 5, defines categorization process considerations for both PRA-based and non-PRA-based (i.e., deterministic) assessment methods. Section 5.3, for example, describes the process for categorization from seismic risk considerations using either a seismic PRA (i.e., PRA-based) or using a seismic margin assessment (SMA), i.e.,

deterministic and not PRA-based. Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5 but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5. The interpretation of this requirement is further clarified in the Vogtle SER (ML14237A034) which states:

Page 33 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.

The reason for this is that the application of non-PRA based assessments results in the default safety significance categorization of any SSCs associated with the safe shutdown success paths defined in those deterministic assessments to be HSS regardless of its risk significance.

Therefore, there is no risk basis for assigning the SSC associated functions to be HSS, since the deterministic analyses from which the associated safe shutdown equipment lists are derived do not define functions equivalent to those used in the categorization process. This is the reason that the guidance in NEI 00-04, Section 7, clearly notes PRA-based in reference to NEI 00-04, Section 5. The categorization process is consistent with the guidance in NEI 00-04 as endorsed by RG 1.201.

If the results of the passive categorization are HSS, then the SSC is categorized as preliminary HSS regardless of the other categorization elements. An HSS determination by the passive categorization process cannot be changed by the IDP.

e) The assessment of the seven Qualitative Considerations is agreed upon by the IDP in accordance with NEI 00-04, Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration. However, the final assessments of the seven qualitative considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all of the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The system categorization document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e. all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification for each consideration or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

Page 34 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 f) During the Qualitative Risk Assessment of SSCs, the cognizant PRA Engineer assigns the component an initial qualitative risk based on the highest risk of any function supported by that component. For example, if the component supports two functions, one being HSS and the other LSS, the component would be assigned an initial qualitative risk of HSS.

g) APS confirms that it will apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 equipment.

Page 35 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 12 APLB - [SPRA] Overall Categorization Process Paragraph 50.69(c)(1)(iv) of 10 CFR requires that the categorization process include evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, and any potential increase in CDF and LERF resulting from changes in treatment are small. Paragraphs 50.69(e)(2) and (3) of 10 CFR require the licensee to monitor the performance of RISC-1 and RISC-2 SSCs and consider the data collected for RISC-3 SSCs and make adjustments to the categorization or treatment processes so that the categorization process and results are maintained valid.

Paragraph 50.69(b)(2)(iv) requires that each application includes a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The evaluations shall include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms from both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Section 8, Risk Sensitivity Study, of NEI 00-04, provides guidance on performing a risk sensitivity study to confirm that the categorization process results in acceptably small increases to CDF and LERF. An example is provided in the guidance to increase the unreliability of all preliminary LSS SSCs by a factor of 3 to 5, which appears to address random failures. No explicit discussion of seismic risk sensitivity studies is provided in the guidance.

The categorization of SSCs using the SPRA is dominated by structural failure modes which are dependent on the corresponding modeling inputs such as the dominant failure modes and fragility curves. These modeling inputs are derived using several parameters, including the SSC design, testing, and as-built installation, all of which can be impacted by alternative treatments.

Additionally, NEI 00-04, Section 5.3, Seismic Assessment, states that for SSCs screened out of the SPRA due to inherent seismic robustness, it is important that the inherent seismic robustness that allows them to be screened out of the SPRA is retained.

Based on the preceding discussion, it is unclear to the NRC staff how the required risk sensitivity study will be performed for categorization using the SPRA to meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv), and how the modeling inputs in the SPRA and those used for the risk sensitivity study continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e). Provide the following:

a. A description of the evaluations that will be performed to demonstrate conformance with 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv) for those SSCs that may be classified as RISC-3 based, in part, on SPRA results.

b. A justification of how the required evaluations described in response to Part a above meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

Page 36 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

c. A description of how it will be determined that the modeling inputs in the SPRA continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e).

APS Response to RAI 12

a. The SPRA retains all the random failures modeled in the underlying internal events model. Sensitivities associated with a potential increase of random failure due to LSS reclassification can be performed on the SPRA model consistently with the sensitivities to be performed in the internal events model. For components that do not have associated random failures, sensitivities will be implemented using the surrogate basic events as identified in APS response to RAI 13 APLB. APS will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with NEI 00-04.

b. The seismic fragility parameters will not be changed in the SPRA for equipment that are re-classified as LSS because the re-classification does not impact the characteristics that are driving the definition of the fragility parameters, namely:

• The seismic demand for individual components does not change based on the re-classification as the location of the equipment does not change, nor the building in which the component is housed.

• The inherent seismic capacity of the component does not change, even if structural, failure modes dominate random failure modes for the specific components:

• Spatial interaction. The spatial interaction challenge is not changed by the equipment re-categorization. If, for example, the driving failure mode for the fragility estimate of a component is the spatial interaction with a nearby block wall, the re-categorization of the component itself would not impact that fragility.

• Anchorage. Also in this case, if the anchorage configuration is not changed upon re-categorization, there is no change in that fragility value.

• Functional failure. If the fragility estimate is driven by functional failure, then it can also be argued that a component re-categorization does not, for example, make a relay more vulnerable to chatter. Note that the functional fragility estimates are largely based on experience data and equipment qualification and testing. The equipment qualification and testing is not affected by a component being subsequently re-categorized as LSS, and the experience database is ultimately relying on a pool of components that are largely not safety-related and for non-nuclear applications [e.g., the Seismic Qualification Utility Group (SQUG) database includes a large number of data associated with equipment that is similar to equipment used in nuclear Page 37 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 plants], and therefore individual equipment re-categorization would not impact those considerations either.

Rugged components were addressed via surrogate fragilities (see response to RAI 14 APLB).

In accordance with 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights, SPRA sensitivity evaluations will meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

c. The PRA configuration control (procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15) includes an assessment of impact of design changes on the seismic PRA. Since an LSS component is not eliminated from the PRA (and therefore from the SPRA as well), a design change that impacts an LSS component will be addressed as appropriate and if a design change requires revisiting the fragility estimates, then an update of the SPRA shall be planned based on the plant PRA update procedures.

Page 38 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 13 APLB - [SPRA] Overall Categorization Process The guidance in NEI 00-04, Sections 5.1, Internal Events Assessment, and 5.3, indicate that the categorization of SSCs, including that using the SPRA, should be based on importance measures and corresponding numerical criteria. Further, NEI 00-04, Section 5.6 discusses the integral assessment wherein the hazard specific importance measures are weighted by the hazards contribution to the plant risk. It is unclear how the integrated importance measures are calculated for certain SPRA basic events that may not align with basic events in other PRA models.

Describe and justify how the integrated importance measures are calculated for SPRA basic events that may not align with basic events in other PRA models.

Indicate how the resulting integrated importance measures will be used to assign the safety-significance of affected SSCs.

APS Response to RAI 13 The PRA one-top model will be used to solve structure, system, and component (SSC) importance measure values separately for each hazard (i.e., internal events, internal flooding, internal fire, and seismic) and then for the combined integrated model (all hazards). This process fully complies with NEI 00-04, 10 CFR 50.69 SSC Categorization, Revision 0.

The SPRA is built upon the internal events PRA and uses the same basic event naming except for the unique seismic failure modes found in the SPRA. The determination of importance measures for the SPRA will utilize the same process as for other hazards where the overall Fussell-Vesely (F-V) importance for each SSC will be the sum of all failure modes over all hazards, and the risk achievement worth (RAW) for each SSC will be the largest RAW of the SSC failure mode basic events over all hazards.

For components that have no dedicated basic event in a PRA model, the following steps will be performed in accordance with procedure 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights:

1. For the system selected for categorization, obtain a list of all non-modeled components in that system.

2. Review each component for the following:

• Failure mode

• Impact of such a failure on its supported mitigating function

• The PRA capability to support the impact of the non-modeled SSC on the supported mitigating function

3. Assign a surrogate basic event to that component if the components failure will noticeably degrade the systems mitigating function and the existence of any one of the following attributes:

Page 39 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• The system supports a modeled key safety function,

• Is a sub-component of the surrogate component,

• Is a supporting component to the modeled surrogate basic event,

• Is required to fulfill a human-operator action basic event,

• Can be approximately modeled with minimal conservatism

4. Retrieve the surrogate basic event importance measure value by one of the following approaches:

• Directly from existing PRA model results files

• Quantifying the configuration risk management program model Page 40 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 14 APLB - [SPRA] Overall Categorization Process NEI 00-04, Section 5.1 provides guidance on the use of importance measures for identifying the candidate safety significance of components during the categorization process. Based on the information provided in the LAR, the NRC staff could not determine how importance measures for identifying the candidate safety significance of components during the categorization process will be used.

Provide the following:

a. NEI 00-04, Section 5.1 states that in calculating the Fussel-Vesely (FV) risk importance measure, it is recommended that a CDF (or LERF) truncation level of five orders of magnitude below the baseline CDF (or LERF) value be used for linked fault tree PRAs and that the truncation level used should be sufficient to identify all functions with a risk achievement worth of greater than 2. Demonstrate the impact of the selected truncation level for the higher bins in the SPRA on the importance measure criteria and the categorization.

b. A description of how the selected screening level in the SPRA maintains consistency with the importance measure criteria in NEI 00-04 or justify any deviations from the guidance by using the selected screening level. This justification may include demonstration of the impact of the selected screening level in the SPRA on the importance measure criteria and the categorization of SSCs.

APS Response to RAI 14

a. The truncation study performed to confirm the stability of the model is discussed in Section 4.3.2 of the quantification notebook, CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision

1. Truncation studies are performed at different g-levels in the generation of the cutsets via CAFTA software that will be fed to SHIP software.

Truncation convergence is demonstrated at each g-level following the guidance in the ASME/ANS RA-Sa-2009 Standard for internal events PRA (i.e., less than 5% difference from the previous decade for the declared converged decade). Numerically, this is consistent with the NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, guidance of 5 orders of magnitude lower than the base case CDF/LERF for the lower g-level but it is closer to 3 orders of magnitude for the higher g-levels. In a seismic PRA, a more meaningful concept of model stability and convergence looks at the stability of the overall plant fragility curve [i.e., overall stability of the conditional core damage probability (CCDP) or conditional large early release probability (CLERP)] rather than to truncation convergence. In this perspective, truncation convergence at higher g-levels is less important because the CCDP is closer to 1.0 at higher g-levels. From the quantification notebook CN-RAM-12-022 one can conclude that the plant level CCDP and CLERP (i.e., the plant fragility curves for CDF and LERF) are stable at 1.0, which means that adding cutsets will not change the overall Page 41 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 results (as CCDP and CLERP cannot go above 1.0). In other words, at high g-levels the integration of the hazard and fragility only returns the hazard curve itself, and therefore additional cutsets not included in the solution because of truncation cannot change the results.

b. The PVNGS SPRA does not use any specific screening level. In other words, there is no quantitative threshold for dismissing a seismically induced failure. All the seismic failures for which seismic fragilities are calculated are included in the model, regardless of the calculated or estimated fragility value. Components that are screened out from an explicit fragility calculation are grouped into surrogate fragility events, one for each system.

An estimate for the surrogate fragilities is provided and is explicitly entered in the model as well. The presence of any surrogate fragility among the important risk contributors would indicate that the surrogate needs to be refined (for example, extracting components from the surrogate and generating specific fragilities). In the current quantification notebook CN-RAM-12-022, the highest ranking surrogate fragility, SF-ALTFW-SUR, is ranked 36th for F-V (overall F-V = 1.68E-03). Section 5.4.2 of CN-RAM 022 explicitly discusses a sensitivity case study associated with the currently modeled surrogate fragilities. Figure 5.4-1 CN-RAM-12-022 shows a comparison between the plant level CDF fragility curve and the surrogate fragilities that shows how the surrogate fragilities are currently significantly lower than the plant level fragility, which is an additional visual indication that they are not significant contributors to the current results.

Page 42 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 15 APLA - Disposition of Key Assumptions and Uncertainties for IE, IF, and FPRA as it pertains to 10 CFR 50.69 Categorization NEI 00-04, Section 5, Component Safety Significance Assessment, as endorsed by RG 1.201, Revision 1, stipulates use of sensitivity studies during the categorization process associated with the choice of specific models and assumptions, as discussed in RG 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (ADAMS Accession No. ML100910006).

Section 3.2.7 of the LAR explains that PRA model assumptions and sources of uncertainty have been identified for this application using guidance from NUREG-1855. Section 3.2.7 further states, in part:

Key PVNGS PRA model specific assumptions and sources of uncertainty for this application were evaluated and documented. These key assumptions and sources of uncertainty reviewed were previously submitted to the NRC in the application dated July 31, 2015 for risk-informed completion times.

The NRC staff found that the evaluation of the PRA model assumptions and sources of uncertainty in the licensees LAR dated July 31, 2015, were dispositioned in each case specifically for the risk-informed completion time (RICT) program. Some of these dispositions refer to an element of the RICT program, such as Risk Management Actions, which are not part of the risk categorization process. As such, the LAR associated with 10 CFR 50.69 does not present dispositions of how the PRA model assumptions and sources of uncertainty impact the risk categorization process.

The licensee stated that the conclusion of the review for this application is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for in the process of categorizing SSCs into risk-informed safety classifications. The licensee will include in the risk sensitivity study a sensitivity increasing all the seismic PRA human event failures (HEFs) derived from the IEPRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

Provide the technical justification to support the LAR conclusion that no additional sensitivity analyses are required to address model specific assumptions or sources of uncertainty except as indicated above (e.g., provide the key PRA modelling assumptions and sources of uncertainty for the internal events and fire events PRAs and disposition them explicitly for the risk categorization process).

Page 43 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 15 Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1.200, Revision 2, (Reference 1) and the ASME/ANS RA-Sa-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 2), have been identified for the P V N G S PRA models using the guidance of NUREG-1855 (Reference 3) and EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 4).

The detailed process of identifying, characterizing, and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups including fire events.

Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of risk categorization of SSCs.

If the PV NG S model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on risk categorization. Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application.

Key assumptions and sources of uncertainty for the 10 CFR 50.69 Program application are identified and dispositioned in Attachment 5, Table 5-1. The conclusion of this review is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for the following:

• In the process of categorizing SSCs into risk-informed safety classifications, APS will include in the risk sensitivity study a sensitivity increasing the unavailability of fast bus transfer by a factor of 3 to address the increase in risk during startup transformer maintenance for the 13.8 kV non-Class 1E Power System (NA) and 4.16 kV non-Class 1E Power System (NB).

Page 44 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 16 APLB - [SPRA] Sensitivity Studies Section 5.3 of NEI 00-04 indicates that components can be identified as being safety-significant following sensitivity studies. Section 5.3 also recommends the completion of several sensitivity studies, including any applicable sensitivity studies identified in the characterization of SPRA adequacy.

a. NEI 00-04, Table 5-4 identifies, among other SPRA sensitivity studies, any applicable sensitivity studies identified in the characterization of PRA adequacy.

i. Indicate whether the key assumptions and key sources of uncertainty (including relevant methods) have been evaluated to determine whether an additional SPRA sensitivity study will be performed in accordance with NEI 00-04, Section 5.3.

ii. Summarize the results of the evaluation discussed in Part (i), the process that will be performed to complete the evaluation discussed in Part (i), or a justification for not performing the evaluation discussed in Part (i).

b. The key assumptions and sources of uncertainties identified as part of the licensees submittal may change as SPRA model updates could affect the significance of those assumptions for this application or create new or different key assumptions or sources of uncertainties. Describe how your 10 CFR 50.69 program will continue to evaluate assumptions and sources of uncertainty when the SPRA model is updated in the future and subsequently incorporates key assumptions and key sources of uncertainty in sensitivity analysis that are performed consistent with the guidance in NEI 00-04.

APS Response to RAI 16

a. i. A review of key assumptions and sources of uncertainty for the 10 CFR 50.69 program application identified one sensitivity study to address the operator action timing for a seismically induced event.

a. ii. APS will perform a sensitivity study on the seismic PRA model by increasing all the seismic PRA HFEs. A factor of 3 will be applied to all HFEs since they are derived from the internal events PRA model. This sensitivity study will address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

b. Procedure 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights, will be used to implement the process of performing sensitivity studies and re-evaluating changes. Step 4.17 describes how initial sensitivity studies will be performed. Step 4.18 describes how the re-evaluation of sensitivity studies will be performed. Included in this step is an action to review the impact of the current categorization activity on previous categorization results. Step 4.19 describes performing PRA reviews to ensure the continued validity of categorization results. A substep Page 45 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 of 4.19 ensures that key assumptions and sources of uncertainty are evaluated after each SPRA update for impact on the 10 CFR 50.69 program sensitivity analyses and categorization.

Page 46 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 17 APLA - Other External Hazards Peer Review Section 3.3 of the LAR states that a full-scope external hazards screening peer review was performed in December 2011 in accordance with RG 1.200, Revision 2.

The LAR does not discuss the results from this external hazards screening peer review and does not state whether the F&O closure review in June 2017 addressed any findings from the external hazards screening peer review.

a. Clarify whether the finding-level F&Os, if any, from the December 2011 peer review of the external hazards screening process was encompassed in the scope of the June 2017 F&O closure review.

b. If finding-level F&Os from the December 2011 peer review of the external hazards screening process were not addressed in the June 2017 F&O closure review, provide these findings and the associated dispositions as it pertains to this application.

APS Response to RAI 17 The December 2011 other external hazards screening peer review identified three findings (see Attachment 6, Table 6-1). Two findings, EXT-D1-01 and EXT-D1-02, concerned five issues identified during the walkdown. The third finding, EXT-E2-01, concerned insufficient documentation of transportation accident and tornado missile impact. These findings were inadvertently excluded from the June 2017 F&O closure review. All these findings were resolved as indicated in Attachment 6, Table 6-1.

These three findings will be included and verified closed in an augmented F&O closure review, as described in Attachment 1.

Page 47 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 18 APLA - SSCs Categorization based on Other External Hazards NEI 00-04 provides guidance on including external events in the categorization of each SSC to be categorized. Fire and seismic hazards are discussed in Section 5.2 and 5.3 of NEI 00-04, respectively. All other hazards are discussed in Section 5.4, Assessment of Other External Hazards. Figure 5-6 in Section 5.4 illustrates the process that begins with the SSC selected for categorization and then proceeds through the flow chart for each external hazard. Figure 5-6 of NEI 00-04 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, it has to be further shown that if the component was removed, the screened scenario would not become unscreened.

NEI 00-04 explicitly states, in part, [i]f it can be shown that the component either did not participate in any screened scenarios or, even if credit for the component was removed, the screened scenario would not become unscreened, then it is considered a candidate for the low safety-significant category.

a. Identify the external hazards that will be evaluated according to the flow chart in NEI 00-04, Section 5.4, Figure 5-6.

b. Identify the external hazards for which all credited SSCs will be considered HSS.

c. Describe and justify any additional method(s) different from Parts a or b above, that will be used to evaluate individual SSCs against external hazards, and identify the hazards that will be evaluated with these methods.

d. Confirm that all external hazards not included in the categorization process from Parts a, b, or c above, will be considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

e. Attachment 4, External Hazards Screening, of the LAR indicates that the external flooding hazards are screened from consideration in the 10 CFR 50.69 process. Further comment for external flooding screening states, Plant design meets 1975 SRP [Standard Review Plan] requirements.

i. Identify what type of SSCs, if any, are credited in the screening of external flooding, such as passive or active features.

ii. If any SSCs are credited for screening of external flooding, then explain and justify how the guidance in Figure 5-6 of NEI 00-04 will apply to external flooding hazards.

f. The LAR states that extreme wind or tornado hazard is screened on the basis that the frequency of damage to the exposed components is estimated to be less than 1E-6/year. Further comments for screening extreme wind or tornado states the spray pond nozzles (not protected against missiles) have a bounding median risk less than 1E-07/year.

i. Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will be applied for this hazard. Specially, Figure 5-4 of NEI 00-04 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, it has to be further Page 48 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 shown that if the component was removed, the screened scenario would not become unscreened.

ii. Explain how the discussion in Part i above would be impacted by the current effort to assess tornado missile protection hazard in response to NRC Regulatory Issue Summary 2015-06, Tornado Missile Protection.

APS Response to RAI 18

a. The other external hazards that will be evaluated according to the flow chart in Figure 5-6 of NEI 00-04 are any hazards listed in Attachment 4 of the LAR, External Hazards Screening, that have not been screened following the process in the ASME/ANS PRA Standard, RA-Sa-2009.

For Palo Verde, all other external hazards (i.e., other than internal events, internal flood, internal fire, and seismic) have been screened as noted in the LAR. As part of the external hazard screening, an evaluation was performed to determine if there are components that participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart, these components would be considered HSS.

b. The statement, All SSCs credited in other IPEEE external hazards are considered HSS, was intended to be consistent with the flow chart in Figure 5-6 of NEI 00-04. There are no other external hazards that will be evaluated using a method other than that which is depicted in the flow chart.

c. There is no additional method(s) different from Part a or b above that will be used to evaluate individual SSCs against external hazards.

d. APS confirms external hazards not included in categorization process Part a, b, or c above are considered insignificant.

e. The basis for screening external flooding and extreme wind or tornado hazards in Attachment 4 of the LAR is discussed below.

i. The screening process followed the guidance in Figure 5-6 of NEI 00-

04. The screening process includes an evaluation of whether SSCs participate in screened scenarios and also considers whether, if credit for SSCs were removed relative to the hazard being evaluated, the hazard would then become unscreened. More specifically, for each external hazard in Attachment 4 of the LAR, an assessment was performed to determine if equipment (i.e., SSCs) is relied upon to mitigate a hazard based on the design basis and severe accident functions of the component. Such SSCs would be considered HSS.

ii. Engineering Study 13-NS-C111, Other External Hazards PRA, addresses external flooding. Based on the PVNGS design for flooding, the IPEEE judging the UFSAR Probable Maximum Precipitation (PMP) to be conservative, and recent maximum rainfalls lying significantly below the PMPs, external flooding is screened for PVNGS. As systems are categorized for 10 CFR 50.69, the components will be reviewed to Page 49 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 determine which design features for flooding may require a component to be HSS.

f. Spray pond nozzles and other features associated with the screened tornado missile hazard must remain HSS. APS has no plans to implement alternatives to the existing licensing basis treatment of tornado missile hazards for the spray ponds.

Page 50 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 19 APLA - Shutdown Risk Section 3.2.5, Low Power & Shutdown, of the LAR states the categorization process will use the shutdown safety management plan described in NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, dated December 1991 (ADAMS Accession No. ML14365A203) for categorization of safety significance related to low power and shutdown conditions. However, the LAR does not cite the other criteria specified in NEI 00-04, Section 5.5, Shutdown Safety Assessment, pertaining to low power shutdown events (i.e., DID attributes and failures that would initiate a shutdown event). Clarify and provide the basis for how the categorization of SSCs will be performed for low power and shutdown events, and how it is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1.

APS Response to RAI 19 APS will utilize a quantitative PRA model for categorization of at power events in plant Modes 1 and 2. For plants without a low power and shutdown PRA, such as Palo Verde, NEI 00-04, as endorsed by RG 1.201, allows the use of a modified process based on the NUMARC 91-06 program to address categorization in plant Modes 3 through defueled. The categorization process will follow the guidance and criteria in Section 5.5 of NEI 00-04 to address low power and shutdown risk. That process, for Palo Verde, is described in procedure 70DP-0RA01, Shutdown Risk Assessments. Below is a summary of the NEI 00-04 process and requirements.

The overall process for addressing low power and shutdown risk is illustrated in Figure 5-7 of NEI 00-04. NUMARC 91-06 specifies that a defense-in-depth approach be used with respect to each defined low power and shutdown key safety function.

The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs. NEI 00-04 provides two criteria for SSCs to be considered preliminary HSS.

1. If a system/train supports a key safety function as the primary or first alternate means, then it is considered to be a primary low power and shutdown safety system and is categorized as preliminary HSS. Procedure 70DP-0RA01, Shutdown Risk Assessment, which is consistent with NUMARC 91-06, is used as a guide to identify primary and first alternative means. NEI 00-04 defines a primary low power and shutdown safety system as also having the following attributes:

• It has a technical basis for its ability to perform the function.

• It has margin to fulfill the safety function.

• It does not require extensive manual manipulation to fulfill its safety function.

2. If the SSCs failure would initiate an event during low power and shutdown plant conditions (e.g., loss of shutdown cooling, drain down), then that SSC is categorized as preliminary HSS.

As stated in NEI 00-04, If the component does not participate in either of these manners, then it is considered a candidate as low safety significance with respect to low power and shutdown safety.

Page 51 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 20 APLA(B) - Reported Baseline Risk Values Attachment 2, Total Unit 1/2/3/ Baseline Average Annual CDF/LERF, of the LAR provides the CDF and LERF values for internal events, internal flooding, internal fire, and seismic events for PVNGS Units 1, 2, and 3. The CDF and LERF values of each hazard presented in LAR Attachment 2 are identical for each unit. Typically, differences in CDF and LERF results exist for multiple-unit plants, even if the differences are not significant. Also, the LAR states numerous times that the licensees risk management process ensures the PRA model used in the application reflects the as-built and as-operated plant for Units 1, 2, and 3. It is not clear to the NRC staff whether the risk values reported in LAR Attachment 2 are the results of separate PRAs performed for each unit or whether PRAs were performed only for a given unit and assumed to represent all three units.

a. If the PRAs were performed only for a given unit and assumed to represent all three units, then for each hazard:

i. Justify that the PRA model is an adequate representation of all three units.

ii. Include a discussion of SSCs that are shared between units and how these were implicitly or explicitly modeled.

iii. Indicate how this assumption will be confirmed going forward if plant modifications vary between units.

b. If the PRAs were performed for each unit separately, explain why the risk results are identical.

APS Response to RAI 20

a. The PRAs were developed based on Unit 1 and modified to capture the scenario impacts and system responses to represent all three units. Delta assessments for differences between Unit 1 (base model) and Units 2 and 3 have been documented and incorporated as appropriate in a composite PRA model. The composite PVNGS PRA model for Units 1, 2, and 3 was confirmed to be representative of the as-built condition of Units 2 and 3 and is not overly conservative for the representation of the as-built condition of Unit 1.

i. Delta assessment summaries for each hazard:

Internal Events PRA The PVNGS units are three physically separate and independent units that are nearly identical in design, construction, maintenance, and operation. Given that the units are nearly identical, one internal events PRA model was developed using Unit 1 as the base case model. There are some minor electrical differences between Unit 1 and the other two units:

a) Unit 1 has a breaker between the Non-class 1E 13.8 kV Intermediate Start-up Switchgear (NANS05) and the Non-class 1E 13.8 kV Onsite Page 52 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Switchgear (NANS03), and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not.

b) Unit 1 is unique in supplying normal power from the Start-up Transformers to the switchyard and to the Water Resources Facility (WRF) via the non-Class 1E 13.8 kV intermediate start-up switchgear.

c) The units connect to three separate, shared, startup transformers for normal and backup power. The startup transformers are identical, so the functions are identical, and the only difference is that different startup transformer and switchyard breaker component numbers are mapped to the basic events for the three units.

These differences represent additional failure modes for Unit 1 components and systems, but are insignificant in the base case model. The results for Unit 1 bound Units 2 and 3.

Internal Fire PRA A review of all unit specific inputs to the internal fire PRA (FPRA) model was conducted and documented to identify unit differences that potentially impact the model. The review identified various as-built/as-operated differences between the PVNGS units. Those that impact the fire PRA modeling are:

• Relocated ignition source target raceways,

• Required cable routing through alternate raceways or fire compartments,

• Distances from ignition source to 1st target or 1st tray,

• Hot Gas Layer timing, and

• Protected raceways (fire wrap)

An equivalency determination was made regarding each difference with respect to the modeling based on Unit 1 input data. Where Unit 2 and Unit 3 specific input data was not equivalent or bounded by the Unit 1 modeling, revised data was provided to construct a composite FPRA model that represents all the fire induced impacts in all units.

An evaluation of the FPRA composite model quantification results was conducted to assess any potential over- or non-conservatism in using either the Unit 1 based FPRA model or the FPRA composite model.

Recently completed plant modifications and model refinements have resulted in the as-built/as-operated units being more closely aligned.

The resulting delta risk between the FPRA baseline model (based solely on Unit

1) and the FPRA composite model (based on all fire impacts from all three units) is less than 0.5% for CDF and 0.1% for LERF. The FPRA composite model most accurately represents Unit 3, but is a very reasonable representation of all three units. The FPRA composite modeling is not overly conservative for the representation of the as-built condition of Unit 1.

Page 53 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Comparison of the FPRA baseline model to the FPRA composite model also concluded:

• The (unit specific) impacted scenarios do not significantly change in dominance amongst all ignition source scenarios,

• The ignition source relative contributions were not significantly rearranged,

• All dominant scenarios represent ignition sources existing in all three units, and

• Total fire compartment risk contributions also did not significantly change Consequently, it is concluded that the relative importance of impacted components is not significantly affected. The minor differences between the units are not expected to result in any impact on the importance of individual components as modeled for risk-informed applications.

Internal Flood PRA The internal flood PRA (IFPRA) was developed for Unit 1. Walkdowns have been performed to confirm/verify the applicability of the Unit 1 flooding analysis to the other two units. No significant flooding related differences were noted between the three units for internal flooding. Therefore, Unit 1 is an adequate representation of all three units.

Seismic PRA The seismic PRA (SPRA) developed for Unit 1 was assessed for applicability to Units 2 and 3. Non-significant differences were observed in the SPRA hazard evaluations and a limited subset of the equipment was judged to warrant unit-specific fragility evaluations. The unit specific fragilities were quantified with both the composite hazard and the Unit 1 SPRA model. The differences in CDF and LERF are, as expected, minimal.

The seismic hazard evaluation was calculated with a composite profile with a single set of amplification factors, with uncertainties representing differences in site profiles among the three units. A sensitivity analysis was then performed to evaluate the difference in seismic hazard between the three units. The conclusion of the sensitivity study was that from the perspective of seismic hazard, the general differences that can be observed between the composite hazard and the unit-specific hazard do not appear to be significant.

Despite the similarity between the three units, dedicated fragility walkdowns have been performed to confirm/verify the applicability of the Unit 1 analysis to the other two units. Following the walkdowns, a limited number of deviations between the three units have been observed that were warranting the development of dedicated Unit 2 and Unit 3 fragility estimates. The fragility analyses for Units 2 and 3 were performed with the same composite hazard developed for the base case (i.e., Unit 1). A limited number of unit-specific fragility parameters were developed where Unit 2/Unit 3 were expected to be different from the Unit 1 fragility parameters. The master fault tree file was Page 54 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 modified for Units 2 and 3 and the SPRA results of the quantification are summarized below.

The following list of components is a summary of structural/interaction deviations from Unit 1 that required unit-specific fragility parameters:

• Unit 2 Diesel Generator A Air Intake Structure

• Unit 2 Diesel Generator Room Essential Exhaust Fans

• Unit 3 Diesel Generator Room Essential Exhaust Fans

• Unit 2 Essential Cooling Water A and B Heat Exchangers

• Unit 2 Auxiliary Feedwater Pump A

• Unit 3 480 V Motor Control Center M32

• Unit 3 DC Battery C

• Unit 3 DC Battery D

• Unit 3 Essential Cooling Water B Heat Exchanger

• Unit 3 Diesel Generator A and B Fuel Oil Storage Tanks The resulting delta risk between the baseline SPRA Unit 1 model and the SPRA Unit 2 and Unit 3 models is less than 0.01% for CDF and LERF. Therefore, Unit 1 is an adequate representation of all three units.

ii. The shared systems between the units are as follows:

1. In normal line-up, the three startup transformers each supply one source of off-site power to two units through separate secondary windings. Thus, loss of one start-up transformer would cause a single train of Engineered Safety Feature (ESF) equipment on two units to lose normal off-site power. Each startup transformer also supplies backup off-site power to both trains in one unit. Class 1E buses would be powered by the emergency diesel generator on a loss of power and then manually transferred back to off-site power by the operators. Loss of off-site power to one ESF bus is not an initiating event. If the unit auxiliary transformer is lost, non-Class 1E power is transferred using a fast bus transfer to the normally aligned start-up transformer (e.g., reactor coolant pumps remain powered). If one unit is on its normal start-up transformer and another unit on its alternate start-up transformer due to maintenance, they share a transformer winding and one unit will block fast transfer of their non-Class 1E 4160V buses. These electrical alignments are included in the PRA model. Unit 1 has a breaker between the non-Class 1E intermediate start-up switchgear (NANS05) and the non-Class 1E onsite switchgear (NANS03) and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not. Unit 1 is also unique in supplying normal power from the start-up transformers to the switchyard and to the Water Page 55 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Resources Facility (WRF). Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

2. Layout and functional alignment of the main control boards is equivalent between the units with the exception of main control board B01 for switchyard controls. Units 2 and 3 have mimic boards (indication) for the switchyard and startup transformers, but only have control for closing their own units breakers and must coordinate with Unit 1 for operation of the station blackout generators (SBOGs). SBOG HFEs were already captured with the Unit 1 modeling. The impact of the Unit 1 Control Room breaker control circuits on Units 2 and 3 was screened out based on the hot-short opening of a breaker due to a fire in Unit 1 impacting Units 2 or 3 being below the quantitative screening criteria [< 1.0E-7/yr for core damage frequency (CDF) and < 1.0E-8/yr for large early release frequency (LERF)], lack of impact to any of the mitigating equipment, the rare occurrence of an internal fire initiated loss of off-site power (LOOP) in industry, the inclusion of industry historical data in the PVNGS values for plant centered LOOP and switchyard centered LOOP, and the small contribution of LOOP to internal fire CDF and LERF. Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

3. Another common electrical connection is to the SBOGs. It is not expected that more than one unit would ever be lined up to receive power concurrently from the SBOGs, although procedures exist to provide limited power to Units 1 and 2 or 1 and 3 (not modeled in the PRA). The likelihood of two units experiencing a simultaneous station blackout is screened out due to its low probability. When a loss of off-site power is experienced on one or both ESF buses in any unit, operators are dispatched to manually start the SBOGs within one hour. As indicated above, SBOG HFEs were already captured with the Unit 1 modeling.

4. The PVNGS fire water supply is also shared between the units.

There are two separate, reliable fire water supply tanks located near the Water Resource Facility boundary. Both tanks are interconnected and the fire protection pumps can take suction from either or both. The headers are arranged in a loop system with two headers running from the pump house along the north and south sides of the power plants. A significant leak in one tank or its piping will initiate a low level alarm alerting operators in the Unit 1 Control Room. Three redundant and diverse (one electrical and two diesel driven) fire pumps are available to supply pressure for the fire main when it exceeds the capacity of the jockey pump.

A seismic failure of the fire protection water main is a potential source of common cause failure of the fire water suppression system. The fire protection water main consists primarily of a Page 56 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 closed 12-inch underground loop encompassing all units, the service and administration buildings, and site construction buildings. The yard main is provided with post-indicator valves for sectional control. Post-indicator valves are also located such that the yard loop for any individual power block can be isolated from the yard loops of the remaining units. Outside hydrants are provided at approximately 250-foot intervals within the power block area and as required near other hazards and near other remote buildings. Hydrants are equipped with 2-1/2 inch hose connections.

According to the Updated Final Safety Analysis Report (UFSAR),

Revision 19, in the unlikely event that the plant fire pumps cannot furnish an adequate water supply to the distribution system, the yard main includes pump connections for obtaining water from the circulating water system cooling tower basin by using portable pumping units. 14OP-0FP05, Isolation of the Fire Water Suppression System, Revision 5, directs the fire protection personnel in the correct operation of isolating specific portions of the fire water suppression system. In doing so, a damaged section of the fire protection water main can be isolated to ensure proper operation elsewhere.

Another mode of failure for the fire water system is seismically induced common cause failure of the fire water pumps. During normal operation, the fire protection water system is kept continuously full and pressurized by the jockey pump. When significant flow (more than 40 gallons per minute) is required to the fire water system, the fire pumps are designed to start sequentially on decreasingly lower pressures in the fire main. Normally, the first fire pump to start would be the motor-driven fire pump when the pressure in the fire main header drops to 95 psig. If the fire main pressure drops below 90 psig and remains below that point for at least 20 seconds, the first diesel-driven fire pump cycles on. The second diesel-driven fire pump will cycle on if the pressure in the fire main header drops below 85 psig and remains below that pressure for at least 30 seconds, according to the UFSAR. Common cause or correlated seismic failure of all fire pumps is mitigated with the availability of a backup fire pump configuration outlined in 14OP-9FP07, Backup Fire Pump Installation, Revision 0.

Low-pressure carbon dioxide systems are provided for total flooding and local hand hose application in those areas indicated in Table 9.5-1 of the UFSAR. In addition, Halon 1301 fire suppression flooding systems are provided to protect additional areas. Each area has its own main and auxiliary gas bottles that are anchored.

Therefore, given each area has its own localized source and components, common cause failure due to seismically induced failure is not a concern.

Page 57 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Finally, the PVNGS Fire Department has recently purchased five fire protection apparatus: three pumpers, one 78 foot aerial ladder/pumper, and one nuclear emergency response vehicle (NERV). The three pumpers are Tilt Table qualified to 26.5 degrees. The NERV is Tilt Table qualified to 30 degrees. All of these firefighting vehicles comply with the UFSAR requirement to address fire header decapitation and supply water to the fire protection systems within each unit.

Therefore, common mode failure of the fire water system to more than one unit is screened out.

5. The units are also connected via the auxiliary steam system, which supplies process steam for water processing and turbine gland seals during secondary plant start-up. The normal line-up of this system is one unit supplying auxiliary steam for all three units. This sharing is done primarily to keep the lines warm and the water within them in good condition. Malfunctions of the system are not significant enough perturbations to cause a trip or shutdown; nor is the system credited in the PRA for mitigating any transients or accidents. For these reasons, the auxiliary steam system is not modeled in the PRA. Procedures do exist, to transfer condensate from one unit to another, if needed.

6. The tower make-up and blowdown system supplies makeup condenser cooling water to all three units to make up for evaporation and blowdown. Its failure would lead to the shutdown of all three units due to lowering level in the circulating water intake for each of the units. It has redundant pumps powered by redundant power supplies, making it highly reliable. Should it ever fail, it would most likely be manifest as a normal shutdown for all three units. At worst, it could lead to loss of condenser vacuum and loss of plant cooling water. It is not required for safe shutdown. For these reasons, the tower make-up and blowdown system is not modeled in the PRA.

iii. PVNGS process going forward if plant modifications vary between units.

As plant modifications and model refinements are developed, the relative impact on the composite PRA model will continue to be assessed. Since plant modifications are usually installed during refueling outages, the three PVNGS units will have different combinations of modifications installed. Significant impacts will be incorporated by updating the composite [backbone] model with the plant modification and implemented for the specific unit(s) in which the modification(s) have been installed. This may require several official model revisions be maintained to accurately represent the status of implemented modifications. Each Model of Record (MOR) revision will be maintained under the PRA model control procedure Page 58 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15.

b. PRAs were not performed separately for each unit.

Page 59 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 21 APLA - Fire Hazards Section 3.2.2, Fire Hazards, of the LAR states in part, the Internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes NRC approved methods. As part of the ongoing PRA maintenance and update process described in Section 3.2.6, APS will address Internal Fire PRA methods approved by the NRC since the development of the Internal Fire PRA. Furthermore, in Section 3.3 of the LAR, the licensee specifies that a full-scope FPRA model peer review was performed in December 2012 and a focused scope FPRA model peer review was conducted in December 2014.

There have been numerous changes to the FPRA methodology since the last full-scope peer review of the PVNGS FPRA. The integration of NRC-accepted FPRA methods and studies described below that are relevant to this submittal could potentially impact the 10 CFR 50.69 risk categorization results and/or risk acceptance guidelines for total CDF and total LERF:

• NRC letter, Recent Fire PRA Methods Review Panel Decisions and EPRI 1022993, Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires, dated June 21, 2012 (ADAMS Accession No. ML12171A583), providing staff positions on (1) frequencies for cable fires initiated by welding and cutting, (2) clarifications for transient fires, (3) alignment factor for pump oil fires, (4) electrical cabinet fire treatment refinement details, and (5) the EPRI 1022993 report.

• NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 2, Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced electrical Circuit Failure (ADAMS Accession No. ML14141A129), which is supported by a letter from the NRC to NEI, Supplemental Interim Technical Guidance on Fire-Induced Circuit Failure Mode Likelihood Analysis (ADAMS Accession Nos. ML14086A165 and ML14017A135).

• NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database:

United States Fire Event Experience Through 2009 (ADAMS Accession No. ML15016A069).

Section 2.5.5 of RG 1.174, provides guidance that indicates additional analysis is necessary to ensure that contributions from the above influences would not change the conclusions of the LAR.

a. Provide a detailed justification for why the integration of the above NRC-accepted fire PRA methods and studies would not change the conclusions of the LAR, and subsequently change the categorization process results. As part of this justification, identify potential fire PRA methodologies used in the fire PRA that are no longer accepted by the NRC staff. Provide technical justification for its use and evaluate the significance of its use on the risk metrics for the application (RG 1.174) provided in Attachment 2 of the LAR.

OR Page 60 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

b. Alternatively, for each NRC-accepted fire PRA method described above, provide the following:

i. Explain how each method is addressed in the fire PRA that will be used during the 10 CFR 50.69 categorization process, and provide updated results for the risk metrics in Attachment 2 of the LAR.

ii. Indicate whether any changes to the fire PRA to address the methods are PRA maintenance or a PRA upgrade as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2, along with justification for the determination.

iii. Discuss the focused scope (or full-scope) peer review(s) that has been performed to evaluate the changes that were determined in Part b.ii above to constitute a PRA upgrade, providing the date for when the peer review(s) was performed and when the peer review report(s) was approved that evaluated the incorporation of the method(s).

c. Provide the findings of the peer review(s) performed from Part b.iii (above) and the disposition for each finding as it pertains to the impact on the 10 CFR 50.69 application.

APS Response to RAI 21 APS will revise the fire PRA model to incorporate more recently endorsed fire PRA guidance prior to implementation of the 50.69 program as part of the maintenance and update process. APS will provide the updated PRA model CDF and LERF values after these and other changes described in other RAI responses are incorporated.

APS will provide the estimated PRA model CDF and LERF values as described in Attachment 1. The estimated CDF and LERF values will include a list of changes made to the baseline PRA model reported in the LAR Attachment 2, Total Unit 1/2/3 Baseline Average Annual CDF/LERF, and to demonstrate that the total CDF and total LERF are below the limits established in RG 1.174, which are 1E-4/year for CDF and 1E-5/year for LERF. APS has a detailed schedule for incorporating these changes in the PRA models, including activities to review results and perform sensitivity and uncertainty analyses. Upon implementation of the noted changes, APS will categorize each change as maintenance or upgrade and perform focused scope peer review(s) as described in Attachment 1.

APS plans to complete the following prior to implementation of the 50.69 program:

1. Incorporate the updated Fire Ignition Frequencies and non-suppression probabilities (NSP) provided in NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, January 2015. Incorporate a 0.001 floor value directly into the manual suppression NSP calculations.

2. Incorporate the updated Electrical Cabinet Heat Release Rates provided in NUREG-2178, Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE), May 2016. [APS does not plan to implement the Obstructed Plume methodology upgrade.]

Page 61 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

3. Update the transient and oil fire growth rates per FAQ 08-0052.

4. Update the KERITE cable type per FAQ 08-0053.

5. Update component binning per FAQ 12-0064. APS plans to retain the transient fire weighting factor methodology of NUREG/CR-6850 and does not plan to take credit for adjusting weighting factors to values between 0.0 and 1.0, as allowed by the methodology in NFPA-805 FAQ 12-0064.

PVNGS Fire PRA ignition source weighting factors are established based on the guidance provided in NUREG/CR-6850 section 6.5.7.2 (and Table 6-3) and the process is documented in fire PRA (FPRA) studies. Knowledgeable plant staff was surveyed; including a PRA engineer, fire protection engineer, fire marshal, operations representative, work management scheduler, mechanical maintenance representative, and an electrical journeyman. The results were qualitatively adjusted (calibrated) as necessary to maintain the Medium (3) factor as the normative value. The full range of influence factor rating values of No (0), Low (1), Medium (3), High (10), and Very High (50) were exercised.

Influence factor rating values of Extremely Low (0.1) and Very Low (0.3) were not used.

Two fire compartments are assigned Zero (0) for both maintenance and occupancy influence factors with a storage factor of One (1) assigned to ensure a frequency greater than zero is assigned to each Plant Analysis Unit: Filter and Ion Exchanger Pits (Fire Compartment, FC49A-G) and Volume Control Tank room (Fire Compartment, FC51A). These compartments are encased in concrete and inaccessible at power.

6. Incorporate the updated guidance on treatment of Sensitive Electronic damage thresholds per FAQ 13-0004.

7. Incorporate oil fire split fractions (counting) per NRC Position ML12171A583 Item 3 below.

8. Incorporate updated uncertainty analysis expectations per NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1.

RECENT FIRE PRA METHODS REVIEW PANEL - ML12171A583

1) Frequencies for Cable Fires Initiated by Welding and Cutting The Internal Fire PRA model, as documented in the LAR, adopted the revised hot work related cable fire ignition frequencies provided in NEI letter titled Recent Fire PRA Methods Review Panel Decision: Frequencies for Cable Fires Initiated by Welding and Cutting, submitted October 7, 2011, as endorsed in ML12171A583. The frequencies for cable fires initiated by welding and cutting utilized in the LAR model were implemented prior to the Full Scope Internal Fire PRA Peer Review, December 2012.

Prior to implementation of the 50.69 program, APS plans to incorporate the updated Fire Ignition Frequencies and Non-Suppression Probabilities provided in NUREG-2169 which will supersede the values endorsed by ML12171A583.

Page 62 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as qualified by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

2) Clarification for Transient Fires The Internal Fire PRA model, as documented in the LAR, adopted the screening transient Heat Release Rate (HRR) provided in NUREG/CR-6850, Appendix G, Table G-1, 98th percentile (317 kW) as clarified in NEI letter, Recent Fire PRA Methods Review Panel Decision: Clarification for Transient Fires and Alignment Factor for Pump Oil Fires submitted September 27, 2011 as endorsed in ML12171A583. The transient fire heat release rates utilized in the LAR model were implemented prior to the Full Scope Internal Fire PRA Peer Review, December 2012.

Further refinements may be applied to decrease the transient HRR to achieve realism in accordance with the methodology of NUREG/CR-6850 and within the clarifications endorsed by ML12171A583. Larger HRR transients are postulated in the Diesel Generator building [although the fire compartment is treated as hot gas layer (HGL) scenario], and in the Turbine building areas which are treated as effective HGL scenarios of very large areas considered to bound the upper limit of transient materials.

3) Alignment Factor for Pump Oil Fires The Internal Fire PRA model as documented in the LAR, adopted the oil fire ignition frequency alignment factors (count split fractions) provided in FAQ 08-0044 and NUREG/CR-6850 Appendix E.3. The alignment factor for pump oil fires utilized in the LAR model was implemented prior to the full scope internal fire PRA peer review conducted in December 2012.

Prior to implementation of the 50.69 program, APS plans to incorporate the updated refined treatment of oil pump endorsed by ML12171A583.

The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as endorsed by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

4) Electrical Cabinet Fire Treatment Refinement Details The electrical cabinet fire treatment refinement submitted by NEI on June 5, 2012, in letter, Recent Fire PRA Methods Review Panel Decision: Treatment of Electrical Cabinets was not endorsed by the NRC. This methodology was never adopted in the PVNGS PRA model.

Page 63 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

5) EPRI 1022993 - Evaluation of Peak Heat Release Rates (HRRs) in Electrical Cabinet Fires The preliminary approach to evaluating peak HRRs in electrical cabinets published in EPRI 1022993 was not endorsed by the NRC. This methodology was never adopted in the PVNGS PRA model.

NUREG/CR-7150 Vol 2 - Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE)

The Internal Fire PRA model as documented in the LAR, adopted the guidance and methodology of NUREG/CR-7150. The guidance and methodology of NUREG/CR-7150 were incorporated into the Fire PRA model prior to the Focused Scope Fire Peer Review, conducted December 2014. Implementation of NUREG/CR-7150 was within the scope of the focused scope peer review.

NUREG-2169 - Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database Prior to implementation of the 50.69 program, APS plans to incorporate the updated Fire Ignition Frequencies and Non-Suppression Probabilities provided in NUREG-2169. The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as endorsed by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

The Attachment 7, Table 7-1 provides the internal fire focused scope peer review finding and its disposition relevant to implementation of the above NRC-accepted fire PRA methods.

Page 64 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 22 APLA - Integrated PRA Hazards Model NEI 00-04, Section 5.6, Integral Assessment, discusses the need for an integrated computation using the available importance measures. It further states, in part, that the integrated importance measure essentially weights the importance from each risk contributor (e.g., internal events, fire, and seismic PRAs) by the fraction of the total core damage frequency [or large early release frequency] contributed by that contributor. The guidance provides formulas to compute the integrated Fussell-Vesely (FV), and integrated Risk Achievement Worth (RAW).

To address the integration of importance measures, some licensees have updated their PRA model to a one-top model that integrates the PRA model(s) across all hazards (i.e., internal events, internal flooding, fire, seismic, high winds, external flooding).

To confirm that the importance measures generated for use in the 10 CFR 50.69 process is consistent with the NEI guidance and does not inadvertently introduce a deviation from the computations for FV and RAW provided in the NEI 00-04 guidance, as endorsed by RG 1.201, Revision 1:

a. Explain whether the PRA model that will be used in the 10 CFR 50.69 categorization process is an integrated one-top model across multiple PRA hazards and if the integrated one-top model includes accident sequence(s) modeling to support quantification of both CDF and LERF.

If using an integrated one-top model across multiple PRA hazards, provide the following:

i. Discuss the process used to validate and confirm the integration of the PRA hazards into a one-top model to ensure that after the PRA model change was performed, SRs QU-F2 and SR FQ-F1 continue to be met (e.g., cutset reviews, identification of non-minimal cutsets, peer review).

ii. Discuss how the individual importance measures (i.e., FV and RAW) for the PRA one-top all hazards model are derived from the one-top model, and justify why the importance measures generated do not deviate from the NEI guidance. If the practice or method used to generate the integrated importance measures is determined to deviate from the NEI guidance, justify why the integrated importance measures computed are appropriate for use in the categorization process.

Page 65 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 22

a. The PRA model that will be used for the 10 CFR 50.69 categorization process will be an integrated one-top model that includes internal events, internal flooding, internal fire, and seismic PRA hazards. This model will support quantification of both CDF and LERF.

i. The individual hazard models are individually verified to meet their respective portions of ASME/ANS RA-Sa-2009 per the normal process of technical verification and peer review. These individual hazard models will be considered the Palo Verde models of record, from which application-specific models will be developed. The one-top model to be used for 50.69 categorization will be such an application-specific model. The integrity of the one-top model will be verified by comparing its results (i.e. cutsets) against those generated by the RG 1.200, Revision 2, compliant peer-reviewed individual hazard models of record. Demonstration that the one-top model produces the same results as the separately peer-reviewed individual hazard models will be documented, along with analysis of any results that diverge from the individual hazard PRA model results. The one-top model itself will not undergo peer review, as it is an application-specific model derived from the individual hazard PRA models of record.

ii. Importance measures such as Fussell-Vesely (F-V) and RAW will be generated per the guidance and methodologies defined in NEI 00-04. Palo Verde does not plan to deviate from the NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, guidance and will thus consider both the individual hazard importance measures (i.e. F-V, RAW, etc. generated by each individual hazard model) as well as the integrated importance measures generated using the one-top PRA model. The integrated importance measures that are derived from the one-top model will be generated using industry standard methodologies, such as the EPRI SYSIMP tool.

Page 66 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 23 APLA - 10 CFR 50.69(e), Feedback and Adjustment Process Section 50.69 of 10 CFR delineates that a licensee voluntarily choosing to implement this section shall submit an application for license amendment under Section 50.69 that contains the following information. Paragraph 50.69(e)(1) of 10 CFR, Feedback and process adjustment-RISC-1, RISC-2, RISC-3 and RISC-4 SSCs, states, in part, [t]he licensee shall review changes to the plant, operational practices, applicable plant and industry operational experience, and, as appropriate, update the PRA and SSC categorization and treatment processes.

NEI 00-04, Section 11.2, Following Initial Implementation, discusses that

[t]he periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes. Specifically, NEI 00-04, Section 12.1 discusses cases for which, in some instances, an updated PRA model could result in new RAW and FV importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization.

Explain how this periodic review will be administered. At minimum, discuss the following:

a. Participants involved in the review;

b. Sources of material identified to be reviewed;

c. Periodicy for when the review will be performed;

d. Documentation of the review performed (e.g., corrective action program, engineering evaluation, etc.); and

e. Criteria used to determine if the change being reviewed has any impact to a modeled PRA hazard(s) and/or any SSC categorized by the 10 CFR 50.69 process.

APS Response to RAI 23 a) The review will be completed by a system engineer and a PRA engineer.

b) To assess the impact of plant changes on RISC-1, RISC-2, RISC-3, and RISC-4 SSCs, the following items are reviewed to ensure the continued validity of categorization results for SSCs that have been categorized:

• Plant modifications since the last review that could impact the SSC categorization (system engineer and PRA engineer)

• Plant specific operating experience that could impact the SSC categorization (system engineer)

Page 67 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• The impact of the updated risk information (that is, PRA model or other analysis used in the categorization) on the categorization process results (PRA engineer)

• Importance measures used for screening in the categorization process. If a review of the importance measures indicates that the SSC should be reclassified, then both the relative and absolute values of the risk metrics will be considered by the IDP.

(PRA engineer)

• An update of the risk sensitivity studies performed for the categorization (PRA engineer)

• Applicable plant and industry operational experience for impact on existing categorizations. (system engineer)

• Input from Regulatory Affairs and Operations regarding changes that may affect the bases for the categorization results. (system engineer) c) The periodic review is completed at least once every other Unit 1 refueling outage. The Periodic Review Process will be completed in accordance with 01DP-0RS12, Requirements for Immediate Reviews, Periodic Reviews, and Performance Monitoring.

d) The system engineer compiles a periodic review report containing the following:

• Summary of plant changes and impact on the categorization results

• Summary of condition reports

• Summary of performance monitoring results of RISC-3 SSCs

• Results of review of SSC failures by component group

• Results of functional failure trends reviews

• Summary of maintenance rule issues, if applicable

• Summary of performance indicators, if available

• Summary of issues affecting the system

• Regulatory Affairs review

• Operations review The Integrated Decision Making Panel (IDP) will review the report and make the final decision regarding recategorizations.

Page 68 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 e) The periodicity of the periodic review coincides with the frequency of PRA model updates. The PRA model update results will be reviewed for components that have been categorized by the 50.69 process.

Attachment 8, Table 8-1 lists the criteria from NEI 00-04 that will be used to determine PRA-based high safety significant (HSS) vs low safety significant (LSS) ranking for components.

Page 69 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 References

1. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009

2. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

4. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

5. NUREG/CR-INEEL/EXT 04-02326, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003, October 2004

6. WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008

7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007

8. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA)

Frequencies through the Elicitation Process, Draft

9. WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, Revision 0, March 2007

10. 79IS-9ZZ07, PVNGS Extended Loss of All Site AC Guideline, Modes 1-4, Rev. 7

11. NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, August 1983

12. NUREG/CR-6850 (EPRI TR-1011989), EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Electric Power Research Institute, Palo Alto, CA, and U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, Rockville, MD, September 2005

13. EPRI Report 3002008101, Loss of Offsite Power at U.S. Nuclear Power Plants Through 2015, July 2016

14. Nuclear Energy Institute (NEI) 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012 Page 70 of 70

Attachment 1 Palo Verde 10 CFR 50.69 PRA Implementation Items

Enclosure Attachment 1 Attachment 1 Palo Verde 10 CFR 50.69 PRA Implementation Items Table 1-1 below identifies the items that are required to be completed prior to implementation of the 10 CFR 50.69 categorization process at Palo Verde Nuclear Generating Station, Units 1, 2 and 3. Issues identified below will be addressed and any associated changes made, focused scope peer reviews performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and findings resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Table 1-1 Palo Verde 10 CFR 50.69 PRA Implementation Items Description Resolution

1. The June 2017 F&O Closure Review of peer Conduct an augmented F&O closure review of the review findings did not include: June 2017 F&O Closure Review findings to include:

a. Documentation of the basis for the a. Documentation of the basis for the maintenance vs update determination maintenance vs update determination for for each reviewed F&O finding each reviewed F&O finding

b. A review of F&O findings from prior b. A review of F&O findings from prior peer peer reviews associated with supporting reviews associated with supporting requirements determined to meet requirements determined to meet Capability Capability Category II of the ASME/ANS Category II of the ASME/ANS RA-Sa-2009 as RA-Sa-2009 as endorsed by RG 1.200, endorsed by RG 1.200, Revision 2 Revision 2 c. Documentation of the review of supporting

c. Documentation of the review of requirements determined to not meet supporting requirements determined to Capability Category II from the self-not met Capability Category II from the assessment of the internal events PRA model self-assessment of the internal events against all supporting requirements in PRA model against all supporting ASME/ANS RA-Sa-2009 as endorsed by RG requirements in ASME/ANS RA-Sa-2009 1.200, Revision 2 as endorsed by RG 1.200, Revision 2 These actions are indicated in the response to RAIs This condition is described in response to RAIs 01.a, 05.b, 05.d, 09.d, and 17 in APS letter dated 01.a, 05.b, 05.d, 09.d, and 17 in APS letter May 9, 2018.

dated May 9, 2018.

2. Four PRA model upgrades were identified from Conduct a focused scope peer review for the a review of all PRA model changes not reviewed following PRA model upgrades:

by peer reviews: a. The common cause methodology change

a. The common cause methodology was from the multiple greek letter (MGL) method changed from the multiple greek letter to the alpha factor method (MGL) method to the alpha factor b. The human reliability analysis (HRA) method methodology change from the systematic

b. The human reliability analysis (HRA) human action reliability procedure (SHARP) methodology was changed from the model to the EPRI HRA Calculator software systematic human action reliability c. PRA Impact 2003-301 that incorporated new procedure (SHARP) model to the EPRI modeling for pressure-induced steam HRA Calculator software generator tube rupture (SGTR) using CE

c. PRA Impact 2003-301 incorporated new NPSD-1124 Methodology for Modeling Main modeling for pressure-induced steam Steam Line Breaks, Revision 0 generator tube rupture (SGTR) using CE d. PRA Impact 2013-151 that significantly NPSD-1124 Methodology for Modeling impacted the results from the internal flood Main Steam Line Breaks, Revision 0 PRA model

d. PRA Impact 2013-151 updated the internal flood PRA model resulting in a These actions are indicated in response to RAIs significant impact on the results 03.c, 06, 09.c, 09.d, in APS letter dated May 9, 2018.

This condition is described in response to RAIs 03.c, 06, 09.c, 09.d, in APS letter dated May 9, 2018.

Page 1 of 3

Enclosure Attachment 1 Table 1-1 Palo Verde 10 CFR 50.69 PRA Implementation Items Description Resolution

3. The PRA models are being revised to incorporate Revise the PRA models to incorporate resolutions to all resolutions to all open F&O findings and fire PRA open F&O findings and fire PRA guidance more guidance more recently endorsed by the NRC as recently endorsed by the NRC as indicated in the indicated in response to RAI 21 in APS letter license amendment request to adopt 10 CFR 50.69, dated May 9, 2018. The PRA model total CDF and Risk-Informed Categorization and Treatment of total LERF after these changes are incorporated Structures, Systems, and Components for Nuclear must meet RG 1.174 risk limits of 1E-4/year for Power Reactors dated July 19, 2017.

CDF and 1E-5/year for LERF as indicated in License Amendment Request to adopt 10 CFR This action is indicated in the response to RAIs 50.69, Risk-Informed Categorization and 02.d, 07, 08, and 21 in APS letter dated May 9, Treatment of Structures, Systems, and 2018.

Components for Nuclear Power Reactors dated July 19, 2017. Ensure after these changes are incorporated as indicated in the response to RAI 21 that the PRA This condition is described in the response to model total CDF and total LERF are below the RAIs 02.d, 07, 08, and 21 in APS letter dated limits established in Regulatory Guide (RG)

May 9, 2018. 1.174, which are 1E-4/year for CDF and 1E-5/year for LERF.

Page 2 of 3

Enclosure Attachment 1 Attachment 1 Additional Conditions Operating License No. NPF-41, NPF-51, and NPF-74 APS proposes the following license conditions, Table 1-2, be added to Appendix D of the PVNGS Units 1, 2, & 3 Renewed Operating Licenses:

Table 1-2 Additional Conditions Amendment Additional Conditions Implementation Number Date APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) specified in license amendment [NUMBER] dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g.,

change from a seismic margins approach to a seismic probabilistic risk assessment approach).

[NUMBER] APS will complete the implementation items listed in the Prior to implementation of Enclosure of APS letter 102-07546, dated July 19, 2017, to 10 CFR 50.69.

the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Page 3 of 3

Attachment 2 Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models

Enclosure Attachment 2 ATTACHMENT 2 Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models

RAI 09

As discussed in APS Response to RAI 09, all changes to the PRA have been reviewed against the information provided in ASME/ANS RA-Sa-2009 PRA Standard and RG 1.200, Revision 2, to classify each as either an upgrade or maintenance.

The process used for the classification of the changes and the results of the review are documented in Engineering Evaluation EWR 18-00619-003. This Attachment provides the list of significant changes included in the EWR along with a brief summary of the process used for the classification.

Justification/Basis for an Upgrade classification includes any one of the following:

• Methodology Change

• Scope Change

• Capability Change In order to provide the basis or justification for those items determined to be Maintenance, the changes were reviewed against Section 1.A-2 and the examples provided in Section 1-A.3 of the ASME/ANS RA-Sa-2009 PRA Standard Nonmandatory Appendix 1-A. These were used to identify that which most closely corresponds to the change being made to the PVNGS PRA model. Consistent with the ASME Standard, Maintenance changes have been determined to have no significant change to risk insights and no impact on significant accident sequences.

Table 2-1 provides the significant changes to the Internal Events PRA Model and Table 2-2 provides the significant changes to the Internal Flooding, Fire and Seismic PRA Models, along with their classification and associated justification/basis.

Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 2/19/2002 1998-35 Address miscalibration of critical sensors. Upgrade Methodology Change -

F&O HR-03 New THERP approach to common cause New THERP HRA method failure of miscalibration of sensors. used 2/4/2003 1998-37 Update ECCS success criteria to be Maintenance Implemented change to the consistent with CE NPSD-1072-P and new PRA model due to new MAAP case entries and update common industry and plant cause modeling conditional upon Line knowledge using processes Break previously applied 2/19/2002 1999-177 Correct modeling of SG downcomer and Maintenance Implemented model bypass flow feed control logic, missing corrections were neither so CCF events for block and bypass valves, numerous nor so large that HRA missing procedure steps, and the significant changes to risk existing common cause event for the insights or accident control valve(s). The correction results in sequences result a less than 1% change in CDF.

Page 1 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 7/13/2001 1999-6 Model DMWOs 746729 and 805235 Maintenance Incorporated model changes installation of digital feedwater control to reflect plant design systems. FWCS will have dual power changes consistent with supplies, NNND11 and NNND12, rather ASME PRA Standard Section than FWCS1 from NNND11 and FWCS2 1-A.2 from NNND12.

2/19/2002 2001-167 Update model to reflect DWG 13-10407 Maintenance Incorporated model changes J104-76-9 which indicates a modification to reflect plant design that changed the power supply to one of changes consistent with the two fans in each BOP-ESFAS cabinet ASME PRA Standard Section and revise loss of cabinet cooling 1-A.2 operator response 2/19/2002 2001-2 Incorporate changes to LERF Model in Maintenance Implemented model order to account for Boundary Conditions corrections were neither so defined in the Level 1 Trees. numerous nor so large that significant changes to risk insights or accident sequences result 2/19/2002 2001-210 Add the alternate off-site power supply to Maintenance Implemented change to the each ESF bus, as well as the GTGs, in the PRA model due to new IE trees for losses of power which splits industry and plant the ESF bus and OSP loss initiators from knowledge using processes the PN IEs. previously applied 2/19/2002 2001-212 Replace Basic Events SYFAULTSXM3-- Maintenance Implemented change to the 2PW and SYFAULTSXM2--2PW with PRA model using processes developed fault trees for switchyard previously applied components to support Maintenance Rule risk evaluations for the switchyard. Also address scheduled maintenance time.

2/4/2003 2002-182 Correct modeling for testing ESF trip Maintenance Implemented model initiation logic to reflect relay test corrections were neither so configuration of trip vs. bypass and numerous nor so large that reflect potential increase in spurious trip, significant changes to risk revise assumption for modeling UV relay insights or accident testing (32ST-9ZZ03), and add sequences result assumption describing modeling for testing that bypasses ESFAS channels.

2/4/2003 2002-218 Change status logic for PKA and PKB Maintenance Implemented model batteries. Correct CM logic for IA corrections were neither so compressors. Add a term to the delete- numerous nor so large that term fault tree to remove LOOP--2PW significant changes to risk with IEDCHVAC; alter logic for setting insights or accident running chillers and air compressors. sequences result 12/30/2010 2002-3 Modify LERF trees to address more recent Maintenance Data update using new PVNGS, industry and regulatory technical industry and plant-specific positions regarding AFW level control, data and Bayesian update AFW PRA success, and probability of process previously Pressure and Thermally induced SG tube employed ruptures.

6/2/2004 2003-1 Change the exchanges in RS with Maintenance Implemented model negated logic to avoid mapping corrections were neither so difficulties in EOOS. Also, delete numerous nor so large that exchange for HJBZ04 OOS in gate significant changes to risk GECB12. insights or accident sequences result 6/2/2004 2003-176 Change SG blowdown pathway from the Maintenance Implemented model Blowdown Flash Tank to the condenser. corrections were neither so Maintenance events may no longer be numerous nor so large that valid for different pathway. significant changes to risk Page 2 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade insights or accident sequences result 6/2/2004 2003-301 Incorporate Pressure-Induced SGTR Upgrade Methodology Change -

modeling into SLB event tree. New methodology used for PI-SGTR modeling 1/11/2006 2004-132 Revise model to properly reflect S/U Maintenance Implemented model Transformer SWYD breakers OOS corrections were neither so condition. Currently power to NAN-S05/6 numerous nor so large that is failed even when loads are transferred significant changes to risk to the Alternate S/U Transformer insights or accident sequences result 1/11/2006 2005-122 Incorporate PPS Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-123 Incorporate EC and WC Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-124 Incorporate GT Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-125 Incorporate PN Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-126 SI Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-127 CD (Altfw) Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-163 SG Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-164 CL (Containment Isolation) Common Upgrade Methodology Change -

Cause Modeling Changes from MGL to Common Cause Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-165 EW Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-166 HJ Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor Page 3 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 1/11/2006 2005-167 IA-GA Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-170 PK System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-171 DG, PB, PE and Off-Site Power Systems Upgrade Methodology Change -

Common Cause Modeling Changes from Common Cause MGL to Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-172 RC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-173 SP System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-174 NC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-2 Modify Small LOCA event tree to reflect Maintenance Implemented change to the testing and analysis done in support of PRA model due to new the sump air entrainment issue under industry and plant CRDR 2726509. knowledge using processes previously applied 1/11/2006 2005-207 Incorporate Alpha Factor Parameters for Upgrade Methodology Change -

Common Cause Modeling Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-97 AF Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 9/28/2007 2006-124 Calculation of control circuit risk based on Maintenance Implemented model individual components may overestimate corrections were neither so its risk contribution. This impact numerous nor so large that consolidates the control circuit failure significant changes to risk contribution back into the start failure insights or accident rate for motor operated pumps and DGs. sequences result 9/28/2007 2006-226 Update MSIV modeling due to DMWO Maintenance Incorporated model changes 2417258, which added redundant closing to reflect plant design solenoid on each train of hydraulics. changes consistent with ASME PRA Standard Section 1-A.2 Page 4 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 9/28/2007 2006-294 Correct mission times for DC power Maintenance Implemented model systems to better reflect support needed corrections were neither so for bringing in off-site or GTG power. numerous nor so large that Also, limit battery FTR applicability to significant changes to risk SBO conditions. insights or accident sequences result 9/28/2007 2007-140 Assumption to not credit MFW for greater Maintenance Implemented model than 30 minutes has resulted in corrections were neither so significant dominant cutsets in latest numerous nor so large that revision (C29 r15 working copy dated significant changes to risk 7/12/07) to be inappropriate. insights or accident sequences result 12/18/2008 2007-207 The Fault Tree that contained 1RCS- Maintenance Implemented model DEPRESS-2HR was deleted by impact corrections were neither so 2007-38. The HRA was inadvertently not numerous nor so large that restored. However, the HRA is called on significant changes to risk by a function event. This Impact restores insights or accident the HRA. sequences result 12/17/2008 2007-209 EDG failures need to be parsed into three Maintenance Implemented change to the categories to conform to NRC data and PRA model due to new MSPI program. industry and plant knowledge using processes previously applied 1/7/2010 2007-67 There is an inconsistency between how Maintenance Implemented model the primary safety fail open event and an corrections were neither so SLOCA are modeled for CS. The primary numerous nor so large that safety failure does not credit CS, but the significant changes to risk SLOCA does and the largest SLOCA is the insights or accident same as the primary safety fail open sequences result event hole size.

1/7/2010 2009-153 Add modeling for fuel oil transfer pumps, Maintenance Implemented change to the DFA(B)P01. MSPI is expected to have PRA model due to new these as separate components. industry and plant knowledge using processes previously applied 2/3/2010 2009-247 Add modeling for the UV relays that Maintenance Implemented change to the cause turbine trip after reactor trip. This PRA model due to new would allow use of the favorable MTC industry and plant fraction on the success branch and knowledge using processes eliminate need of the unfavorable previously applied fraction.

12/30/2010 2010-219 Use of HRA Calculator vs. manual SHARP Upgrade Methodology Change -

HRA worksheets and Dependency SHARP HRA conversion to Analysis changes. HRA Calculator 12/7/2014 2015-836 This impact documents, by reference, the Maintenance PRA Software code change changes to the internal events model from one fault tree linking from Risk Spectrum Rev 20 to CAFTA code to another with new model. code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes Page 5 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 11/16/2013 2013-151 Update internal flood PRA model to address Upgrade Capability Change -

results from associated CRAIs from CRDR Impact to Significant 3590575. Sequences (2 Orders of Magnitude difference) 11/16/2013 2015-868 Incorporate Internal Flood Model Impact Maintenance PRA Software code 2013-151 into CAFTA. change from one fault tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 11/11/2014 2018-2448 Tripping RCP Breaker Locally Maintenance Implemented model DRC R55 40OP-9ZZ19 allows for local RCP breaker trip corrections were neither with AO pre-stationed during fires in specific so numerous nor so fire zones. FPRA allows 45-60 minutes to large that significant stop RCPs which is sufficient time for AO to changes to risk insights respond locally for any fire without pre- or accident sequences staging prior to need. result 3/6/2014 CS-A6-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new cable and results provided in Report 0001-0013- selection methodology 001-002 Revision 0 (Hughes Associates) for regarding fire-induced active tripping of an overcurrent fault to the loss of active tripping Fire PRA model. capability electrical protection.

12/6/2014 PRM-B2-n/a Palo Verde Fire PRA is developed in the Maintenance PRA Software code CAFTA suite of software, which is a different change from one fault fault tree tool than Risk Spectrum. tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 9/27/2014 CS-B1-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new breaker and results provided in Report 0001-0013- coordination 001-003 Revision 1 (Hughes Associates) with methodology that also respect to breaker coordination impacted significant sequences.

Page 6 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 12/7/2014 QLS-A1-01, Based on the resolution of F&Os QLS-A2-01 Upgrade Methodology Change -

QLS-A2-02, and QLS-A2-02, using the revised qualitative New Qualitative QLS-A2-01 screening criteria Based on the resolution of Screening Methodology F&Os QLS-A2-01 and QLS-A2-02, using the employed revised qualitative screening criteria documented in the Screening and Quantification study section 4.2.1, the study was revised and documents the basis for screening any fire compartments 10/16/2014 FSS-D1-01 Incorporate Report 0001-0014-002-001 Upgrade Methodology Change -

Revision 0 for HGL New Hot Gas Layer methodology applied 10/11/2014 2018-2448 Revised sources to include transitioned Upgrade Methodology Change -

DRC T107 segmented bus duct method New Bus Duct Methodology utilized 12/6/2014 PRM-A3-01 A comprehensive re-evaluation of the Loss of Upgrade Methodology Change -

RCP Seal Cooling accident progression and New Loss of RCP Seal success criteria was conducted to bound the Cooling Modeling scope of failure scenarios Methodology.

8/27/2013 SHA-E1-01 New site specific data was subsequently Upgrade Methodology change -

collected as part of the Near Term Task Implements a different Force (NTTF) 2.1 analysis. Lettis Consultants methodology for seismic International, Inc. Project Report 221-PR-04 hazard evaluation than Revision 4 documents the updated seismic previously applied.

hazard evaluation for Palo Verde.

Page 7 of 11

Enclosure Attachment 2 , Table 2-3 below provides those Internal Events PRA changes that were determined to be PRA Upgrades.

Table 2-3 Identified PVNGS Internal Events PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 1998-35, 2/19/02 New HRAs in the area of Methodology New THERP HRA Events F&O HR-03 miscalibration of critical sensors. Change approach to common cause failure of miscalibration of sensors 2003-301 6/2/04 Incorporate Pressure-Induced Methodology New PI-SGTR SGTR modeling into SLB event Change Methodology tree.

2005-122 thru - 1/11/06 System Common Cause Methodology Common Cause 127, 2005-163 Modeling Changes: Change Methodology thru 2005-167, PPS, EC/WC, GT, PN, SI, CD changed from MGL 2005-170 thru - (Altfw), SG, EW, IA-GA, PK, DG, to Alpha Factor.

174, 2005-207, PB, PE and Off-Site Power, RC, 2005-97 SP, NC, DC, AF 2010-219 12/30/10 Use of HRA Calculator vs. Methodology SHARP HRA manual HRA worksheets and Change conversion to HRA Dependency Analysis Calculator Methodology changes.

Page 8 of 11

Enclosure Attachment 2 , Table 2-4 below provides the Internal Events PRA upgrades identified in RAI 09, Part (b).

Table 2-4 Peer Reviews of Internal Events PRA Upgrades Upgrade Review Change Hazard Description Upgrade Review Results / New Date Findings Internal 2/19/02 New THERP approach to Finding Level Fact and F&O Closed.

Events common cause failure Observation Closure Review Associated HR TEs of miscalibration of conducted April 19, 2017 (HR-4, HR-5, HR-6, sensors through June 23, 2017. and HR-7) met Report Date: June 23, 2017 6/2/04 New PI-SGTR Focused Scope Peer Review TBD Methodology as described in Attachment 1.

1/11/06 Common Cause TBD Methodology changed from MGL to Alpha Factor.

12/30/10 SHARP HRA conversion TBD to HRA Calculator Page 9 of 11

Enclosure Attachment 2 Attachment 2, Table 2-5 below provides those changes that were determined to be PRA Upgrades.

Table 2-5 Identified Internal Flood, Internal Fire and Seismic PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 2013-151 11/16/13 Update internal flood PRA Capability Impact to Significant Flooding model to: Change Sequences (2 Orders of Magnitude

1) Updated pipe rupture difference in results) frequency values

2) Incorporate realistic flow rates used for time dependent flood levels

3) Incorporate flood isolation actions

4) Incorporate plant modification that increased pipe length Internal CS-A6-01 (F) 3/6/2014 Cable Selection and Circuit Methodology New cable selection Fires Analysis study was revised Change methodology to incorporate the regarding fire-methodology and results induced loss of provided in Report 0001- active tripping 0013-001-002 Revision 0 capability for electrical protection.

CS-B1-01 (F) 9/27/2014 Cable Selection and Circuit Methodology New breaker Analysis study was revised Change coordination to incorporate the methodology methodology and results provided in Report 0001-0013-001-003 Revision 1 QLS-A1-01 (F) 12/7/2014 Revised qualitative Methodology New Qualitative QLS-A2-01 (F) screening criteria Change Screening Criteria QLS-A2-02 (F) documented in the Screening and Quantification study section 4.2.1 PRM-A3-01 (F) 12/6/2014 A comprehensive re- Methodology New Loss of RCP evaluation of the Loss of Change Seal Cooling RCP Seal Cooling accident modeling progression and success methodology criteria was conducted to bound the scope of failure scenarios FSS-D1-01 (F) 10/16/2014 Incorporate Report 0001- Methodology Methodology Change 0014-002-001 Revision 0 Change for HGL treatment for HGL 2018-2448 10/11/2014 Revised sources to include Methodology New segmented bus DRC T107 transitioned segmented bus Change duct methodology duct method Seismic SHA-E1-01 (F) 8/27/2013 New site specific data was Methodology Different subsequently collected as Change methodology for part of the Near Term Task seismic hazard Force (NTTF) 2.1 analysis. evaluation Page 10 of 11

Enclosure Attachment 2 , Table 2-6 provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g.,

additional findings, closure, etc.).

Table 2-6 Peer Reviews of Internal Flooding, Internal Fires and Seismic PRA Upgrades Upgrade Review Change Hazard Description Upgrade Review Results / New Date Findings Internal 11/16/13 Impact to Significant Focused- Scope Peer Review, TBD Flooding Sequences (2 Orders of as described in Attachment 1.

Magnitude difference)

Internal 3/6/2014 New cable selection Focused scope Fire PRA Peer SR CS-A6 met Fires methodology regarding Review conducted December *SR CS-C4 to be fire-induced loss of 8-12, 2014. Report Date: reviewed by augmented active tripping January 22, 2015 F&O closure review capability for electrical protection.

• Augmented F&O closure 9/27/2014 New breaker review, as described in SR CS-B1 met CC II/III coordination Attachment 1.

methodology 12/7/2014 New Qualitative SR QLS-A1 met Screening Criteria New F&O QLS-A1-01[14FS]

SR QLS-A2 met 12/6/2014 New Loss of RCP Seal SR PRM-A3 met Cooling modeling New F&O PRM-A3-01 methodology [14FS]

• SR ES-B3 to be reviewed by augmented F&O closure review 10/16/2014 Methodology Change SR FSS-D1, FSS-D4, for HGL treatment FSS-D11, and FSS-E1 all met New F&O FSS-D2-01[14FS]

10/11/2014 New segmented bus SR IGN-A7 met duct methodology Seismic 8/27/2013 Different methodology Finding Level Fact and F&O Closed.

for seismic hazard Observation Closure Review SR SHA-E1 meets CC-evaluation conducted April 19, 2017 II/III through June 23, 2017.

Report Date: June 23, 2017 Page 11 of 11

Attachment 3 Disposition of Key Assumptions/Sources of Uncertainty

Enclosure Attachment 3 Attachment 3 Disposition of Key Assumptions/Sources of Uncertainty

RAI 10

Attachment 3, Table 3-1 below describes the disposition of key assumptions and sources of uncertainty identified in the seismic PRA.

Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Human Failure Events Accessibility for completion of non- A sensitivity analysis was performed evaluating the (HFEs) during a seismic screened human failure events impact of not crediting the subject HFEs and there was event (HFE) during a seismic event is minimal impact on the CDF and LERF. Therefore, no assumed possible for all non- additional sensitivity analysis is required for 10 CFR screened HFEs besides those which 50.69.

are assumed to fail in the case where the corridor building or turbine building collapses. Both the collapse of the corridor building and turbine building and their impact on the access to the Main Steam Support Structure is considered in the Seismic PRA model. There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed.

Seismic performance Seismic-only PSFs applied to the This is considered a conservative assumption.

shaping factors (PSFs) with internal events HEPs will over-ride Therefore, no sensitivity analysis is required for 10 CFR respect to seismic-induced the flooding PSFs based on the 50.69.

flooding. consideration that the seismic events are more global events than the specific flooding events.

No additional modifications are made to the internal events HEP to consider the possibility of seismic-induced flooding events.

The Seismic PRA HFE The Seismic PRA dependency The modification of the timing available due to seismic dependency analysis analysis assumes that once an considerations may result in a longer response or accident sequence is initiated, the identification time and consequently a higher HEP.

operator action timing for a seismically induced event is similar A sensitivity analysis was performed in the seismic PRA to that of an internally induced quantification increasing all the Seismic PRA human event for main control room failure events (HFEs) derived from the internal events actions. PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

The change in CDF and LERF was 9.7% and 5.3%,

respectively. Therefore, the current Seismic PRA model used for the 50.69 Program will increase all Seismic HFEs by a factor of 3 to address uncertainty.

Page 1 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Seismic PRA Weighting There is no standardized method PVNGS uses all three accepted approaches for factors applied to three to calculate human error developing the PVNGS Unit 1 seismic PRA with more approaches probabilities (HEP) in a seismic emphasis given to the Surry method with a weighting PRA. Therefore, a mean HEP for factor of 0.7 while the other two methods are given a each basic event was calculated by lower and equal weight (i.e., 0.15). Since the Surry combining three accepted approach was a selective combination of previous approaches (Surry, Kernkraftwerk approaches and the most recently performed and Muhleberg (KKM), and Swiss published method, the greatest weight was applied to Federal Nuclear Safety the seismic HEPs developed according to it. However, Inspectorate (ENSI)) using the the Surry method has the potential to be the least following weighting factors: 0.7, conservative approach among the three methods, the 0.15, and 0.15, respectively. assumption associated with the weighting factor is an assumption that carries epistemic uncertainties. A sensitivity analysis was performed that ran the Seismic PRA model using only the KKM and ENSI approaches, equally weighted. The change in CDF and LERF was -

1.63% and 0.42%. Therefore, no additional sensitivity analysis is required for 10 CFR 50.69.

Relay chatter correlation Relay chatter between relays of This is a conservative assumption because the demand the same manufacturer, model experienced by a relay is dictated by in-cabinet number, and plant location, i.e., response and not the in-structure response spectra building and elevation were (ISRS) which the binning is based. Therefore, no assumed to be fully correlated. sensitivity analysis is required for 10 CFR 50.69.

Also, each relay identified as a control switch, push button, or motor starter are fully correlated with other generic, like components.

Simplified Relay Fragility Low risk importance relays (based This assumption is reasonable given that none of the c Parameters on Risk Achievement Worth) were values for the relays evaluated using the detailed treated with a simplified fragility fragility analysis were determined to have a c below analysis and higher importance 0.33 and most had c of around 0.5. Therefore, no relays (10 different types) were sensitivity analysis is required for 10 CFR 50.69.

treated with a detailed fragility analysis. The simplified relay chatter fragility analysis assumed a c of 0.35 based on engineering judgment.

Seismic failure of relays and For the relays modeled in the PRA analyst experience is credited in the selection of basic event mapping Seismic PRA, the basic event the appropriate internal events PRA model component associated with the seismic failure failure modes to reflect postulated seismic PRA model of the relay must be mapped to an component failure modes. This selection was performed existing internal events target by Westinghouse PRA seismic experts and reviewed by basic event. A key source of APS PRA engineers. Therefore, no sensitivity analysis is modeling uncertainty is associated required for 10 CFR 50.69.

with the mapping of seismic basic events. Failure modes postulated for the PVNGS internal events model may not fully align with their assigned seismic counterparts.

Seismic PRA uses internal The PVNGS Seismic PRA assumes The internal events PRA that was used to develop the events PRA as a starting that the internal events PRA that is Seismic PRA was evaluated separately for its PRA point used as a starting point meets the quality and was determined to meet Capability requirements of Capability Category II of the PRA standard. Therefore, no Category II of the PRA standard. sensitivity analysis is required for 10 CFR 50.69.

Page 2 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Success criteria for Seismic If not otherwise specified, the The base case Seismic PRA uses a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time PRA success criteria associated with the for the run time of mitigating equipment. A sensitivity internal events PRA logic are case was developed to assess the impact of using a 72 considered valid and applicable to hour mission time for equipment run failures. The accident sequences initiated by a change in overall CDF and LERF for this case is 2.73%

seismic event. However, a and 0.69%, respectively. Therefore, no additional standard 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time sensitivity analysis is required for 10 CFR 50.69.

may not be suitable for a seismic-induced accident scenario because of the longer time needed for offsite power recovery.

Seismic failure correlation Seismic failures are assumed to be The validity of this assumption of complete correlation completely correlated. This is still being discussed at the industry level. This is assumption implies that a single considered a conservative assumption. Therefore, no basic event is used to model the sensitivity analysis is required for 10 CFR 50.69.

seismic failure of components that are identified as pertaining to the same fragility. Theres one exception to this where failures in the steam path in the Turbine Building are not considered correlated with failures of the feedwater lines.

Seismically induced Loss of The seismically induced LOOP is The basis for this assumption is that seismically Offsite Power (LOOP) assumed to bound the fragility of induced LOOP has a generally low seismic capacity.

non-seismic class systems. This Scenarios where the non-seismic support systems incur assumption implies that a number seismically induced failures while offsite power is still of non-seismic class systems are available are considered realistic only for very low not addressed with a specific magnitude seismic events. Therefore, the most seismic failure. significant mitigating equipment will still be available.

This is considered a conservative assumption.

Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Seismic PRA LOOP recovery In the Seismic PRA, LOOP recovery It is realistic to consider that offsite power recovery is is not credited for any seismic available for low magnitude seismic events. The event above the safe shutdown selection of the SSE as a threshold between earthquake (SSE), while it is recovery/no-recovery of offsite power is arbitrary and credited with unchanged conservative. Therefore, no sensitivity analysis is probability for a seismic event required for 10 CFR 50.69.

below the SSE.

Screening of equipment in Screening of equipment in the Using a surrogate event for a number of components the Seismic Equipment List Seismic Equipment List (SEL) is that have been screened out introduces a conservative (SEL) based on fragility analysis. failure mode. The uncertainty introduced by the use of Equipment screened by the surrogate equipment for the seismic class I system is fragility team as inherently rugged judged to have a limited impact on the model.

is not modeled in the Seismic PRA Therefore, no sensitivity analysis is required for 10 CFR for their seismic induced failure. In 50.69.

order to quantitatively capture the impact of screened out equipment, generic fragility parameters for the building that housed the screened out equipment were used. The screened equipment are modeled through a surrogate basic event at a system level.

Page 3 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Operators tripping the It is assumed that the operators This is considered a conservative assumption.

reactor above operating will always trip the reactor in case Therefore, no sensitivity analysis is required for 10 CFR basis earthquake (OBE) of a seismic event above OBE if 50.69.

even the option for a controlled shutdown is allowed.

Train N Auxiliary Feedwater The AFN Pump is assumed to A sensitivity case was developed to assess the (AFN) Pump (AFN) is remain functional with small uncertainty in crediting the AFN pump and not the assumed to remain breaks or leaks at instrument associated piping network. The capacity of the AFN functional following a design tubing. The fragility analysis pump was reduced to the same system level fragility basis earthquake associated with the AFN Pump only parameters associated with the instrument air system.

addresses the pump and not the CDF and LERF increased by 0.08% and 0.03% and entire piping network. indicates little significance of uncertainty in this simplification of the analysis. Therefore, no additional sensitivity analysis is required for 10 CFR 50.69.

Main steam line relief valves Main steam line relief valves are A sensitivity case is developed to assess the impact of not explicitly included in the screened out of the analysis on the this assumption. A fully dependent seismic failure SEL. basis that the steam generator and across all 20 relief valves is modeled. CDF and LERF related piping & valves are values did not change when compared to the base case considered very rugged. For this results. This indicates that there is no significant reason, the seismic failure of the uncertainty. Therefore, no additional sensitivity analysis main steam line relief valves is not is required for 10 CFR 50.69.

modeled.

Structural failures of Structural failures of building are This is a conservative assumption since the fragility buildings assumed to result in major parameters provided are addressing the beginning of collapse and failure of all the structural failure, and a failure of limited areas of equipment housed inside the the building may result in failure of only a limited building. number of equipment inside the building. The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the CST tunnel. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

The Anticipated Transient The ATWS logic for seismic PRA Moderator Temperature Coefficient (MTC) and ATWS Without Scram (ATWS) logic assumes that the RCS pressure will pressure transient are not influenced by the fact that for seismic PRA be above the HPSI shutoff head for the event is initiated by a seismic event rather than a only a short period of time. spurious failure. Therefore, the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Page 4 of 4

Attachment 4 IDP Changes from Candidate HSS to LSS

Enclosure Attachment 4 Attachment 4 IDP Changes from Candidate HSS to LSS RAI 11 , Table 4-1 below summarizes IDP limitations described in NEI 00-04.

Table 4-1 IDP Changes from Candidate High-Safety-Significant (HSS) to Low or no Safety-Significance (LSS)

Categorization IDP Drives Step - Change Associated Element Evaluation Level NEI 00-04 HSS to Functions Section LSS Internal Events Base Not Allowed Yes Case - Section 5.1 Fire, Seismic and Other External Events Base Allowable No Risk (PRA Case - Section 5.2 Component Modeled) PRA Sensitivity Studies Allowable No

-Section 5.1 Integrated PRA Assessment - Section Not Allowed Yes 5.6 Fire, Seismic and Other Component Not Allowed External Hazards - No Risk (Non-modeled)

Shutdown - Section 5.5 Function/Component Not Allowed No Core Damage - Section Function/Component Not Allowed Yes Defense-in- 6.1 Depth Containment - Section Component Not Allowed Yes 6.2 Qualitative Considerations -

Function Allowable N/A Criteria Section 9.2 Passive Passive - Section 4 Segment/Component Not Allowed No Page 1 of 1

Attachment 5 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models

Enclosure Attachment 5 Attachment 5 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models

RAI 15

Attachment 5, Table 5-1 identifies the key assumptions and sources of uncertainty and their dispositions for internal events, internal flooding and internal fire PRA models used for the 10 CFR 50.69 Program.

Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty There are two plant systems 1. SBOGs can be aligned to multiple units 1. The existing PRA model does not modeled in the PRA that are to supply limited loads. However, credit SBOGs in more than one unit.

shared between the three units. simultaneous multiple unit station Therefore, no sensitivity analysis is They are assumed to be aligned blackout conditions are screened out required for 10 CFR 50.69.

as follows: based on low probability. 2. Since each of the three startup

1. The station blackout 2. Each 13.8 kV bus has a normal and transformers are the same, there is generators (SBOGs) are alternate startup transformer supply no difference in risk except during assumed aligned to only source. The alignment is only changed maintenance, when fast bus transfer one unit during an event. for maintenance conditions. If one unit is is blocked. As part of the unavailability

2. The switchyard and startup on its normal source and another on its sensitivity analysis for the 13.8 kV transformers that supply alternate source, they share a non-Class 1E Power System (NA) and off-site power to the units transformer winding and one unit will 4.16 kV non-Class 1E Power System are assumed aligned to the block fast transfer of their non-Class 1E (NB), APS will increase the normal breaker on each 4160V buses. In this unique condition, unavailability of fast bus transfer by a Units 13.8 kV buses. loss of one train of power in the unit factor of 3 to address the increase in Alternate power from blocking fast bus transfer will result in a risk during start up transformer another transformer is reactor trip due to loss of two reactor maintenance.

modeled for out of service coolant pumps.

conditions.

Page 1 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Reactor Coolant Pump (RCP) RCP Seal Leak or Rupture is not modeled as No sensitivity analysis is required for 10 Seal Leak or Rupture a loss of Reactor Coolant System (RCS) CFR 50.69.

Inventory safety function. Based on WCAP-15749 Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, (Reference 6) and vendor information [refer to WCAP-16175-P-A Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, (Reference 9)] the very tight clearances would limit RCS leakage into the seal package to 17 gallons per minute (gpm) per pump. WCAP-15749 was based on WCAP-16175-P-A, which the NRC endorsed. WCAP-16175-P-A specifies an assumed 17 gpm per pump seal leakage rate for Palo Verde. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA. An analysis showed that continuing to model RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF.

Loss of Coolant Accident (LOCA) NUREG/CR-6928 (Reference 7) restated the The slight variance in the range of break Frequencies results from NUREG-1829 (Reference 8). The sizes for different LOCAs is not significant LOCA frequencies are based upon expert and is judged to have minimal impact on elicitations. The LOCA sizes identified by the LOCA frequencies, within the NRC are different from those estimated for uncertainties associated with the expert PVNGS. elicitation values, and of insignificant impact. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Loss of Off-site Power (LOOP) The national LOOP data presented in the The LOOP frequencies are based on Frequency periodically updated EPRI events report recent industry data and are appropriate (Reference 13) was used to obtain point- to represent plant-specific conditions.

estimates for switchyard centered and severe SBOGs, as well as other additional electric weather related LOOP frequencies. The EPRI power supplies, are available on site to reports indicate that the generic LOOP data is mitigate LOOP. Therefore, no sensitivity subject to user modifications and screenings analysis is required for 10 CFR 50.69.

to fit the local plant designs and environmental conditions. This approach of LOOP screening is considered reasonable and necessary to avoid erroneous skewing of the LOOP data. The frequency of extreme weather LOOP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid related LOOP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 5).

Page 2 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Loss of Off-site Power at The probabilities of offsite power non- The offsite power non-recovery Switchyard (LOOP) Associated recoveries were obtained from Table 4-1 of probabilities are based on the best Non-Recovery Probabilities the draft NRC NUREG/CR-INEEL/EXT available data and are appropriate to 02326 (Reference 5). The error factors represent plant-specific conditions.

associated with LOOP frequencies and LOOP Diesel Generators, SBOGs, as well as non-recovery probabilities were obtained other additional electric power supplies, from draft NRC NUREG/CR-INEEL/EXT are available on site to mitigate LOOP.

02326 (when provided); otherwise, by using Therefore, no sensitivity analysis is available in-house statistical programs for required for 10 CFR 50.69.

lognormal and Weibull distributions.

Battery Life Assumptions The PVNGS batteries are conservatively The PRA model used to support the 10 CFR assumed to be discharged after 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 50.69 Program will be controlled by PVNGS even though greater margin is available. procedures to reflect the as-built, as-79IS-9ZZ07 Extended Loss of All Site AC operated plant condition. Therefore, no Guideline, Modes 1-4 (Reference 10), Appendix sensitivity analysis is required for 10 CFR A is available for load shedding during an 50.69.

Extended Loss of AC Power (ELAP) to extend Class 1E 125 VDC (PK) battery life in order to provide power to a reduced set of loads, allowing control room operation of Atmospheric Dump Valves (ADVs) and the steam driven Train-A Auxiliary Feedwater pump (AFA-P01).

This is the only battery load shedding strategy employed at the PVNGS units. The battery load-shedding strategy results in a safe stable end-state at the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time and supports a minimum of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> of ELAP conditions with the expectation that the 480V FLEX generators are deployed and operational within 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> to restore AC power to the battery chargers. 4160V portable generators are also available to restore AC power to the unit.

The 79IS-9ZZ07 Extended Loss of All Site AC guideline was issued after the PRA Model of Record utilized for the LAR. The impact to the PRA Model of this new guideline will be evaluated in accordance with the PRA Model Control procedure. The evaluation will consider, at minimum, the effects of extending battery life, applicability to specific ELAP scenarios, and the impact of shed loads.

All flood scenarios on the 40ft A cutset review showed that the contribution This is a conservative approach and and 51ft elevations of the of Fire Protection (FP) initiators is very low would not have a significant impact on Auxiliary Building assume that a and that the Internal Flood results are not the baseline Internal Flood model.

pipe failure drains the Refueling being skewed by this conservatism. Therefore, no sensitivity analysis is Water Tank (RWT). required for 10 CFR 50.69.

A single internal events PRA There are no significant differences between It is a realistic assumption that the Unit 1 model was developed to the units for Internal Flood. The Unit 1 SSC designators are used, since there are quantify the plant flood risk for System, Structure, or Component (SSC) no major differences between the three multiple units. designators were used in the Internal Flood units in terms of internal flooding.

model. It was therefore assumed that the Therefore, no sensitivity analysis is quantification results are applicable to all required for 10 CFR 50.69.

units.

Page 3 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty All components within a flood This is a conservative assumption that This is a conservative approach that area where the flood originates simplifies the impacted component list. simplifies the impacted component list.

were assumed susceptible and Uncertainty exists where exactly the flood Therefore, no sensitivity analysis is failed as a result of the flood, would occur, the impact due to the geometry required for 10 CFR 50.69.

spray, steam, jet impingement, of the room and equipment, and the pipe whip, humidity, direction of the spray or splash for a given condensation and temperature scenario. This assumption raises CDF.

concerns except when component design (e.g.,

waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect.

Block walls are not credited in Unless a treatment is non-conservative, the This has no impact and is of low the analysis and are treated as block walls are analyzed on an individual consequence. Therefore, no sensitivity typical plant walls. basis. The amount of water that could flow analysis is required for 10 CFR 50.69.

through the gaps is unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment.

Breaks in pipes less than or The basis for this assumption is as follows: This is a conservative approach.

equal to two inches in 1. Provides a practical limit to bound the Therefore, no sensitivity analysis is equivalent diameter were only scope of the analysis to potentially large required for 10 CFR 50.69.

considered if the break would flow rate and significant consequence directly result in a plant trip or events.

result in a flood induced 2. Pipe sizes of less than or equal to two equipment failure that would inch diameter do not accurately reflect result in a plant trip or plant fluid system flood impacts (i.e. two immediate shutdown. inch diameter pipes produce significantly smaller flow rates).

3. At low flow rates, typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful. Such conditions enhance operator actions significantly to successfully mitigate the breaks in small bore pipes.

However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events. Specifically these events are considered in rooms without drains. Piping less than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented.

Closed-loop systems and tanks This is a conservative approach that allows This is a conservative approach.

were assumed to for the consideration of all consequences and Therefore, no sensitivity analysis is instantaneously release the does not require time based calculations. required for 10 CFR 50.69.

entire system inventory Control Room staff would be Human Error Probability (HEP) and This is a conservative approach.

unable to respond effectively to Performance Shaping Factors (PSF) Therefore, no sensitivity analysis is multiple events immediately adjustments were made during the early required for 10 CFR 50.69.

following the flooding event stages of a flooding event to account for the additional stress influencing factors. The CDF is higher with this assumption.

Page 4 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty No addition to the Control Room Operator actions to isolate the flood source It is a realistic assumption that there crew is credited early into a are required shortly after detecting that a would be no addition to the Control Room flood event when assessing Pressure Boundary Failure (PBF) has crew early into the flood event when human actions. occurred. Often when responding to flood assessing human actions. Therefore, no events operators are responding to multiple sensitivity analysis is required for 10 CFR alarms. 50.69.

It is assumed that pipes that are The assumption is conservative as it includes This is a conservative approach.

larger than 3" were capable of additional piping that may not be conducive Therefore, no sensitivity analysis is producing major floods unless it to major flooding. Since major floods are not required for 10 CFR 50.69.

was determined that the piping a major contributor to the Pressure Boundary was not capable of producing a Failure frequency, its contribution to risk major flood. would be considered minimal.

External tanks were not External tanks that are ruptured would not There is no significant impact on the considered as a flood source normally propagate into the plant. There model. Therefore, no sensitivity analysis unless there is a normally were no tanks identified outside the is required for 10 CFR 50.69.

available pathway into the plant protected area in this Internal Flood PRA whereby the tank contents could whose contents could propagate into the empty into a room within the plant. It was assumed that the impact of an main plant structures. external tank rupture was bounded by the evaluation performed for internal events.

Breach of an external tank was assumed to discharge to the yard area and there would be no flood-induced failures of PRA related components.

Floods are assumed to fail all Cases in which equipment is deemed as This assumption is a conservative equipment in the initiating room sufficiently high or flood barriers are not modeling technique that is used to and then propagate out of the expected to retain water to sufficient flood initially fail all equipment within an room to surrounding flood levels are treated on an individual basis. initiating compartment and if needed, areas. Additionally, splitting the flood areas would further refinement is applied to dominant generate an unreasonable number of cutsets to provide more realistic results.

scenarios with no added insight. The top Therefore, no sensitivity analysis is cutsets are impacted by this assumption and required for 10 CFR 50.69.

therefore very specific isolation actions were taken. The flood isolation actions for dominant cutsets were developed and proceduralized to mitigate flooding consequences. Supporting flood analyses for these isolation actions have been reviewed and documented in engineering evaluations and PRA studies. The PRA model reflects the as-built/as-operated plant configuration.

Floods are assumed to Water will flow down the path of least It is a realistic assumption and is of low propagate down pipe chases resistance therefore a pipe chase is the consequence. Therefore, no sensitivity rather than down stairwells in preferred path over a stairwell with a door in analysis is required for 10 CFR 50.69.

situations where pipe chases are front.

not surrounded by a curb and/or a door must be opened to enter into the stairwell.

Floods are assumed to The hydrostatic load that a door can handle It is a realistic assumption and is of low propagate through doorways is based on whether the door closes against consequence. Therefore, no sensitivity which open out, away from the the frame or away (with relation to the room analysis is required for 10 CFR 50.69.

initiating flood area more readily that the flooding initiates). A door that is rather than doorways which against the frame can withstand a greater open in, towards the initiating load as opposed to away from the door flooding area. frame.

Page 5 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Floor drains were assumed to be This assumption is based on the expectation It is a realistic assumption and is of low capable of controlling water that a spray event will not result in a consequence. Therefore, no sensitivity levels for spray events. significant accumulation of standing water. analysis is required for 10 CFR 50.69.

During plant walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank.

Such events were screened out as potential flooding sources.

The piping layout for flood To the extent possible, the similarities were It is a realistic assumption and is of low sources included in the Internal confirmed during the plant walkdowns. consequence. Therefore, no sensitivity Flooding PRA was estimated to Therefore, Units 2 and 3 pipe lengths were analysis is required for 10 CFR 50.69.

be similar for all three units. assumed to be identical to Unit 1 piping lengths. There are no major differences between the three units.

It is assumed that if a PBF were There are no operator procedures for This is a conservative assumption and is to occur in the Safety Injection isolating a flood event, therefore the most of low consequence. A sensitivity analysis (SI) or Chemical & Volume conservative and bounding location to isolate was performed in which each flooding Control (CH) system piping, that a flood of the SI or CH is one of the two pipe isolation HEP associated with the SI or CH the operator would isolate the headers. By isolating at this point it results in system piping (a total of four) for these flood at one of the two pipe the loss of at least one train of the ECCS. flooding isolation events were modified headers connecting the This does cause a trip. Therefore the overall from their original HEP of 5E-02 or less to Refueling Water Tank (RWT) to impact on the model is small. a highly conservative screening value of the CH and SI systems. 1.00. The change in overall CDF and LERF for this case is 0.6% and 0.4%,

respectively. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

It is assumed that spurious Spurious actuation of a system relief valve This is of low consequence. Therefore, no actuation of system relief valves was not determined to be a credible flooding sensitivity analysis is required for 10 CFR would discharge a limited source because the inventory that was 50.69.

amount of inventory to a released would be retained within the discharge tank and such events flooding area and would not lead to an were screened out as potential applicable initiating event. The risk is flooding sources. considered negligible as this is not considered to be a significant source of inventory.

Limited or no access to an area There was no credit taken for mitigation This is of low consequence. Therefore, no where flooding initiation occurs when the equipment relied on for mitigation sensitivity analysis is required for 10 CFR was assumed. was located in the flooding initiation area. 50.69.

Operators cannot get into flooded areas.

Only one internal flooding The occurrence of simultaneous multiple It is a realistic assumption and is of low initiating event is assumed to independent internal flooding events was consequence. Therefore, no sensitivity occur at a time. considered to be very unlikely and was not analysis is required for 10 CFR 50.69.

considered in this evaluation. This is consistent with PRA modeling.

The breach of isolation This is a simplifying assumption that has a This is a conservative assumption and is barrier(s) that may result in a negligible impact on the model. Propagation of low consequence. Therefore, no maintenance-induced flooding pathways were made to be conservative for sensitivity analysis is required for 10 CFR event was assumed to have no all scenarios 50.69.

impact on altering the propagation paths related to other flooding mechanisms (i.e.,

pipe failure) for the flooding source.

Page 6 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty The indirect effects of a PBF on Closed looped systems were considered to be This is a conservative assumption and is the operability of a closed normally operating and provides cooling to of low consequence. Therefore, no looped system were considered equipment that is relied on to maintain the sensitivity analysis is required for 10 CFR to be immediate. plant in a power production state. It was 50.69.

therefore assumed that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity. A PBF would drain the system and in most cases an operator action to isolate the PBF would not be feasible. This assumption is conservative and raises CDF.

The spill rate resulting from a For a potentially unlimited source, a PBF that It is a realistic assumption and is of low PBF of a potential unlimited resulted in a spray event (<100 gpm) would consequence. Therefore, no sensitivity flooding source that causes a take an extraordinary amount of time to analysis is required for 10 CFR 50.69.

spray event is low enough (i.e., cause a loss of that system. Additionally,

<100 gpm) to have no given that for most of the large nearly significant impact on the unlimited sources the makeup capabilities of operation of the affected the system would generally exceed the flow system. rate generated by a spray event. It was therefore assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (i.e. the CH system) this assumption was not valid.

The flow rate from a PBF is The spill rate resulting from a PBF of piping is This is a conservative assumption and is assumed static at the maximum considered to be the highest flow rate of low consequence. Therefore, no possible rate and the scenario is possible from the system or piping, and for sensitivity analysis is required for 10 CFR only ended when the source was tank is was assumed to be constant at an 50.69.

exhausted or isolated. assumed flow rate, and for systems requiring pumps is considered the realistic pump flow rate, for the particular break in the originating flooding area until the flooding source was isolated or its water supply was limited or exhausted.

The accumulation of flood water in a flooding area was considered halted when the flooding source was terminated, or when outflow from the flooding area matches or exceeds the inflow of flood water to the flooding area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding.

Spill rates were assumed to fall within the following categories:

• Spray events: 100 gpm

• Flooding events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)

• Major flooding events: greater than 2000 gpm (or the maximum capacity of the system, whichever is lower)

Page 7 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty The treatment of main steam Recovery of feedwater is important for This is of low consequence. Therefore, no line break and main feedwater secondary side heat removal. The internal sensitivity analysis is required for 10 CFR line break internal events events analysis was believed to provide 50.69.

analysis was assumed to sufficient analysis to be used in the internal address the impact of these flooding model.

events in assessing whether main feedwater can be recovered following a reactor trip.

It was assumed that minimal or The flooding HRA dependency analysis did This is of low consequence. Therefore, no no dependency existed between not include large early release specific HFEs. sensitivity analysis is required for 10 CFR flood-specific and large early HFEs specific to large early releases (i.e., 50.69.

release specific Human Failure post-core damage operator actions) are Events (HFEs). generally performed several hours after the initiating event occurs.

No dependency between early and late operator actions. All HFE dependency analyses are evaluated in accordance with NUREG/CR-1278 Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, (Reference 11) and meet all requirements found in ASME/ANS RA-Sa-2009 (Reference 2). There is no impact on the model.

The fire areas defined by the Fire areas are required by regulation to be It is a realistic assumption and is of low Fire Hazards Analysis (which is sufficiently bounded to withstand the hazards consequence. Therefore, no sensitivity contained in the UFSAR, associated with the area as defined in analysis is required for 10 CFR 50.69.

Sections 9B.2.1 through Generic Letter 86-10 (Enclosure 1 Section 4).

9B.2.22) will substantially Fire zone boundaries are similarly assumed contain the adverse effects of adequate; however, because fire zones have fires originating from any a lesser pedigree than fire areas, their currently installed fixed ignition boundaries are verified adequately in this source or reasonably expected notebook by a fire hazard analysis (FHA) transient ignition source. Fire review and plant walkdowns. Fire zone zone boundaries are similarly boundaries that appear unable to withstand assumed adequate or combined. the fire hazards within the zone are combined. The fire PRA utilizes fire compartments which generally align with fire zones, but may be a combination of several fire zones.

Systems and equipment not The assumption that any fire fails all It is a realistic assumption and is of low credited in the fire-induced risk equipment lacking cable routing information consequence. Therefore, no additional model (e.g., systems for which has the potential to affect the assessed fire sensitivity analysis is required for 10 CFR cable routing will not be risk. The assumption that any fire will 50.69.

performed) are assumed to be minimally result in a loss of Main Feedwater failed in the fire-induced risk and subsequent reactor trip likely adds model. These systems and conservatism to the Fire PRA results.

equipment are failed in the However, the degree of conservatism is worst possible failure mode, relatively small compared with other including spurious operation modeling uncertainties, since Main Feedwater will trip for most transient events.

It is assumed that any fire will minimally result in a loss of The impact of these assumptions was Main Feedwater and subsequent evaluated by a sensitivity analysis case reactor trip. This is a simplifying which concluded that the risk reduction due and conservative assumption to crediting all components assumed always and is typical of Fire PRAs. failed was small.

However, it may not be true for all fires.

Page 8 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty It is assumed that the Reactor RPS design is sufficiently fail-safe and It is a realistic assumption and is of low Protection System (RPS) design redundant to preclude fire-induced failure to consequence. The low frequency of a fire is sufficiently fail-safe and scram: Consistent with the guidance in occurring coincident with the low redundant to preclude fire- NUREG/CR-6850 Section 2.5.1 (Reference probability of independent failure to induced failure to scram, or 12), type of sequences that can be generally scram results in a negligible contribution random failure to scram during eliminated from consideration in Fire PRA to fire risk. Therefore, no sensitivity a fire event, as a risk significant include sequences for which a low frequency analysis is required for 10 CFR 50.69.

contributor. argument can be made, and uses ATWS as a specific example, because fire-induced failures will almost certainly remove power from the control rods, resulting in a trip, rather than cause a failure to scram condition.

Properly sized and coordinated Electrical protection design calculations This is a conservative approach because electrical protective devices are provide the documentation of the electrical credited cable lengths have a margin of assumed to function within their coordination between overcurrent protective 20% or more applied to the credited design tripping characteristics, devices. An evaluation was performed to cable lengths to ensure that applicable thus preventing initiation of assess the Fire PRA power supply raceways were identified. Additionally, secondary fires through circuit coordination requirements in accordance with the fire-induced impact is modeled within faults created by the initiating NUREG/CR 6850 (Reference 12), and the credited cable length. Therefore, no fire. provides a link to relevant PVNGS electrical sensitivity analysis is required for 10 CFR coordination calculations that demonstrate 50.69.

selective tripping capability for each credited Fire PRA power supply. When selective tripping cannot be demonstrated, the current fire PRA model credits cable lengths to limit fault current that fails a power supply.

It is assumed that Fire PRA All raceways containing cables were assigned It is a realistic assumption and is of low targets were assigned the a radiant heat flux damage threshold of consequence. It was concluded that appropriate radiant heat flux 6kW/m2 and 205 °C. Raceways containing minimal benefit could be obtained by damage and temperature cables with thermoset insulation only may be further analysis to identify and model damage criteria depending on assigned a radiant heat flux damage raceways containing only thermoset the cable insulation information threshold of 11 kW/m2 and 330 °C but have insulation. Therefore, no sensitivity available. In other words, all been initially assigned the thermoplastic analysis is required for 10 CFR 50.69.

raceways containing cables with damage thresholds. A brief review of the thermoplastic or unknown cable dominant scenarios identified the existence insulation were assigned a of thermoplastic insulated cables within the radiant heat flux damage target raceways.

threshold of 6kW/m2 and 205

°C. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thresholds.

Page 9 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Plant modifications and recovery All plant modifications credited in the LAR The PRA model reflects the as-built/as-actions were assumed in the submittal baseline probabilistic risk assessment operated plant configuration. Therefore, base case Fire model at the time (PRA) to address fire risk have been physically no sensitivity analysis is required for 10 of the LAR submittal. implemented in all three Units. Any model CFR 50.69.

and/or documentation updates as a result of these physical modifications are being tracked via our PRA model impact database.

All fire human failure event (HFE) recovery actions have been derived from the Internal Events PRA model. No unique HFEs have been created for the fire model. The augmented fire HFEs meet requirements found in Table 4-2.10-1 of ASME/ANS RA-Sa-2009 (Reference 2).

Page 10 of 10

Attachment 6 Other External Hazards Screening Peer Review Findings

Enclosure Attachment 6 Attachment 6 Other External Hazards Screening Peer Review Findings

RAI 17

Attachment 6, Table 6-1 documents the other external hazards screening peer review findings and their dispositions.

Table 6-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT-D1 01 The walkdown resulted in 1. Erosion of spoils piles from the excavation of the 45-acre unresolved issues. It is reservoir into the East Wash drainage path next to the East assumed these issues need to Wash Embankment has negatively impacted the design be resolved successfully to drainage through this area. (The plant had previously allow the screening process to identified this issue.) This item applies to all three units.

be complete and verified. Disposition: APS committed to removing the spoils piles from Until the issues are resolved, the vicinity of the East Wash channel in 2013 and the hazards cannot be subsequently removed those spoils piles. Therefore, this item considered screened. The is resolved.

issues are unanalyzed. The 2. The safety-related structures roof design (drains and report implies that a additional scuppers or holes in the parapet walls to limit the successful resolution is water level to 6 in.) did not appear to provide many holes in forthcoming, but no the parapet walls to limit water depth to 6 in. The design of commitment date is provided. the scuppers should be reviewed with respect to a probable Based on the information maximum precipitation (PMP) event. This item applies to all provided, the issues could three units.

remain unresolved for the life Disposition: A Palo Verde Action Request 3952605 concluded of the plant. If this is the that there was a nonconformance with respect to the PVNGS case, the current condition Updated Final Safety Analysis Report (UFSAR) description.

should be evaluated and However, a subsequent Engineering Evaluation (EWR shown to be compliant with 3956860) analyzed the scupper drainage capacity and the screening criteria. concluded that the roof loading would not exceed 30 psf (6 in.

of water) given the design basis 50-y/6-h PMP. Therefore, the as-built roof drainage design met the 1975 SER requirements.

This item is resolved.

3. The onsite ammonia tanks (1-M-SCN-T03C and D) inside the Turbine Building appear to contain NH2OH and Carbohydrazide rather than ammonia. This needs to be clarified with the authors of the control room habitability evaluations and inventory of onsite hazardous materials calculations. This item applies to all three units.

Disposition: Follow-on discussion indicated that additional contents within those tanks vary as needed. However, assuming ammonia as described is appropriate in the control room habitability analyses. Therefore, this item is resolved.

Page 1 of 2

Enclosure Attachment 6 Table 6-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT-D1 01 4. The onsite storage of PolyFloc AE1701 walkdown indicated (cont.) that the 11,000 gal tank at the Water Resources Facility (WRF) is no longer used. Only the 6,000 gal tank is used. This should be discussed with the authors of the control room habitability evaluations and inventory of onsite hazardous materials calculations. This item is conservatively assumed to apply to all three units. (Unit 1 is closest to the WRF storage location.)

Disposition: Assuming the 11,000 gal tank is being used is conservative. Also, it preserves the option of using it if the 6,000 gal tank system becomes unavailable. Therefore, this item is resolved.

5. The drainage ditch between Building A (Administrative building) and the parking lot south of the switchyard has a cement traffic barrier in it. The reason for this is not apparent.

This item applies only to Unit 3.

Disposition: Because of the location of the barrier drainage ditch, any overflow would be routed towards the southeast boundary of the site (based on site drainage design drawings) and would not be expected to impact Unit 3 (nearest to the barrier) or the other units. Therefore, this item is resolved.

EXT-D1 02 PVNGS is a three unit site. These issues applied to all three units and were resolved for The external hazards all three units as indicated above in F&O EXT-D1-01.

evaluation presumably applies to all three sites equally. The walkdown identifies 3 issues in the YARD [#1, #4, and

1. 5], which could be preferentially worse for one unit. Issue #2 and #3 should specify if this occurs at each unit, or one unit applicable to the whole site. There is no discussion of unit dissimilarities, based on orientation.

EXT-E2 01 For the analysis of the The calculations of hazard frequency and CCDP were transportation accident subsequently added to Section 6.35 of the final report and the resulting from the shipment tornado missile impact was documented in Section 6.7 of the of chlorine gas by railcars and revised report. After these changes, these events continued onsite delivery of ammonium to meet the screening criteria and the finding is now resolved.

hydroxide, the actual calculations of the hazard frequency and CCDP were not presented in Section 6.35 of the report. The bounding calculation performed for the tornado missile impact was not sufficiently documented in Section 6.7 of the report.

Page 2 of 2

Attachment 7 Internal Fire Focused Scope PRA Peer Review

Enclosure Attachment 7 Attachment 7 Internal Fire Focused Scope PRA Peer Review

RAI 21

Attachment 7, Table 7-1 below provides the internal fire focused scope peer review finding and its disposition relevant to implementation of the NRC-accepted fire PRA methods described in RAI 21-APLA.

Table 7-1 Internal Fire Focused Scope PRA Peer Review Observation ID /

Finding Description Documentation of Resolution F&O Number CF-A1-01 [14FS] A review of the FSS database, design drawings, and circuit This finding has been resolved by PRA failure supporting documentation identified several instances model and documentation changes. The where an inappropriate circuit failure probability was assigned in FSS database, circuit failure review the Fire PRA. worksheets and Cable Selection and

• Circuit failure review worksheets, highlighted elementary Circuit Analysis [CS/CF] study have been diagrams, and the FSS database for valve CHN-LV-110, revised to correct the unintended associated with BE 1CHELV110P-AVFC Failure of AOV Valve application of the circuit failure LV110P fails to Isolate following ISLOCA were reviewed. The probability.

review determined that cables 1ECH58NC1XA, 1ECH58NC1XB, and 1ECH58NC1XC were assigned an A review of the specific circuit types (i.e.,

aggregate CF probability of 0.56, based on Table 4-1 of instrumentation circuit failure NUREG/CR-7150 for SOV, single break, ungrounded dc, probabilities incorrectly assigned and thermo-set cable. Upon review of the circuit, the cables of MOV power cable identification and concern appear to be associated with instrumentation assignment of circuit failure probabilities) signals related to the control of the valve (4-20 mA signal for similar component type was cable as opposed to 125 vdc control cable). As discussed in performed.

Section 3 and 7.3 of NUREG/CR-7150, conditional spurious probability estimates should not be applied to The Cable Selection and Circuit Analysis instrumentation circuits. [CS/CF] study was revised to provide additional guidance when performing

• Circuit failure review worksheets, highlighted elementary cable failure mode likelihood calculations diagrams, and the FSS database for valve Component for instrument and power cables.

Functional State 1JHPBUV2:Closed:Closed, associated with Additionally, this finding is associated BE 1HPBP36V02-MV-RC Failure of MOV Globe VLV HPB- with SRs determined met to Capability UV002 to Remain Closed for CTMNT Isolation were reviewed. Category II and will be included in an The component is a normally closed, desired closed MOV. upcoming augmented F&O Closure The review determined that the power cables for this valve Review for determination of closure.

were identified as required for the valve functional state, although the power cables (i.e., 1EHP02BC1KA, and 1EHP02BC1KC) are not required for the valve to remain closed. In addition, these cables were assigned a spurious operation probability from Table 4-3 of NUREG/CR-7150, which is intended for grounded MOV single break control circuits (not power cables). Other instances were identified during the review where MOV power cables for passive MOVs that were analyzed only for spurious operation had their power cables identified as required and assigned spurious operation probability.

Page 1 of 2

Enclosure Attachment 7 Table 7-1 Internal Fire Focused Scope PRA Peer Review Observation ID /

Finding Description Documentation of Resolution F&O Number Identification of incorrect spurious operation probability for specific types can underestimate fire risk (e.g., AOV Valve LV110P example) or overestimate fire risk (e.g., MOV Globe VLV HPB-UV002 example).

Recommendation: Review the specific circuit types (i.e.,

instrumentation circuit failure probabilities incorrectly assigned and MOV power cable identification and assignment of circuit failure probabilities) for these components and other similar component types. Update the methodology and results in the Fire PRA Notebook Fire PRA Cable Selection and Circuit Analysis and any other necessary supporting documents and databases.

Page 2 of 2

Attachment 8 PRA Risk Criteria per NEI 00-04

Enclosure Attachment 8 Attachment 8 PRA Risk Criteria per NEI 00-04 RAI 23 , Table 8-1 below lists the criteria from NEI 00-04 that will be used to determine PRA-based high safety significant (HSS) vs low safety significant (LSS) ranking for components.

Table 8-1 PRA Risk Criteria per NEI 00-04 PRA Base Case Criteria Ranking HSS Sum of F-V for all basic events modeling the SSC of interest, including common cause events > 0.005 HSS Maximum of component basic event RAW values > 2 HSS Maximum of applicable common cause basic events RAW values > 20 LSS Any modeled SSCs that do not meet any of the HSS criteria Page 1 of 1

10 CFR 50.69 10 CFR 50.90 MARIA L. LACAL Senior Vice President Nuclear Regulatory and Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 Tel 623.393.6491 102-07690-MLL/MDD May 9, 2018 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

References:

1. Arizona Public Service Company (APS), License Amendment Request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, for Palo Verde Nuclear Generating Station, Units 1, 2, and 3, dated July 19, 2017, Agencywide Documents Access and Management System (ADAMS) No. ML17200D162

2. NRC Letter, Request for Additional Information License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components, dated April 13, 2018, ADAMS No.

ML18099A007

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 APS Response to Request for Additional Information for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components On July 19, 2017, APS submitted a license amendment request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment Of Structures, Systems, and Components for Nuclear Power Reactors, Reference 1. During the week of February 20, 2018, the NRC staff conducted an audit at the Palo Verde Nuclear Generating Station (PVNGS) to gain an understanding of the risk-informed categorization process and to review the probabilistic risk assessment model that will be used by APS for this risk-informed LAR. The NRC staff determined A member of the STARS Alliance Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

102-07690-MLL/MDD ATTN: Document Control Desk U.S. Nuclear Regulatory Commission APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Page 2 that additional information is required in order to complete their review and a clarifying phone call was held with APS to discuss the information needed. The NRC questions and the APS responses to the Request for Additional Information (RAI) questions are provided in the enclosure to this letter.

Several of the responses by APS refer to additional work that will be completed subsequent to this response letter. This work will be completed prior to implementation of the 10 CFR 50.69 process at PVNGS. As described in Attachment 1 to the enclosure, a new license condition is proposed to address this work required to be completed prior to implementation of the 10 CFR 50.69 categorization process at PVNGS.

APS has reviewed the information supporting a finding of no significant hazards consideration that were previously provided to the NRC in the enclosure of Reference 1. APS has concluded that the information provided in this response does not affect the basis for concluding that the proposed license amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92.

Should you need further information regarding this letter, please contact Michael DiLorenzo, Nuclear Regulatory Affairs, at (623) 393-3495.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on______May 9, 2018 (Date)

Sincerely, MLL/MDD/PJH/sa

Enclosure:

Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components

102-07690-MLL/MDD ATTN: Document Control Desk U.S. Nuclear Regulatory Commission APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Page 3 cc: K. M. Kennedy NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS C. A. Peabody NRC Senior Resident Inspector for PVNGS M. D. Orenak NRC NRR Project Manager for PVNGS

ENCLOSURE Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components

Table of Contents Enclosure - Response to Request for Additional Information (RAI) for License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components - Palo Verde 10 CFR 50.69 PRA Implementation Items - Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models - Disposition of Key Assumptions/Sources of Uncertainty - IDP Changes from Candidate HSS to LSS - Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding, and Internal Fire Models - Other External Hazards Screening Peer Review Findings - Internal Fire Focused Scope PRA Peer Review - PRA Risk Criteria per NEI 00-04

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Introduction On July 19, 2017, APS submitted a license amendment request (LAR) to adopt Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-Informed Categorization and Treatment Of Structures, Systems, and Components For Nuclear Power Reactors. To support its safety evaluations, the NRC staff conducted an audit at the Palo Verde Nuclear Generating Station (PVNGS) in Tonopah, Arizona, from February 20-23, 2018. The NRC staff has reviewed the LAR and determined that additional information is required in order to complete the review. These request for additional information (RAI) responses are provided in this enclosure. The APS response is provided after each RAI.

Request for Additional Information (RAI) 01 APLA RG 1.200, Revision 2, PRA Acceptability, F&O Closure

a. Regulatory Guide (RG) 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (ADAMS Accession No. ML090410014), provides guidance for addressing probabilistic risk assessment (PRA) acceptability including addressing the need for the PRA model to represent the as-designed or as-built, as-operated plant through: (1) a discussion of the resolution of the peer review (or self-assessment, for peer reviews performed using the criteria in Nuclear Energy Institute (NEI) 00-02, Revision 1, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, May 2006 (ADAMS Accession No. ML061510619),

findings and observations that are applicable to the parts of the PRA required for the application; and (2) documenting the use of the parts of the PRA that conform to capability categories or grades lower than deemed required for the given application.

Without the described information above, the NRC staff is unable to complete its review. Please provide the following:

i. For the PRA quality requirements addressed in the self-assessment, please confirm the scope of the facts and observation (F&O) closure review included review of the self-assessment findings of the internal events PRA (IEPRA) against the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, supporting requirements (SRs) at Capability Category II (CC- II), as qualified by RG 1.200, Revision 2.

ii. If the F&O closure review did not include review of findings from the self-assessment of the IEPRA against the ASME/ANS RA-Sa-2009 SRs at CC-II, as qualified by RG 1.200, Revision 2, then please provide all the self-assessment findings and a disposition for each finding as it pertains to this application.

Page 1 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

b. Section 3.3, PRA Review Process Results [10 CFR 50.69(b)(2)(iii)], of the LAR, the licensee stated that a F&O closure review was performed in June 2017 to assess the closure of all finding level F&Os from these peer reviews.

Additionally, the NRC staff determined that APS performed a self-assessment of the IEPRA model in March 2011 to address the PRA quality requirements not considered in the Combustion Engineering Owners Group (CEOG) peer review.

Appendix B, NRC Position on the NEI Peer Review Process (NEI 00-02), of RG 1.200, Revision 2, provides guidance that states the results of the self-assessment are used to demonstrate the technical adequacy of a PRA for an application, differences between the current version of the standard (i.e.,

ASME/ANS Ra-Sa-2009) as endorsed in RG 1.200, Appendix A, and the earlier version (i.e., ASME RA-Sb-2005) be identified and addressed. The licensees peer review performed in 1999 was performed using the CEOG peer review process prior to the inception of the ASME/ANS RA-Sb-2005 PRA Standard.

i. For the self-assessment, please clarify how the 1999 Peer Review performed was assessed against the current version of the ASME/ANS PRA standard, as qualified by RG 1.200, Revision 2. Please provide the date to confirm when the self-assessment was performed.

APS Response to RAI 01

a. The self-assessment of the internal events PRA (IEPRA) (Engineering Evaluation 3579223, Revision 1) was performed in March 2011 against the requirements in ASME/ANS RA-Sa-2009 and NRC clarifications in RG 1.200, Revision 2, Appendix A. The self-assessment identified four supporting requirements (SRs) as not met to Capability Category (CC) II: IE-A8, SY-A4, SY-C1, and SY-C2.

The F&O closure review in June 2017 included a review of the issues associated with the four not met SRs from the self-assessment (page A-34 of the F&O closure review report). An augmented F&O closure review will be conducted as described in Attachment 1 to better document the scope of the F&O closure review as including the self-assessment results.

b. A self-assessment of the IEPRA model was completed by APS in March 2011 to assess the gaps between the CEOG peer review results and the current version of the ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. The self-assessment reviewed all IEPRA SRs in the ASME/ANS RA-Sa-2009 and RG 1.200, Revision 2, guidance to Capability Category II. The results of the self-assessment were documented in Engineering Evaluation 3579223, Revision 1.

Page 2 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 02 APLB - Seismic PRA RG 1.200, Revision 2, PRA Acceptability, NEI 12-13 Section 3.2.3, Seismic Hazards, of the LAR states, in part, that [t]he categorization process for seismic hazards will use a peer reviewed plant-specific Seismic PRA [SPRA] model in accordance with RG 1.200, Revision 2. The NRC staff was unable to determine, which peer review guidance was used. Please indicate, which guidance document was used to perform the SPRA peer review.

If the peer review was performed using guidance not described in RG 1.200, Revision 2, such as NEI 12-13, External Hazards PRA Peer Review Process Guidelines (ADAMS Package Accession No. ML122400044), please provide the following additional information to justify the use of NEI 12-13:

a. Please describe how the qualifications of the SPRA peer review team comply with the peer review requirements in ASME/ANS RA-Sa-2009, Sections 1-6.2 and 5-3.2, as endorsed in RG 1.200, Revision 2.

b. Please identify any unreviewed analysis methods (UAMs) used in the SPRA, as determined by the peer review team, and describe each UAM with a level of detail appropriate for the NRC staff to evaluate its acceptability.

c. Please describe if the SPRA relies on expert judgment to meet any SR and, if so, demonstrate conformance to the expert judgment requirements of ASME/ANS RA-Sa-2009, Section 1-4.3. Also, please cite any information from the peer review report related to the evaluation of the use of expert judgment by the peer review team and whether the peer review team found the use of expert judgment to be appropriate.

d. Please clarify whether the SPRA was reviewed against CC-I for any SR.

Provide a list of all SRs that were reviewed against CC-I or found to meet only CC-I without an associated finding. For each such SR, please justify why not meeting the SR at CC-II does not impact this application.

e. Please clarify whether an in-process peer review was performed for the SPRA. If an in-process approach was utilized, confirm that (i) the approach met the requirements for an independent peer review as stated in ASME/ANS RA-Sa-2009 and the process described in NEI 12-13; (ii) a final review by the entire peer review team occurred after the completion of the SPRA; and (iii) peer reviewers remained independent throughout the PRA development activity as discussed in the enclosure to the letter dated November 16, 2012, from Mr. Donald G. Harrison, NRC to Mr. Biff Bradley, NEI (ADAMS Accession No. ML12321A280).

Page 3 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 02 The PVNGS Seismic PRA (SPRA) peer review was performed using the process defined in Nuclear Energy Institute (NEI) 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012 (Reference 14).

a. The peer review team was made up of five members that were fully qualified to meet the experience expectations of ASME/ANS RA-Sa-2009, Part 5, Section 5-3, Peer Review for Seismic Events At-Power. Each of the peer review team members has extensive knowledge of the technical requirements of the ASME/ANS RA-Sa-2009 Standard in their area of review.

Three of the five team members each have over 20 years of experience in the nuclear power field specializing in probabilistic risk assessment. The remaining two team members each have over 25 years of experience performing seismological investigations which includes probabilistic seismic hazards and at least one member completed Seismic Qualification Utility Group (SQUG) walkdown screening and seismic evaluation training. As such, the peer review team fully complies with Section 1-6.2 of ASME/ANS RA-Sa-2009.

Furthermore, the peer review team has the combined experience to meet the requirement of Section 5-3.2 of ASME/ANS RA-Sa-2009. Each member is an expert in their field as demonstrated by holding Manager level positions such as technical leads of PRA development, lead seismic scientist, or principal investigator.

b. There were no Supporting Requirements (SRs) classified as unreviewed analysis methods (UAMs).

c. There was no need for the use of expert judgment outside of the PRA analysis team to meet any SR. There was no need to obtain broader perspectives on any aspect of the development of the SPRA.

d. Two seismic hazard analysis (SHA) SRs (SHA-E1 and SHA-E2) were evaluated as CC-I. Findings were assessed for both SHA-E1-01 and SHA-E2-

01. Therefore, in accordance with the NRC comment, a finding was written for any SR receiving a CC-I. An F&O closure review performed in June 2017 reviewed both SHA findings and verified finding SHA-E1-01 meets Capability Category II. However, finding SHA-E2-01 needed additional actions to be considered as meeting Capability Category II. SHA-E2-01 will be resolved as described in Attachment 1.

e. The PVNGS SPRA was peer reviewed all-at-once and not an in-process approach.

Page 4 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 03 APLB - [SPRA] RG 1.200, Revision 2, PRA Acceptability, FPIE as Basis for SPRA ASME/ANS RA-Sa-2009, Section 5-2.3, Part 5, Requirements for Seismic Events At-Power PRA, assumes that full-scope internal-events at-power Level 1 and Level 2 large early release frequency (LERF) PRAs exist and that those PRAs are used as the basis for the SPRA systems analysis. Please provide the following information to establish the technical adequacy of the IEPRA model, which was used as the foundation for the SPRA.

a. Please identify the version of the IEPRA which was used as the foundation for the SPRA and any finding-level F&Os that had not been closed in accordance with an NRC-accepted process at the time it was used.

b. For each finding-level F&O, please describe the disposition and the impact of the F&O on the SPRA as it pertains to this application.

c. Please identify any IEPRA upgrades that were incorporated into the IEPRA, which was used as the foundation for the SPRA, but had not been peer-reviewed prior to the development of the SPRA.

APS Response to RAI 03

a. The SPRA peer review judged supporting requirement (SR) SPR-B1 as Not Met and is described by finding SPR-B1-01. The basis for this finding is a self-assessment of the internal events PRA (IEPRA) (Engineering Evaluation 3579223) performed in March 2011 which identified open findings following a 1999 peer review of the internal events model. The self-assessment identified four SRs as not met to Capability Category II: IE-A8, SY-A4, SY-C1, and SY-C2. Internal events plant walkdowns, interviews, and documentation have since been performed. The F&O closure review in June 2017 included a review of the issues associated with the four not met SRs from the self-assessment (page A-34 of the F&O closure review report).

b. Each of these internal events findings have been verified closed in an F&O Closure Review. Therefore, SPR-B1-01 was evaluated as closed based on the closure of the internal events findings closure.

c. There are three IEPRA upgrades that were subsequently identified for a focused scope peer review: Common cause methodology change (Multiple Greek Letter Method to Alpha Factor Method), Human Reliability Analysis (HRA) methodology change (Systematic Human Action Reliability Procedure (SHARP) model to the EPRI HRA Calculator Software), and PRA Impact 2003-301 that incorporated new modeling for pressure-induced steam generator tube rupture (SGTR) using CE NPSD-1124 Methodology for Modeling Main Steam Line Breaks, Revision 0. These upgrades were not previously determined to be upgrades since they were already reflected in the internal flood, internal fire, and seismic PRA models at the time of those peer reviews. A focused scoped peer review will be conducted as described in Attachment 1.

Page 5 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 04 APLB - RG 1.200, Revision 2, PRA Maintenance and Update:

Configuration Control Section 3.2.6, PRA Maintenance and Updates, of the LAR states that the licensees risk management process ensures that the applicable PRA models used, continue to reflect the as-built and as-operated plant for each of the PVNGS units. NEI 00-04, Revision 0, 10 CFR 50.69 SSC [Structure, System, and Component] Categorization Guideline (ADAMS Accession No. ML052910035), Section 12.1, states that the assessment of new technical information should be performed during the normally scheduled periodic review cycle. However, based on the information provided in the LAR, it was not clear to the NRC staff how the site-specific seismic hazard information would be evaluated to ensure that the SPRA continues to reflect the as-built, as-operated plant.

Please summarize the process that will be used to review seismic hazard information, including: the frequency of the review if it is to be performed periodically, the sources of information that will be used to perform the reviews, and the criteria that will be used to determine when new hazard results will be incorporated into the SPRA. Please include a description of the approach that will be taken to propagate updated site-specific hazard information throughout the SPRA model that could impact the categorization results.

APS Response to RAI 04 The Palo Verde PRA configuration control process is documented in procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15. The as-built, as-operated plant is monitored with respect to all PRA model hazards (internal events, internal flooding, fire, and seismic). Monthly, PRA staff review new or revised plant documents to identify impacts that would require a change to the PRA model. In addition, at least once every two refueling outages, which is 36 months for Palo Verde, changes in PRA methods as documented in various industry reports are reviewed to identify impacts. Updates to the seismic hazard evaluation will rely on industry guidance and common practice to determine the need to incorporate new information into hazard results. Once a need is identified, the update will follow the configuration control process of identifying the impacted model, providing a change description, assigning a priority, modifying the model, and then updating the applications and documents listed in Appendix B of 70DP-0RA03.

In addition, PVNGS Design Civil Department participates in the EPRI Risk and Safety Management - Supplemental Program 7.1m External Hazards Data Collection. By participating in this program, APS ensures that information pertaining to external hazards are tracked and considered in maintaining the safe operation of the plant. EPRI serves as a focal point for tracking and disseminating new hazard information as it becomes available. EPRI tracks evolving information related to external hazards and compiles periodic reports. The benefits of this program include:

Page 6 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• An efficient, shared resource for understanding changes in external hazards and for making consistent evaluations of whether new information is credible and relevant

• Regular reporting of relevant updates to inform decisions regarding preparations for external hazards

• Interpretation and analysis of information to identify technical insights and to clarify potential uncertainties This information can then be used by PVNGS Design Civil and PRA to inform evaluations and decisions affecting plant design, operation, and maintenance.

Page 7 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 05 APLA(B) - RG 1.200, Revision 2, PRA Acceptability, F&O Closure Process Section 3.3 of the LAR states, in part, [a]n F&O closure peer review was performed in June 2017, in accordance with NRC letter dated May 3, 2017. Furthermore, it states, in part, [t]he F&O closure review was conducted to ensure the findings had been satisfactorily resolved to meet the ASME PRA Standard RA-Sa-2009 to Capability Category II, the sub-element criteria for the CEOG from Internal Events PRA peer review, and RG 1.200, Revision 2.

Please provide the following information to clarify and confirm that the F&O closure review was performed consistent with Appendix X to NEI 05-04/07-12/12-06 guidance (ADAMS Accession No. ML16158A035) governing the process for Close-out of Facts and Observations that the NRC staff accepted, with conditions, in the letter dated May 3, 2017, from Joseph Giitter and Mary Jane Ross-Lee, NRC to Greg Krueger, NEI (ADAMS Accession No. ML17079A427).

a. Please clarify whether a focused scope peer review was performed concurrently with the F&O closure process. If so, please provide a brief summary of the focused scope peer review that includes:

i. Discussion of the scope of F&Os reviewed (e.g., which peer review(s) generated F&Os, self-assessment finding(s), external hazards peer review(s), etc.).

ii. Discussion of any new findings generated from the concurrent focused scope peer review performed and the associated dispositions as it pertains to this application.

iii. Summary of the peer review teams conclusion(s) and comments on the concurrent focused scope peer review performed.

b. Please confirm that the closure review team was provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constitutes a PRA upgrade or maintenance update, as defined in ASME/ANS RA-Sa-2009 and qualified by RG 1.200, Revision 2. If the written assessment and justification for the determination of each F&O was not performed and reviewed by the F&O closure review team, please discuss how this aspect of the F&O closure process was met consistent with the NRC staffs acceptance and conditions provided in the letter dated May 3, 2017.

c. Appendix X,Section X.1.3, includes the following five criteria for selecting members of the closure review team.

i. Every member of the independent assessment team should be independent of the PRA associated with the F&Os being reviewed, per the criteria of independent in the ASME/ANS PRA Standard. These members may be contractors, utility personnel, or employees of other utilities, and may include members of peer review teams that previously reviewed the models being assessed.

Page 8 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 ii. Every member of the independent assessment group should meet the relevant peer reviewer qualifications as stated in the ASME/ANS PRA Standard for the technical elements associated with the F&Os being reviewed.

iii. The overall review team experience includes two qualified reviewers for each F&O. An exception to this is allowed for the closure of an F&O related to a single SR, in which case, a single independent reviewer is acceptable, in alignment with the peer review guidance in the main body of this document and in accordance with the ASME/ANS PRA Standard.

iv. Each member of the independent assessment team should be knowledgeable about the F&O independent assessment process used to assess the adequacy of the F&O resolution.

v. The total number of reviewers is a function of the scope and number of finding F&Os to be reviewed for closure.

Please describe how the selection of members for the June 2017 independent assessment met the above criteria. Please explain how closure of the F&Os was assessed to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements, associated with the closed F&Os now meet ASME/ANS RA-Sa-2009 SRs at CC-II.

d. Please discuss whether the F&O closure review scope included all finding-level F&Os, including those finding-level F&Os that are associated with Met SRs at CC-II. If not, please identify and describe those findings that were excluded from the F&O closure review scope. For each identified finding-level F&O, please describe the disposition and the impact of the F&O on PRA as it pertains to this application.

APS Response to RAI 05

a. ABS Consulting report R-3882824-2037, Palo Verde Generating Station PRA Finding Level Fact and Observation Closure Review, section 2.2 states the following:

The review team found that some Findings should remain open since their closure was deemed incomplete or did not address the issue. The review team shared any new issues identified during the course review, but such items were not considered new Finding level F&Os since, with the exception of two F&Os (i.e., one IEPRA F&O and one associated with the SPRA seismic hazard analysis element), the review did not involve an embedded focused scope peer review. For the two F&Os for which a concurrent focus peer review was performed, no new F&Os were identified. The host utility PRA team was prepared to generate actions for follow-up investigation of such new issues as appropriate.

As noted, the focused scope peer review reviewed the resolution of two existing F&Os determined to be upgrades. The focused scope peer review did not generate any new F&Os against any Palo Verde PRA models. Per Page 9 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 section 3.3 of ABS report R-3882824-2037, the F&Os reviewed as part of the embedded focused scope peer review are as follows:

During the period of onsite closure review, concurrent focused scope peer review was also performed for two separate F&Os; i.e., IEPRA F&O HR-03 and SPRA F&O SHA-E1-01.

b. The F&O closure review team was not provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constituted a PRA upgrade or maintenance update as defined in ASME/ANS RA-Sa-2009. Attachment 1 identifies the items that are required to be completed prior to implementation of the 10 CFR 50.69 categorization process at PVNGS.

c. APS reviewed the resumes for each proposed F&O closure review team member to ensure the criteria of Appendix X to NEI 05-04/07-12/12-06, the staffs acceptance and conditions provided in the letter dated May 3, 2017 (ADAMS Accession Number ML17079A427), Regulatory Guide 1.200, Revision 2, and ASME/ANS RA-Sa-2009 were met. The selected team members were confirmed by Palo Verde to be independent and meet the relevant peer reviewer qualifications as defined in ASME/ANS RA-Sa-2009. Each F&O resolution was reviewed by at least two qualified reviewers. F&O closure review team members were knowledgeable about the F&O independent assessment process as defined in Appendix X to NEI 05-04/07-12/12-06.

APS ensured the team was large enough to ensure that each F&O resolution was reviewed by at least two qualified reviewers during the week allotted to the F&O closure review. APS will follow this same process with the augmented F&O closure review.

ABS Consulting report R-3882824-2037, section 2.2, states the following:

The Finding F&O Closure Technical Review Team decided if the Finding F&Os in question were adequately addressed and could be closed out via consensus. Additionally, once all of the Finding F&Os that were associated with a given SR assessed as less than Capability Category II had been closed out, the capability category of the affected SRs was also considered changed per the discussion in Section 2.4.

ABS Consulting report R-3882824-2037, section 2.4, outlines the criteria used by the F&O closure review team to assign the revised capability categories:

The guidance in NEI 05-04 Section 3, NEI 07-12 Section 3.3, and NEI 12-13 Section 3.3 regarding assignment of capability categories against the ASME/ANS PRA Standard was applicable in this review relative to re-categorization of SR capability categories.

Therefore, upon closure of all F&Os associated with a given SR:

• If the SR was originally considered NOT MET, the SR shall be considered MET at CC-II.

• If the SR was originally considered MET at CC-I and the F&O provided a path to CC-II, the SR shall be considered MET at CC-II.

Page 10 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• If the SR was originally considered MET with F&Os that qualified that ranking, those qualifications shall be removed.

The re-categorization of the status of the subelement criteria/requirement for the IEPRA (which used the CEOG peer review process) is similar. If the status of the subelement criteria was originally considered Marginal or Inadequate, it shall be considered Meets upon closure of all associated F&Os. If the subelement requirement was originally considered Meets with qualifying F&Os, the qualifications shall be removed once all associated F&Os are closed.

In short, the F&O closure team reviewed each F&O resolution against any associated ASME/ANS RA-Sa-2009 SR(s) and revised the Met/Not Met status based on satisfactory closure of the F&O. The updated SR status is documented in ABS Consulting report R-3882824-2037, tables 4-2, 4-3, 4-4, and 4-5. This same process will be followed for the augmented F&O closure review.

d. The F&O closure review scope included all finding-level F&O resolutions associated with Not Met to capability category (CC) II ASME/ANS RA-Sa-2009 Supporting Requirements (SRs) written against the Palo Verde internal events, internal flooding, internal fire, and seismic PRA models. Other findings associated with Met to CC II SRs were not believed to be in the required scope since the affected SRs were met regardless of the findings.

To address this question, APS will include all F&O findings associated with Met Supporting Requirements at CC II in an augmented F&O closure review.

The augmented F&O closure review will be conducted as described in Attachment 1.

Page 11 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 06 APLA(B) - RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review Attachment 3, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process, of the LAR provides dispositions for the self-assessment open items and the F&Os from the peer review of the IEPRA (including internal flooding) and SPRA that were not closed by the June 2017 F&O closure review. These dispositions state that the closure review team recommendations will be addressed or implemented and that

[t]hese [PRA] changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a prerequisite to categorization.

Please propose a mechanism that ensures these activities and changes will be completed and appropriately reviewed in accordance with an NRC-accepted process (e.g., full-scope peer review, focused scope peer review, or F&O closure review) and any issues resolved prior to implementing the categorization process. This mechanism should also include any additional finding-level F&Os identified in response to APLA(B) RAI 01, APLB RAI 03, APLA(B) RAI 05, APLA(B) RAI 09, APLA RAI 17, and APLA RAI 21 and specify, how the F&Os will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR). An example would be a table of listed implementation items referenced in a license condition.

As an alternative to providing an implementation item for an F&O, please demonstrate that the F&O will have no impact to the 10 CFR 50.69 categorization process results.

APS Response to RAI 06 The Not Met finding level F&Os from the peer review of the IEPRA (including internal flooding) and SPRA that were not closed by the June 2017 F&O closure review are being tracked via the PRA model impact database. Model and documentation updates necessary to address the F&O closure review panel recommendations are in progress and closure will be confirmed by the conduct of an additional NRC endorsed F&O Closure Review. In addition, this review will include six seismic PRA findings associated with supporting requirements determined Met to Capability Category II as identified in APLA(B) RAI 05. Finally, the review will also include three external hazards findings related to walkdowns and documentation identified in APLA RAI 17. No additional findings requiring a review were identified in APLA(B) RAI 01, APLB RAI 03, and APLA RAI 21.

For IEPRA changes determined to be PRA upgrades in APLB RAI 03 and APLA(B)

RAI 09, APS will conduct a focused scope peer review as described in Attachment 1.

Finding level F&Os identified as a result of the focused scope peer review will be resolved prior to implementation of the 10 CFR 50.69 application. Finding level F&Os will be reviewed by an F&O closure review team to verify closure through the NRC endorsed F&O Closure Review.

Page 12 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 07 EMIB/ESEB - [SPRA] RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review Finding-level F&O SFR-F3-01 in Attachment 3 of the LAR noted that the detailed fragility evaluation for dominant relay contributors should demonstrate that the seismic demand is an appropriate median-based response, and that the important uncertainties are included in obtaining log standard deviations. The closure review team recommended that the following be incorporated into the calculation to provide the basis for potential resolution and closure of the finding:

1. Justify the use of Best Estimate [BE] ISRS [in-structure response spectra] as the median. In our [closure review team]

opinion, the SSI [soil-structure interaction] analysis using BE soil properties, best estimate structure stiffness and a conservative estimate of best estimate structure damping results in a 84th percentile response.

2. The u associated with SSI is obtained using the BE, UB [upper bound] and LB [lower bound] [envelope] as the 84th and the BE alone as the median. Please explain the rationale that this results for the same building (Control Building) a wide range of SSI c from 0.09 to 0.22.

3. Explain why the uncertainties associated with structure stiffness and damping, time history simulation and earthquake component combination are ignored in the SOV [separation of variables) calculations.

The above closure team resolution recommendations appear to suggest that: (a) the ISRS, derived from the building SSI analysis, used as input for the seismic fragility evaluation of the equipment (relays in this case) may not be an appropriate median-centered response; and (b) that important uncertainties associated with the structure response may not have been included in the SOV calculations, such that the resulting equipment fragilities using the ISRS input are reasonably realistic.

Since fragility is the input to evaluate core damage frequency (CDF)/LERF the results of which are used for equipment categorization criterion, this finding may have the potential to impact the categorization results.

Describe the technical rationale for addressing the above closure review team recommendations that would justify that the building ISRS are an appropriate median response and that important uncertainties associated with the structure response were appropriately included, such that the resulting equipment fragility values are reasonably realistic. Alternatively, provide information that would demonstrate that the F&O will have no impact on the 10 CFR 50.69 categorization process results.

Page 13 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 07 Finding SFR-F3-01 has been addressed by a Westinghouse Electric Company seismic team per the recommendation provided by the F&O closure panel.

Subsequently, the completed resolutions will be evaluated in accordance with Attachment 1.

The technical rationale in response to the closure teams recommendations to be captured in the F&O closure process is summarized as follows:

1. Justification for use of BE soil, BE structure, and a conservative estimate of median structural damping as appropriate for median response at PVNGS:

a. Use of conservative estimate of median damping: The BE ISRS were judged appropriate as median input to fragility analysis because the building response is dominated by low-frequency soil-structure modes.

For these modes, the control building (CB) structural distortion is low compared to the rigid body motion resulting from soil compliance. As a result, seismic demand is not sensitive to structural damping. This is further justified by sensitivities demonstrating that applying higher levels of structural damping does not have a significant impact on response due to the relatively large amounts of soil damping due to the embedded structures on deep soil columns.

b. Use of BE properties (soil + structure) instead of averaging LB, BE, and UB properties for median demand: The approach taken is appropriate for the SPRA, specifically at PVNGS due to the stability of SSI results obtained. Soil stiffness variability, which at PVNGS dominates overall variability in response over structural stiffness variability, was determined by varying shear modulus by Cv per American Society of Civil Engineers (ASCE) 4-98, Seismic Analysis of Safety-related Nuclear Structures. Response analyses varying soil properties with BE structural stiffness and conservative median damping were run for one set of artificial time histories (with variability due to time history generation accounted for in the SOV calculation). The resulting SSI response analyses were reviewed and determined to be stable and without considerable deficiencies to conclude that the BE soil property SSI run appropriately represented the best estimate of median demand.

While an increasing number of recent SPRA response analyses may average LB, BE, and UB properties, this may be indicative of more complex response analyses with the probabilistic soil uncertainty evaluation and 5 sets of time histories. The resulting SSI response may not be stable, and averaging may be appropriate for median demand. It is noted that neither EPRI TR-103959, Methodology for Developing Seismic Fragilities, June 1994, EPRI NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin, Revision 1, nor EPRI 1019200, Seismic Fragility Applications Guide Update, December 2009 stipulate the use of response averaging to obtain median demand.

Page 14 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

2. The u associated with SSI varying for components in the same building (SSI c from 0.09 to 0.22 in the Control Building) is justified since the SSI uncertainty was directly computed by the location-specific component response. The components analyzed include items located at a low elevation of the control building (CB) (Elevation 100) where the demand contribution from the ground motion component of the total seismic motion is high. The ground motion component is independent from SSI and it is reasonable to expect that an item located at a low elevation will have a relatively low u value for SSI uncertainty, as was determined in the analysis.

3. The uncertainties associated with structure stiffness and damping, as well as time history simulation were updated for SOV calculations due to information from sensitivity studies.

By evaluating the PVNGS response to F&O SFR-F3-01, as summarized above, through a subsequent F&O closure process prior to 50.69 program implementation, PVNGS will demonstrate that the ISRS derived from SSI analysis are appropriate for median-centered response and that important uncertainties associated with structure response are included in SOV calculations, resulting in reasonably realistic equipment fragilities.

Page 15 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 08 RGS - [SPRA] RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review In Attachment 3 of the LAR, finding-level F&O SHA-E2-01 included a recommendation for the licensee to [d]emonstrate that the updated set of soil

[peak ground acceleration (PGA)] hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil [PGA] hazard curves used in the Seismic PRA model. If the updated set of soil [PGA] hazard curves is greater than those used in the Seismic PRA model, the impact on Seismic risk quantification should be assessed. This discussion indicates that the current version of the SPRA is based on a seismic hazard study performed prior to the 2015 study evaluated by the NRC staff as part of its 10 CFR 50.54(f) review (ADAMS Accession Nos. ML15076A073 and ML16221A604) and that the updated seismic hazard curves will be incorporated in a PRA update. Finding level F&O SHA-E2-01 states, in part, it is not clear if the seismic risk quantification using the [PGA] hazard curves from LCI [LCI Report 2211-PR-07-Rev. 4, Seismic Hazards Evaluation for Palo Verde Nuclear Generating Station] (2013) is appropriate.

Provide a comparison (e.g., a graph or table) of the seismic hazard currently used in performing the SPRA (LCI 2013) with the updated seismic hazard curves (LCI 2015b) to be incorporated in a PRA update. In addition, please provide a description of how fragility analyses performed using the 2013 seismic hazard curves will be reconciled with the updated seismic hazard. Alternatively, demonstrate that the F&O will have no impact to the 10 CFR 50.69 categorization process results.

APS Response to RAI 08 Finding SHA-E2-01 is currently being addressed per the recommendation provided by the F&O closure review team. The 2015 hazard developed for the 50.54(f) response is being used to update the SPRA, thus addressing the recommendation provided by the F&O closure panel. The completed resolutions will be resolved in accordance with Attachment 1.

Figure 8.1 shows a comparison between the 2013 uniform hazard response spectra (UHRS) [i.e., the Senior Seismic Hazard Analysis Committee (SSHAC) Level 2 hazard study] and the 2015 update (i.e., the SSHAC Level 3 study), which represent the old and updated input to the fragility analysis respectively. Figure 8.2 shows the comparison of the associated peak ground acceleration (PGA) hazard curves used for the SPRA quantification.

To support a full re-quantification of the SPRA, the hazard developed for the Near Term Task Force (NTTF) 2.1 in 2015 was post-processed to extract the needed uncertainty information. In particular, the 2015 seismic hazard was post-processed to obtain a suite of approximately 100 discrete total mean hazard curves with associated weighting factors, consistent with what was performed in support of the SPRA quantification for the 2013 hazard curves.

A scaling analysis of the fragility parameters developed in 2013 to make them consistent with the updated hazard is complete. As can be noted in Figure 8.1, the Page 16 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 energy content of the 2015 spectra is lower than the 2013 spectra in the low frequency range (i.e., lower than 2Hz). As a number of important fragilities for the PVNGS SPRA are sensitive to low frequency energy content, such decrease resulted in an overall improvement of the fragility data for the PVNGS SPRA.

The updated fragility values and the 2015 hazard or spectra are currently being used for an updated quantification of the SPRA. The quantification will be documented in the updated quantification notebook, CN-RAM-12-22, Palo Verde Seismic Probabilistic Risk Assessment - Quantification. See Figures 8-1 and 8-2.

UHRS Comparison Figure 8-1 Page 17 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 PGA hazard curves comparison Figure 8-2 Page 18 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 09 APLA(B) RAI 09 - RG 1.200, Revision 2, PRA Acceptability, PRA Upgrades Identified in F&O Closure Review Report Section 3.3 of the LAR states, in part, that [a]ll PRA upgrades (as defined by the ASME PRA Standard RA-Sa-2009) implemented since conduct of the CEOG peer review in 1999 have been peer reviewed. The LAR indicated that one full-scope peer review was performed on the IEPRA model in July 1999, Internal Flooding PRA (IFPRA) (2010), SPRA (2013), Fire PRA (FPRA) (2012 and 2014). The NRC staff requests that the licensee provide the following additional information to enable the NRC staff to evaluate if the guidance provided in RG 1.200, Revision 2, regarding PRA upgrades was followed:

a. Describe the changes made to the IEPRA since the full-scope peer review was conducted in 1999, including any changes that would impact the modeling framework for the PRA, such as converting the PRA to a one-top fault tree across all the PRA hazards. Provide the dates for when each change occurred. This description should be of sufficient detail for the NRC to determine whether the changes are considered PRA maintenance or PRA upgrades as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2. Include in your discussion: (1) any new methodologies (i.e., summarize the original method in the PRA and the new method); (2) changes in scope that impact the significant accident sequences or the significant accident progression sequences; (3) changes in capability that impact the significant accident sequences or the significant accident progression sequences.

b. For each change described in Part a above, indicate whether the determination for the change was PRA maintenance or a PRA upgrade as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2, along with justification for the determination.

c. Discuss any focused scope (or full-scope) peer reviews that have been performed for the PRA upgrades identified in Part b above, providing the timeline of when the peer reviews were performed and when the peer review reports were approved. For each upgrade identified, either:

i. Provide the findings of the peer review(s) performed on the upgrade and the disposition of the findings as it pertains to the impact on the 10 CFR 50.69 application, OR, ii. Confirm that the resulting F&Os from the peer review(s) on the upgrade were assessed in the F&O closure review in June 2017.

d. Describe the changes that have been made to the IFPRA, SPRA, and FPRA since their respective peer reviews on November 2010, February 2013, and December 2012, and December 2014, respectively. Provide information commensurate with that requested for the IEPRA in Parts (a), (b), and (c) which indicate and justify the determination of whether the changes were maintenance or an upgrade and, if an upgrade, provide information to support a technical acceptability determination.

Page 19 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 09 As requested, changes made to the Palo Verde Internal Events PRA, Internal Flooding PRA, Seismic PRA, Fire PRA, and External Events PRA since their respective peer reviews have been identified, documented, classified and justified as PRA maintenance or PRA Upgrade.

a. Changes made to the Palo Verde internal events PRA model since the 1999 Internal Events PRA Peer Review have been collected and documented in Engineering Evaluation EWR 18-00619-003. This evaluation provides details of the PRA model changes captured in the PRA Impact Database and F&O Resolution reports along with the date each change occurred. See Attachment 2, Table 2-1 for a listing of the significant changes made to the Palo Verde Internal Events PRA model.

b. As documented in EWR 18-00619-003, each PRA model change was reviewed against the PRA Maintenance or PRA Upgrade definitions provided in ASME/ANS RA-SA-2009 with consideration of the qualifications and clarifications provided in Regulatory Guide 1.200, Revision 2. See Attachment 2, Table 2-1, for a listing of the significant changes made to the Palo Verde Internal Events PRA model along with their classification and associated Basis.

Justifications for the assessment of a change being a PRA Upgrade included new methodologies, changes in scope impacting significant accident sequences or the significant accident progression sequences or changes in capability impacting significant accident sequences or the significant accident progression sequences.

Justifications for determining changes as PRA maintenance included specific reference to sections and PRA Maintenance examples provided in ASME/ANS PRA Standard Nonmandatory Appendix 1-A.

The majority of the changes were assessed to be PRA maintenance activities.

This included the conversion of the Risk Spectrum PRA model to CAFTA and development of the one top logic fault tree. With respect to the CAFTA software conversion, ASME Standard RA-Sa-2009 Appendix 1-A, section 1-A.3 Classification of PRA Changes, Example 11 clearly states that changing from fault tree linking code to another for quantification of sequences is classified as PRA Maintenance. All the items listed in the rationale provided for Example 11 being considered maintenance are met for the conversion from Risk Spectrum to CAFTA. Both codes use the same linked fault tree codes and are both well accepted in the PRA community. The conversion of the PVNGS Internal Events PRA model is well documented and includes disposition of code differences. In addition, in-depth reviews of cutsets from both codes were performed, as well as review of truncation, recoveries, importances, and resolution of modeling differences. The documented review also included comparison of results with various plant configurations of significant components out of service. Therefore, this change was determined to be PRA maintenance. Likewise, the one top logic fault tree developed for the risk-informed 10 CFR 50.69 application is also considered maintenance. Each hazard model placed under the single top fault tree has been peer reviewed against RG 1.200, Rev 2. The top gate of the fault tree acts as a simple OR gate allowing solution of individual hazards by solving a lower gate or all hazards together by solving the top gate. The same peer-Page 20 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 reviewed fault tree modeling methodology is used. The same basic events are used with appropriate overrides for hazard-specific operator actions. Resulting cutsets from the combined hazard model were compared to the individual hazard models and documented as part of the software quality assurance data qualification process for the Phoenix software. For these reasons, this change was determined to be PRA maintenance as well.

Attachment 2, Table 2-3 provides those Internal Events PRA changes that were determined to be PRA Upgrades.

c. Attachment 2, Table 2-4 provides the Internal Events PRA upgrades identified in Part (b) above. For each upgrade, the specific peer review evaluating the upgrade, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings, closure, etc.) are provided. It is noted that if an identified upgrade has not undergone a peer review, it will be included in the Focused scope Peer Review planned to be conducted as described in Attachment 1.

d. As documented in EWR 18-00619-003, the same process described in Parts (a) and (b) above was applied to the changes made to the Internal Flooding PRA, Seismic PRA, and Fire PRA since their respective peer reviews. Attachment 2, Table 2-5 provides those changes that were determined to be PRA Upgrades.

See Attachment 2, Table 2-2 for a listing of the significant changes made to the Palo Verde Internal Flooding, Seismic, and Fire PRA models.

Attachment 2, Table 2-6 provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings, closure, etc.). It is noted that if an identified upgrade has not undergone a peer review, it will be included in the Focused scope and augmented F&O Closure Peer Review planned to be conducted as described in Attachment 1.

As noted in Attachment 2, Table 2-6, a number of findings resulted from the review of the identified upgrades. New F&Os QLS-A1-01[14FS], PRM-A3-01[14FS], and FSS-D2-01[14FS] were received. Of these, only one, FSS-D2-01, was included in the 2017 F&O Closure Review which determined that this F&O was closed and SR FSS-D2 was met. The remaining findings will be verified closed and the Fire PRA SRs CS-C4 and ES-B3 will be reviewed by an augmented F&O closure review, as described in Attachment 1. Therefore, the disposition of these F&Os for Internal Fires and Seismic will have no impact on the risk-informed 10 CFR 50.69 application.

In summary, after reviewing all changes made to the PRA models, APS has identified four PRA model upgrades that will be reviewed in an upcoming focused scope peer review. The resolutions to any existing open F&O findings and any new F&O findings resulting from the upcoming focused scope peer review of upgrades will be resolved prior to implementation of the 10 CFR 50.69 applications, as described in Attachment 1.

Page 21 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 10 APLB - RG 1.200, Revision 2, PRA Acceptability, Key Assumptions and Key Sources of Uncertainty Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, states, in part, that [f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application. Further, RG 1.200, Revision 2, Section 4.2, Licensee Submittal Documentation, states, in part, that

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. RG 1.200, Revision 2, Section 3.3.2, defines the terms key assumption and key source of uncertainty.

Section 3.2.7, PRA Uncertainty Evaluations, of the LAR states, in part, that [t]he list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application These key assumptions and sources of uncertainty reviewed were previously submitted to the NRC in the application dated July 31, 2015. (ADAMS Accession No. ML15218A300).

a. Describe the approach used to identify and characterize the key assumptions and key sources of uncertainty in the SPRA for this application.

i. Discuss (1) whether all assumptions and sources of uncertainty (including relevant methods) related to all aspects of the models (e.g.,

hazard, fragility, and plant response analysis for the SPRA) were evaluated to determine whether they were key; and (2) the criteria that were used to determine whether the modeling assumptions and sources of uncertainty were considered key.

ii. Discuss whether any approaches or models were determined to be a consensus approach or model for the purposes of identifying the key assumptions and key sources of uncertainty. If a consensus model was used, discuss whether the determination was made in accordance with the guidance in NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking (ADAMS Accession No. ML090970525), which indicates that for risk-informed regulatory decisions, the consensus model approach is one that NRC has used or accepted for the specific risk-informed application for which it is proposed.

b. Describe each key assumption and key source of uncertainty identified in the SPRA. Provide this in sufficient detail to enable the NRC staff to identify whether the key assumptions and key sources of uncertainty used in the SPRA involve any changes to industry consensus approaches.

Page 22 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

c. Discuss how each key assumption and key source of uncertainty identified above was dispositioned for this application. If available, provide the results of any sensitivity studies that will be used to support the disposition for this application or use a qualitative discussion to justify why different reasonable alternative assumptions would not affect this application.

APS Response to RAI 10 a.i. During the development of the SPRA model, the assumptions and sources of uncertainty related to aspects of the model were reviewed to determine whether they were key and they were documented as such in the SPRA reports. Those that were determined to be key met the following criteria in NRC RG 1.174, Revision 2:

...when it could impact the PRA results that are being used in a decision, and consequently, may influence the decision being made.

Sources of model uncertainty and assumptions have been identified using the guidance of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making.

a.ii. Methods used in the development of the different elements of PVNGS SPRA (i.e., hazard, fragility and plant response modeling) are documented and summarized in the relevant documentation and are established methods used in multiple SPRAs in the industry. No specific deviations have been made from these established methods, which can be considered consensus methods in the industry.

1) The Hazard assessment addresses assumptions and associated uncertainties explicitly in the SSHAC process and in the resulting probabilistic seismic hazard analysis (PSHA) calculation.

Epistemic uncertainties are therefore quantitatively translated in the spread of a full family of hazard curves with associated weight factors (96 individual hazard curves have been developed from the entire PSHA decision tree). No specific assumption has been identified in the hazard assessment that required a specific sensitivity in the final quantification of the SPRA. The final quantification of the SPRA used all 96 curves for the final SPRA uncertainty assessment for both CDF and LERF.

The technique used for the uncertainty propagation in the PVNGS SPRA allowed for a decomposition of the uncertainties between hazard, fragility, and system.

2) In the final quantification of the SPRA, two sensitivities were run to address the importance of fragility-related modeling assumptions, one addressing the fragility of the non-safety auxiliary feedwater (AFN) pump, and one addressing the impact of surrogate fragilities. In both cases, the model showed little sensitivity to these modeling assumptions.

Page 23 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

3) The plant response analysis including seismic modifications to the HRA follows established methods, mainly documented in the Electric Power Research Institute (EPRI) SPRA Implementation Guidance or the EPRI SPRA Surry report. Key assumptions associated with the modeling of the plant response are identified during the development of the analysis and are then summarized and documented in Section 4.4 of the SPRA modeling notebook (i.e., CN-RAM-12-15, Palo Verde Seismic Probabilistic Risk Assessment - Model Development, Revision 1) and in Section 4.4 of the Seismic HRA notebook (i.e., CN-RAM-12-24, Palo Verde Seismic PRA - Human Reliability Analysis, Revision 2). Those assumptions are then re-addressed for their potential modeling uncertainties and ad-hoc sensitivities are performed when suitable modeling alternatives are available.

b. The following major assumptions are adopted in the development of the PVNGS SPRA and are consistent with the general guidance discussed in the above mentioned established methods:

i. During the SPRA analysis, major assumptions associated with success criteria (on a system and sequence basis) are reviewed to identify potential inconsistencies with a seismically induced accident. If not otherwise specified, the success criteria associated with the IEPRA logic are considered valid and applicable to accident sequences initiated by a seismic event. This assumption implies that all the success criteria runs performed in support of the internal events accident sequences are applicable and are not replicated for the SPRA.

A significant limitation of this assumption concerns the potentially different mission time of the SPRA, compared with an IEPRA. Explicit discussion on this topic is presented in Section 5.1 of the modeling notebook (CN-RAM-12-15) and a dedicated sensitivity case is performed to address the epistemic uncertainties associated with this assumption in the quantification notebook (CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1). This reflects an industry consensus approach for SPRAs.

ii. Seismic failures are assumed to be completely correlated. This assumption implies that a single basic event is used to model the seismic failure of components that are identified as pertaining to the same fragility group by the fragility team. The validity of the assumption of complete correlation is still being discussed at the industry level. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

One significant exception to this general assumption is where failures in the steam path in the turbine building are not considered correlated with failures of the feedwater lines.

iii. The seismically induced Loss of Offsite Power (LOOP) is assumed to bound the fragility of non-seismic class systems. This assumption implies that a number of non-seismic class systems are not addressed Page 24 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 with a specific seismic failure. The basis for this assumption is that seismically induced LOOP has a generally low seismic capacity.

Scenarios where the non-seismic support systems include seismically induced failures while offsite power is still available are considered realistic only for a very low magnitude seismic event. Some exceptions include the instrument air (IA) system and the station blackout generator (SBOG), for which system specific fragility considerations are made. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

iv. The PVNGS IEPRA credits recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after a LOOP. In the PVNGS SPRA, LOOP recovery is not credited for any seismic event above the safe shutdown earthquake (SSE), while it is credited with unchanged probability for a seismic event below the SSE. This assumption is based on the consideration that it is realistic to consider that offsite power recovery is available for low magnitude seismic event. As the magnitude of a seismic event increases, the recovery time is expected to increase (i.e., probability of recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> decreases). The potential to recover is lost for longer time frames (potentially over 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) for larger magnitude events. The selection of the SSE as a threshold between recovery/no-recovery of offsite power is arbitrary.

v. Screening of equipment in the Seismic Equipment List (SEL) is based on fragility analysis. Equipment screened by the fragility team as inherently rugged is not modeled in the SPRA for their seismic induced failure. In order to quantitatively capture the impact of screened out equipment, the fragility team provided generic fragility values for screened out equipment on a location basis (i.e., fragility parameters based on building). The screened equipment is then not explicitly modeled but rather modeled through surrogate basic events at a system level that address seismic induced failure of a system due to a combination of seismic failures of equipment within the system. A sensitivity case is explicitly discussed to address the impact of this modeling approach.

vi. It is assumed that the operators will always trip the reactor in case of a seismic event above the Operating Basis Earthquake (OBE) even if plant procedures allow for the option of a controlled shutdown. This is considered a conservative assumption although it is not expected to have a significant impact on the overall risk profile of the plant. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

vii. Assumption #4 in Section 6 of the fragility analysis report (11C4043-RPT-003, Seismic Fragility Analysis of PVNGS Unit 1 Structures, Systems and Components, Revision 1) states that AFN pump is assumed to remain functional with small leaks in instrument lines. The listed AFN pump fragility does not include instrument line failure as the fragility analysis did not address the entire flow path for the AFN Page 25 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 pump. Nevertheless, tubing to flow transmitters was found to be vulnerable to seismic motion and interaction. A tube break could not be ruled out and is a potential low capacity failure mode (small break leak). Following the recommendation of the fragility analysis report (11C4043-RPT-003 Rev. 1), the uncertainty associated with this assumption is addressed through a sensitivity case in the quantification notebook (CN-RAM-12-022) that changes the fragility parameters of the AFN pump into the same fragility values used for the system level fragility for the IA system.

viii. Main steam line relief valves have not been explicitly included in the SEL but are nevertheless screened out by the analysis on the basis that the steam generator and related piping & valves are normally considered very rugged. For this reason the seismic failure of the relief valve is not modeled (this assumption has been supported by a discussion with the fragility team). A sensitivity case was developed to assess the impact of this assumption. In the sensitivity case, a fully dependent seismic failure across all 20 relief valves is modeled with a fragility dataset given per the screened out equipment in the Main Steam Support Structure (MSSS) (11C4043-RPT-003 Rev.1).

ix. Structural failures of buildings are assumed to result in major collapse and failure of all equipment housed inside the building (e.g., structural failure of containment will result in failure of reactor coolant system (RCS) lines, structural failure of auxiliary building will result in failure of all pumps and valves in the structure, structural failure of the MSSS will result in failure of all pumps and valves in the structure, structural failure of the control building will result in failure of all cabinets, etc.).

This is a conservative assumption since the fragility parameters provided are addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The level of detail in the fragility analysis of the building does not allow for crediting partial failure and therefore all equipment in the building is assumed lost. A similar consideration is made for the soil failure underneath the buildings.

The most significant example of this assumption is the structural failure of the turbine building assumed to be also impacting and failing the condensate storage tank (CST) tunnel.

There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. A more refined fragility analysis of the structures can be done to reduce this conservatism, although this is currently not within the scope of the analysis.

x. The anticipated transient without scram (ATWS) logic for seismic PRA assumes that the RCS pressure will be above the high pressure safety injection (HPSI) shutoff head for only a short period of time. In this case, injection following the pressure decrease is expected to be sufficient to provide inventory and boron. The assumption is needed Page 26 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 because all ATWS event trees show that, given success of steam generator (SG) heat removal and failure of the pressurizer safety valve (PSV) to reseat, high pressure injection and high pressure recirculation is sufficient to terminate the transient successfully. However, depending on the moderator temperature coefficient (MTC) and other parameters, the RCS pressure may exceed the HPSI pump shutoff head for a sufficient period of time to lead to core damage before the pressure drops below the shutoff head. This is expected to be the case for a short period of time early in core life, i.e., the success criteria for injection cannot be met because the RCS pressure will be well above the shutoff head for the HPSI pumps. If the high pressure endures for long enough, core damage is guaranteed and vessel failure will occur at high pressure. MTC and ATWS pressure transient are not influenced by the fact that the event is initiated by a seismic event rather than a spurious failure and therefore the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. This is a specific case of the more generic Assumption i. above. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

xi. Accessibility for completion of non-screened human failure event (HFE) actions during a seismic event is assumed possible for all non-screened HFEs besides those which are assumed to fail in the case where the corridor building or turbine building (east) collapses (i.e.,

CN-RAM-12-24). Non-accessibility to equipment in the field would likely result in the associated human error probability (HEP) being set to 1.0; a sensitivity case is developed in the quantification notebook (CN-RAM-12-022) that sets all the HEP to 1.0. Such a sensitivity case is used to address the impact of this assumption on the PVNGS SPRA model.

xii. In the consideration of seismic-induced floods, it is assumed that the seismic performance shaping factors (PSFs) applied to the internal events HEPs will override the flooding PSFs, based on the consideration that the seismic events are more global events than the specific flooding events (i.e., CN-RAM-12-24). There are no specific sensitivity cases that have been designed in the quantification notebook (CN-RAM-12-022) that address the epistemic uncertainty of this assumption.

xiii. The SPRA dependency analysis assumes that once an accident sequence is initiated, the operator action timing for a seismically induced event is similar to that of an internally induced event for main control room actions. The combinations are qualitatively assessed to ensure sufficient time is available to account for operators potentially requiring extra time to navigate through the plant following a seismic event. The modification of the timing available due to seismic considerations may result in a longer response or identification time and consequentially a higher HEP. A specific sensitivity analysis on this has not been defined; the sensitivity analysis which sets HEPs to 1.0 Page 27 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 (see Assumption xi. above), is bounding but it does not reflect an increase to specific individual HEPs which reflect timing available changes due to seismic considerations.

xiv. The weighting factors applied to the three approaches, specified in Section 4.3.2.4 of the Seismic HRA notebook (i.e., CN-RAM-12-24),

assume Surry to be the most accepted and applicable approach due to Surry being the most recent approach of the three implemented in this analysis. A specific sensitivity analysis that adjusts the weighting factors applied to the three approaches is documented in the quantification notebook (CN-RAM-12-022).

c. The Attachment 3, Table 3-1 describes the disposition of key assumptions and sources of uncertainty identified in the SPRA.

Page 28 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 11 APLA(B) - Overall Categorization Process Section 3.1.1, Overall Categorization Process, of the LAR has two different sets of bulleted elements and concludes with an additional list of ten elements. The elements discuss: training that will be provided, the different hazard models, and PRA model results. However, it is not clear to the NRC staff what the sequence of evaluations will be in the categorization process, what information will be developed and used, and what guidance on acceptable decisions by the Integrated Decision-Making Panel (IDP) will be followed during the categorization of each system.

a. Summarize, in the order they will be performed, the sequence of elements or steps that will be followed to categorize a respective system. A flow chart, such as that provided in the NEI presentation (ADAMS Accession No. ML17249A072) for the September 6, 2017, public meeting with NEI regarding 10 CFR 50.69 LARs (ADAMS Accession No. ML17265A020), may be provided instead of a description. The steps should include:

i. The input from all PRA evaluations such as use of the results from the internal events, internal flooding, seismic, and fire PRAs; ii. The input from non-PRA approaches (other external events, and shutdown);

iii. The input from the responses to the seven qualitative questions in NEI 00-04, Section 9.2; iv. The input from the defense-in-depth (DID) matrix;

v. The input from the passive categorization methodology.

b. Clarify the difference between preliminary high safety significant (HSS) and assigned HSS and identify, which inputs can, and which cannot, be changed from preliminary HSS to low safety significant (LSS) by the IDP. Confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance (ADAMS Accession No. ML061090627).

c. Clarify, which steps of the process are performed at the function level and which steps are performed at the component level. Describe how the categorization of the component impacts the categorization of the function, and vice-versa. Describe any instances in which the final safety significance of the function would differ from the safety significance of the component(s) that support the function, and confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1.

d. Section 7.1, Engineering Categorization, of Section 7, Preliminary Engineering Categorization of Functions, of NEI 00-04, states, in part, that if any SSC is safety significant, from either the PRA-based component safety significance assessment (Section 5) or the defense-in-depth assessment (Section 6), then the associated system function is preliminary safety significant. Describe whether your categorization process is consistent with Page 29 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 or differs from the guidance in NEI 00-04, Section 7, where functions supported by any HSS component(s) will be assigned as HSS. If the licensees categorization process differs from the guidance in Section 7 of NEI 00-04 cited above where functions supported by any HSS component(s) will be assigned HSS, justify the approach.

e. Section 9.2.2, Review of Safety Related Low Safety-Significant Functions/SSCs, of NEI 00-04, which is performed by the IDP, states, in part, in making their assessment, the IDP should consider the impact of loss of the function/SSC against the remaining capability to perform the basic safety functions. This section also provides seven specific questions that should be considered by the IDP for making the final determination of the safety-significance for each function/SSC. However, it is unclear in the LAR how the IDP will collectively assess these seven specific questions. For example, is a function/SSC considered HSS when the answer to any one question is false (e.g., failure of the function/SSC will directly cause an initiating event or adversely affect the DID remaining to perform the function). Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS.

f. Section 7.1 of NEI 00-04, states, in part, [d]ue to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC or part thereof should be assigned the highest risk significance for any function that the SSC or part thereof supports. Clarify at what point during the licensees risk categorization process will assessment of the risk significance of SSCs that support multiple functions be identified to ensure they are assigned the highest risk significance given all SSCs that may overlap, may not be categorized.

g. The industry flow chart presented at the September 6, 2017, public meeting, shows that the passive categorization would be undertaken separately from the active categorization. Furthermore, in the LAR Section 3.1.2, Passive Categorization Process, the licensee states, in part, that [p]assive components and the passive function of active components will be evaluated using the Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the Safety Evaluation (SE) by the Office of Nuclear Reactor Regulation for Arkansas Nuclear One, Unit 2, regarding their Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, dated April 22, 2009 [ADAMS Accession No. ML090930246]. The NRC staff notes that this methodology has been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequence of pressure boundary failure for Class 1 SSCs may be different than for Class 2 and Class 3, and therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

The LAR does not justify how the ANO-2 methodology can be applied to Class 1 SSCs and how sufficient DID and safety margins are maintained. A Page 30 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 technical justification for Class 1 SSCs should address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: justification of the appropriateness of the conditional core damage probability (CCDP) numerical criteria used to assign High, Medium, and Low safety significance to these loss-of-coolant initiating events; identification and justification of the adequacy of the additional qualitative considerations to assign Medium safety significance (based on the CCDP) to High safety significance; justification for crediting operator actions for success and failure of pressure boundary; guidelines and justification for selecting the appropriate break size (e.g. double ended guillotine break or smaller break); and include supporting examples of types of Class 1 SSCs that would be assigned low safety significance, etc.

As mentioned in the meeting summary from the February 20, 2018, Risk-Informed Steering Committee (RISC) meeting (ADAMS Accession No. ML18072A301), the NRC staff understands that the industry is planning to limit the scope to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle license amendment (ADAMS Accession No. ML14237A034).

Please provide the requested technical justification, or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 equipment.

APS Response to RAI 11 a) The process to categorize each system will be consistent with the guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by RG 1.201. RG 1.201 states that:

the implementation of all processes described in NEI 00-04 (i.e.,

Sections 2 through 12) is integral to providing reasonable confidence and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by

§50.69(c)(1)(iv).

However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible, and as long as they are all completed, they may even be performed in parallel. Note that NEI 00-04 only requires Item 3 to be completed for components/functions categorized as LSS by all other elements. Similarly, NEI 00-04 only requires Item 4 to be completed for safety related active components/functions categorized as LSS by all other elements.

1. PRA-based evaluations (e.g., the internal events, internal flooding, and fire PRAs)

Page 31 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

2. Non-PRA approaches (e.g., seismic safe shutdown equipment list (SSEL), other external events screening, and shutdown assessment)

3. Seven qualitative criteria in Section 9.2 of NEI 00-04

4. The defense-in-depth assessment

5. The passive categorization methodology Figure 11-1 is an example of the major steps of the categorization process described in NEI 00-04:

Categorization Process Overview Figure 11-1 b) Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., HSS or LSS) that is presented to the Integrated Decision-Making Panel (IDP). Note: the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Attachment 4, Table 4-1. The safety significance determination of each element, identified above in Figure 11-1, is independent of each other and therefore the sequence of the elements does not impact the resulting preliminary categorization of each component or function.

Page 32 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04, Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however, the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201. Attachment 4, Table 4-1, summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in Attachment 4, Table 4-1. A component is assigned its final RISC category upon approval by the IDP.

c) The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., Internal Events PRA or Integrated PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04, Section 10.2, allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with an HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g. Passive, Non-PRA-modeled hazards). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped. Therefore, if an HSS component is mapped to an LSS function, that component will remain HSS. If an LSS component is mapped to an HSS function, that component may be driven to HSS based on Attachment 4, Table 4-1 or may remain LSS.

d) NEI 00-04, Section 5, defines categorization process considerations for both PRA-based and non-PRA-based (i.e., deterministic) assessment methods. Section 5.3, for example, describes the process for categorization from seismic risk considerations using either a seismic PRA (i.e., PRA-based) or using a seismic margin assessment (SMA), i.e.,

deterministic and not PRA-based. Section 7 requires assigning the safety significance of functions to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5 but does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5. The interpretation of this requirement is further clarified in the Vogtle SER (ML14237A034) which states:

Page 33 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS.

The reason for this is that the application of non-PRA based assessments results in the default safety significance categorization of any SSCs associated with the safe shutdown success paths defined in those deterministic assessments to be HSS regardless of its risk significance.

Therefore, there is no risk basis for assigning the SSC associated functions to be HSS, since the deterministic analyses from which the associated safe shutdown equipment lists are derived do not define functions equivalent to those used in the categorization process. This is the reason that the guidance in NEI 00-04, Section 7, clearly notes PRA-based in reference to NEI 00-04, Section 5. The categorization process is consistent with the guidance in NEI 00-04 as endorsed by RG 1.201.

If the results of the passive categorization are HSS, then the SSC is categorized as preliminary HSS regardless of the other categorization elements. An HSS determination by the passive categorization process cannot be changed by the IDP.

e) The assessment of the seven Qualitative Considerations is agreed upon by the IDP in accordance with NEI 00-04, Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration. However, the final assessments of the seven qualitative considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all of the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The system categorization document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e. all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification for each consideration or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

Page 34 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 f) During the Qualitative Risk Assessment of SSCs, the cognizant PRA Engineer assigns the component an initial qualitative risk based on the highest risk of any function supported by that component. For example, if the component supports two functions, one being HSS and the other LSS, the component would be assigned an initial qualitative risk of HSS.

g) APS confirms that it will apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 equipment.

Page 35 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 12 APLB - [SPRA] Overall Categorization Process Paragraph 50.69(c)(1)(iv) of 10 CFR requires that the categorization process include evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, and any potential increase in CDF and LERF resulting from changes in treatment are small. Paragraphs 50.69(e)(2) and (3) of 10 CFR require the licensee to monitor the performance of RISC-1 and RISC-2 SSCs and consider the data collected for RISC-3 SSCs and make adjustments to the categorization or treatment processes so that the categorization process and results are maintained valid.

Paragraph 50.69(b)(2)(iv) requires that each application includes a description of, and basis for acceptability of, the evaluations to be conducted to satisfy 10 CFR 50.69(c)(1)(iv). The evaluations shall include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms from both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Section 8, Risk Sensitivity Study, of NEI 00-04, provides guidance on performing a risk sensitivity study to confirm that the categorization process results in acceptably small increases to CDF and LERF. An example is provided in the guidance to increase the unreliability of all preliminary LSS SSCs by a factor of 3 to 5, which appears to address random failures. No explicit discussion of seismic risk sensitivity studies is provided in the guidance.

The categorization of SSCs using the SPRA is dominated by structural failure modes which are dependent on the corresponding modeling inputs such as the dominant failure modes and fragility curves. These modeling inputs are derived using several parameters, including the SSC design, testing, and as-built installation, all of which can be impacted by alternative treatments.

Additionally, NEI 00-04, Section 5.3, Seismic Assessment, states that for SSCs screened out of the SPRA due to inherent seismic robustness, it is important that the inherent seismic robustness that allows them to be screened out of the SPRA is retained.

Based on the preceding discussion, it is unclear to the NRC staff how the required risk sensitivity study will be performed for categorization using the SPRA to meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv), and how the modeling inputs in the SPRA and those used for the risk sensitivity study continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e). Provide the following:

a. A description of the evaluations that will be performed to demonstrate conformance with 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv) for those SSCs that may be classified as RISC-3 based, in part, on SPRA results.

b. A justification of how the required evaluations described in response to Part a above meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

Page 36 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

c. A description of how it will be determined that the modeling inputs in the SPRA continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e).

APS Response to RAI 12

a. The SPRA retains all the random failures modeled in the underlying internal events model. Sensitivities associated with a potential increase of random failure due to LSS reclassification can be performed on the SPRA model consistently with the sensitivities to be performed in the internal events model. For components that do not have associated random failures, sensitivities will be implemented using the surrogate basic events as identified in APS response to RAI 13 APLB. APS will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with NEI 00-04.

b. The seismic fragility parameters will not be changed in the SPRA for equipment that are re-classified as LSS because the re-classification does not impact the characteristics that are driving the definition of the fragility parameters, namely:

• The seismic demand for individual components does not change based on the re-classification as the location of the equipment does not change, nor the building in which the component is housed.

• The inherent seismic capacity of the component does not change, even if structural, failure modes dominate random failure modes for the specific components:

• Spatial interaction. The spatial interaction challenge is not changed by the equipment re-categorization. If, for example, the driving failure mode for the fragility estimate of a component is the spatial interaction with a nearby block wall, the re-categorization of the component itself would not impact that fragility.

• Anchorage. Also in this case, if the anchorage configuration is not changed upon re-categorization, there is no change in that fragility value.

• Functional failure. If the fragility estimate is driven by functional failure, then it can also be argued that a component re-categorization does not, for example, make a relay more vulnerable to chatter. Note that the functional fragility estimates are largely based on experience data and equipment qualification and testing. The equipment qualification and testing is not affected by a component being subsequently re-categorized as LSS, and the experience database is ultimately relying on a pool of components that are largely not safety-related and for non-nuclear applications [e.g., the Seismic Qualification Utility Group (SQUG) database includes a large number of data associated with equipment that is similar to equipment used in nuclear Page 37 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 plants], and therefore individual equipment re-categorization would not impact those considerations either.

Rugged components were addressed via surrogate fragilities (see response to RAI 14 APLB).

In accordance with 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights, SPRA sensitivity evaluations will meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

c. The PRA configuration control (procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15) includes an assessment of impact of design changes on the seismic PRA. Since an LSS component is not eliminated from the PRA (and therefore from the SPRA as well), a design change that impacts an LSS component will be addressed as appropriate and if a design change requires revisiting the fragility estimates, then an update of the SPRA shall be planned based on the plant PRA update procedures.

Page 38 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 13 APLB - [SPRA] Overall Categorization Process The guidance in NEI 00-04, Sections 5.1, Internal Events Assessment, and 5.3, indicate that the categorization of SSCs, including that using the SPRA, should be based on importance measures and corresponding numerical criteria. Further, NEI 00-04, Section 5.6 discusses the integral assessment wherein the hazard specific importance measures are weighted by the hazards contribution to the plant risk. It is unclear how the integrated importance measures are calculated for certain SPRA basic events that may not align with basic events in other PRA models.

Describe and justify how the integrated importance measures are calculated for SPRA basic events that may not align with basic events in other PRA models.

Indicate how the resulting integrated importance measures will be used to assign the safety-significance of affected SSCs.

APS Response to RAI 13 The PRA one-top model will be used to solve structure, system, and component (SSC) importance measure values separately for each hazard (i.e., internal events, internal flooding, internal fire, and seismic) and then for the combined integrated model (all hazards). This process fully complies with NEI 00-04, 10 CFR 50.69 SSC Categorization, Revision 0.

The SPRA is built upon the internal events PRA and uses the same basic event naming except for the unique seismic failure modes found in the SPRA. The determination of importance measures for the SPRA will utilize the same process as for other hazards where the overall Fussell-Vesely (F-V) importance for each SSC will be the sum of all failure modes over all hazards, and the risk achievement worth (RAW) for each SSC will be the largest RAW of the SSC failure mode basic events over all hazards.

For components that have no dedicated basic event in a PRA model, the following steps will be performed in accordance with procedure 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights:

1. For the system selected for categorization, obtain a list of all non-modeled components in that system.

2. Review each component for the following:

• Failure mode

• Impact of such a failure on its supported mitigating function

• The PRA capability to support the impact of the non-modeled SSC on the supported mitigating function

3. Assign a surrogate basic event to that component if the components failure will noticeably degrade the systems mitigating function and the existence of any one of the following attributes:

Page 39 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• The system supports a modeled key safety function,

• Is a sub-component of the surrogate component,

• Is a supporting component to the modeled surrogate basic event,

• Is required to fulfill a human-operator action basic event,

• Can be approximately modeled with minimal conservatism

4. Retrieve the surrogate basic event importance measure value by one of the following approaches:

• Directly from existing PRA model results files

• Quantifying the configuration risk management program model Page 40 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 14 APLB - [SPRA] Overall Categorization Process NEI 00-04, Section 5.1 provides guidance on the use of importance measures for identifying the candidate safety significance of components during the categorization process. Based on the information provided in the LAR, the NRC staff could not determine how importance measures for identifying the candidate safety significance of components during the categorization process will be used.

Provide the following:

a. NEI 00-04, Section 5.1 states that in calculating the Fussel-Vesely (FV) risk importance measure, it is recommended that a CDF (or LERF) truncation level of five orders of magnitude below the baseline CDF (or LERF) value be used for linked fault tree PRAs and that the truncation level used should be sufficient to identify all functions with a risk achievement worth of greater than 2. Demonstrate the impact of the selected truncation level for the higher bins in the SPRA on the importance measure criteria and the categorization.

b. A description of how the selected screening level in the SPRA maintains consistency with the importance measure criteria in NEI 00-04 or justify any deviations from the guidance by using the selected screening level. This justification may include demonstration of the impact of the selected screening level in the SPRA on the importance measure criteria and the categorization of SSCs.

APS Response to RAI 14

a. The truncation study performed to confirm the stability of the model is discussed in Section 4.3.2 of the quantification notebook, CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision

1. Truncation studies are performed at different g-levels in the generation of the cutsets via CAFTA software that will be fed to SHIP software.

Truncation convergence is demonstrated at each g-level following the guidance in the ASME/ANS RA-Sa-2009 Standard for internal events PRA (i.e., less than 5% difference from the previous decade for the declared converged decade). Numerically, this is consistent with the NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, guidance of 5 orders of magnitude lower than the base case CDF/LERF for the lower g-level but it is closer to 3 orders of magnitude for the higher g-levels. In a seismic PRA, a more meaningful concept of model stability and convergence looks at the stability of the overall plant fragility curve [i.e., overall stability of the conditional core damage probability (CCDP) or conditional large early release probability (CLERP)] rather than to truncation convergence. In this perspective, truncation convergence at higher g-levels is less important because the CCDP is closer to 1.0 at higher g-levels. From the quantification notebook CN-RAM-12-022 one can conclude that the plant level CCDP and CLERP (i.e., the plant fragility curves for CDF and LERF) are stable at 1.0, which means that adding cutsets will not change the overall Page 41 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 results (as CCDP and CLERP cannot go above 1.0). In other words, at high g-levels the integration of the hazard and fragility only returns the hazard curve itself, and therefore additional cutsets not included in the solution because of truncation cannot change the results.

b. The PVNGS SPRA does not use any specific screening level. In other words, there is no quantitative threshold for dismissing a seismically induced failure. All the seismic failures for which seismic fragilities are calculated are included in the model, regardless of the calculated or estimated fragility value. Components that are screened out from an explicit fragility calculation are grouped into surrogate fragility events, one for each system.

An estimate for the surrogate fragilities is provided and is explicitly entered in the model as well. The presence of any surrogate fragility among the important risk contributors would indicate that the surrogate needs to be refined (for example, extracting components from the surrogate and generating specific fragilities). In the current quantification notebook CN-RAM-12-022, the highest ranking surrogate fragility, SF-ALTFW-SUR, is ranked 36th for F-V (overall F-V = 1.68E-03). Section 5.4.2 of CN-RAM 022 explicitly discusses a sensitivity case study associated with the currently modeled surrogate fragilities. Figure 5.4-1 CN-RAM-12-022 shows a comparison between the plant level CDF fragility curve and the surrogate fragilities that shows how the surrogate fragilities are currently significantly lower than the plant level fragility, which is an additional visual indication that they are not significant contributors to the current results.

Page 42 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 15 APLA - Disposition of Key Assumptions and Uncertainties for IE, IF, and FPRA as it pertains to 10 CFR 50.69 Categorization NEI 00-04, Section 5, Component Safety Significance Assessment, as endorsed by RG 1.201, Revision 1, stipulates use of sensitivity studies during the categorization process associated with the choice of specific models and assumptions, as discussed in RG 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (ADAMS Accession No. ML100910006).

Section 3.2.7 of the LAR explains that PRA model assumptions and sources of uncertainty have been identified for this application using guidance from NUREG-1855. Section 3.2.7 further states, in part:

Key PVNGS PRA model specific assumptions and sources of uncertainty for this application were evaluated and documented. These key assumptions and sources of uncertainty reviewed were previously submitted to the NRC in the application dated July 31, 2015 for risk-informed completion times.

The NRC staff found that the evaluation of the PRA model assumptions and sources of uncertainty in the licensees LAR dated July 31, 2015, were dispositioned in each case specifically for the risk-informed completion time (RICT) program. Some of these dispositions refer to an element of the RICT program, such as Risk Management Actions, which are not part of the risk categorization process. As such, the LAR associated with 10 CFR 50.69 does not present dispositions of how the PRA model assumptions and sources of uncertainty impact the risk categorization process.

The licensee stated that the conclusion of the review for this application is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for in the process of categorizing SSCs into risk-informed safety classifications. The licensee will include in the risk sensitivity study a sensitivity increasing all the seismic PRA human event failures (HEFs) derived from the IEPRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

Provide the technical justification to support the LAR conclusion that no additional sensitivity analyses are required to address model specific assumptions or sources of uncertainty except as indicated above (e.g., provide the key PRA modelling assumptions and sources of uncertainty for the internal events and fire events PRAs and disposition them explicitly for the risk categorization process).

Page 43 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 15 Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1.200, Revision 2, (Reference 1) and the ASME/ANS RA-Sa-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 2), have been identified for the P V N G S PRA models using the guidance of NUREG-1855 (Reference 3) and EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 4).

The detailed process of identifying, characterizing, and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups including fire events.

Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of risk categorization of SSCs.

If the PV NG S model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on risk categorization. Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application.

Key assumptions and sources of uncertainty for the 10 CFR 50.69 Program application are identified and dispositioned in Attachment 5, Table 5-1. The conclusion of this review is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for the following:

• In the process of categorizing SSCs into risk-informed safety classifications, APS will include in the risk sensitivity study a sensitivity increasing the unavailability of fast bus transfer by a factor of 3 to address the increase in risk during startup transformer maintenance for the 13.8 kV non-Class 1E Power System (NA) and 4.16 kV non-Class 1E Power System (NB).

Page 44 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 16 APLB - [SPRA] Sensitivity Studies Section 5.3 of NEI 00-04 indicates that components can be identified as being safety-significant following sensitivity studies. Section 5.3 also recommends the completion of several sensitivity studies, including any applicable sensitivity studies identified in the characterization of SPRA adequacy.

a. NEI 00-04, Table 5-4 identifies, among other SPRA sensitivity studies, any applicable sensitivity studies identified in the characterization of PRA adequacy.

i. Indicate whether the key assumptions and key sources of uncertainty (including relevant methods) have been evaluated to determine whether an additional SPRA sensitivity study will be performed in accordance with NEI 00-04, Section 5.3.

ii. Summarize the results of the evaluation discussed in Part (i), the process that will be performed to complete the evaluation discussed in Part (i), or a justification for not performing the evaluation discussed in Part (i).

b. The key assumptions and sources of uncertainties identified as part of the licensees submittal may change as SPRA model updates could affect the significance of those assumptions for this application or create new or different key assumptions or sources of uncertainties. Describe how your 10 CFR 50.69 program will continue to evaluate assumptions and sources of uncertainty when the SPRA model is updated in the future and subsequently incorporates key assumptions and key sources of uncertainty in sensitivity analysis that are performed consistent with the guidance in NEI 00-04.

APS Response to RAI 16

a. i. A review of key assumptions and sources of uncertainty for the 10 CFR 50.69 program application identified one sensitivity study to address the operator action timing for a seismically induced event.

a. ii. APS will perform a sensitivity study on the seismic PRA model by increasing all the seismic PRA HFEs. A factor of 3 will be applied to all HFEs since they are derived from the internal events PRA model. This sensitivity study will address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

b. Procedure 01DP-0RS09, 10 CFR 50.69 Active Component Risk Significant Insights, will be used to implement the process of performing sensitivity studies and re-evaluating changes. Step 4.17 describes how initial sensitivity studies will be performed. Step 4.18 describes how the re-evaluation of sensitivity studies will be performed. Included in this step is an action to review the impact of the current categorization activity on previous categorization results. Step 4.19 describes performing PRA reviews to ensure the continued validity of categorization results. A substep Page 45 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 of 4.19 ensures that key assumptions and sources of uncertainty are evaluated after each SPRA update for impact on the 10 CFR 50.69 program sensitivity analyses and categorization.

Page 46 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 17 APLA - Other External Hazards Peer Review Section 3.3 of the LAR states that a full-scope external hazards screening peer review was performed in December 2011 in accordance with RG 1.200, Revision 2.

The LAR does not discuss the results from this external hazards screening peer review and does not state whether the F&O closure review in June 2017 addressed any findings from the external hazards screening peer review.

a. Clarify whether the finding-level F&Os, if any, from the December 2011 peer review of the external hazards screening process was encompassed in the scope of the June 2017 F&O closure review.

b. If finding-level F&Os from the December 2011 peer review of the external hazards screening process were not addressed in the June 2017 F&O closure review, provide these findings and the associated dispositions as it pertains to this application.

APS Response to RAI 17 The December 2011 other external hazards screening peer review identified three findings (see Attachment 6, Table 6-1). Two findings, EXT-D1-01 and EXT-D1-02, concerned five issues identified during the walkdown. The third finding, EXT-E2-01, concerned insufficient documentation of transportation accident and tornado missile impact. These findings were inadvertently excluded from the June 2017 F&O closure review. All these findings were resolved as indicated in Attachment 6, Table 6-1.

These three findings will be included and verified closed in an augmented F&O closure review, as described in Attachment 1.

Page 47 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 18 APLA - SSCs Categorization based on Other External Hazards NEI 00-04 provides guidance on including external events in the categorization of each SSC to be categorized. Fire and seismic hazards are discussed in Section 5.2 and 5.3 of NEI 00-04, respectively. All other hazards are discussed in Section 5.4, Assessment of Other External Hazards. Figure 5-6 in Section 5.4 illustrates the process that begins with the SSC selected for categorization and then proceeds through the flow chart for each external hazard. Figure 5-6 of NEI 00-04 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, it has to be further shown that if the component was removed, the screened scenario would not become unscreened.

NEI 00-04 explicitly states, in part, [i]f it can be shown that the component either did not participate in any screened scenarios or, even if credit for the component was removed, the screened scenario would not become unscreened, then it is considered a candidate for the low safety-significant category.

a. Identify the external hazards that will be evaluated according to the flow chart in NEI 00-04, Section 5.4, Figure 5-6.

b. Identify the external hazards for which all credited SSCs will be considered HSS.

c. Describe and justify any additional method(s) different from Parts a or b above, that will be used to evaluate individual SSCs against external hazards, and identify the hazards that will be evaluated with these methods.

d. Confirm that all external hazards not included in the categorization process from Parts a, b, or c above, will be considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

e. Attachment 4, External Hazards Screening, of the LAR indicates that the external flooding hazards are screened from consideration in the 10 CFR 50.69 process. Further comment for external flooding screening states, Plant design meets 1975 SRP [Standard Review Plan] requirements.

i. Identify what type of SSCs, if any, are credited in the screening of external flooding, such as passive or active features.

ii. If any SSCs are credited for screening of external flooding, then explain and justify how the guidance in Figure 5-6 of NEI 00-04 will apply to external flooding hazards.

f. The LAR states that extreme wind or tornado hazard is screened on the basis that the frequency of damage to the exposed components is estimated to be less than 1E-6/year. Further comments for screening extreme wind or tornado states the spray pond nozzles (not protected against missiles) have a bounding median risk less than 1E-07/year.

i. Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will be applied for this hazard. Specially, Figure 5-4 of NEI 00-04 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, it has to be further Page 48 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 shown that if the component was removed, the screened scenario would not become unscreened.

ii. Explain how the discussion in Part i above would be impacted by the current effort to assess tornado missile protection hazard in response to NRC Regulatory Issue Summary 2015-06, Tornado Missile Protection.

APS Response to RAI 18

a. The other external hazards that will be evaluated according to the flow chart in Figure 5-6 of NEI 00-04 are any hazards listed in Attachment 4 of the LAR, External Hazards Screening, that have not been screened following the process in the ASME/ANS PRA Standard, RA-Sa-2009.

For Palo Verde, all other external hazards (i.e., other than internal events, internal flood, internal fire, and seismic) have been screened as noted in the LAR. As part of the external hazard screening, an evaluation was performed to determine if there are components that participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart, these components would be considered HSS.

b. The statement, All SSCs credited in other IPEEE external hazards are considered HSS, was intended to be consistent with the flow chart in Figure 5-6 of NEI 00-04. There are no other external hazards that will be evaluated using a method other than that which is depicted in the flow chart.

c. There is no additional method(s) different from Part a or b above that will be used to evaluate individual SSCs against external hazards.

d. APS confirms external hazards not included in categorization process Part a, b, or c above are considered insignificant.

e. The basis for screening external flooding and extreme wind or tornado hazards in Attachment 4 of the LAR is discussed below.

i. The screening process followed the guidance in Figure 5-6 of NEI 00-

04. The screening process includes an evaluation of whether SSCs participate in screened scenarios and also considers whether, if credit for SSCs were removed relative to the hazard being evaluated, the hazard would then become unscreened. More specifically, for each external hazard in Attachment 4 of the LAR, an assessment was performed to determine if equipment (i.e., SSCs) is relied upon to mitigate a hazard based on the design basis and severe accident functions of the component. Such SSCs would be considered HSS.

ii. Engineering Study 13-NS-C111, Other External Hazards PRA, addresses external flooding. Based on the PVNGS design for flooding, the IPEEE judging the UFSAR Probable Maximum Precipitation (PMP) to be conservative, and recent maximum rainfalls lying significantly below the PMPs, external flooding is screened for PVNGS. As systems are categorized for 10 CFR 50.69, the components will be reviewed to Page 49 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 determine which design features for flooding may require a component to be HSS.

f. Spray pond nozzles and other features associated with the screened tornado missile hazard must remain HSS. APS has no plans to implement alternatives to the existing licensing basis treatment of tornado missile hazards for the spray ponds.

Page 50 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 19 APLA - Shutdown Risk Section 3.2.5, Low Power & Shutdown, of the LAR states the categorization process will use the shutdown safety management plan described in NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, dated December 1991 (ADAMS Accession No. ML14365A203) for categorization of safety significance related to low power and shutdown conditions. However, the LAR does not cite the other criteria specified in NEI 00-04, Section 5.5, Shutdown Safety Assessment, pertaining to low power shutdown events (i.e., DID attributes and failures that would initiate a shutdown event). Clarify and provide the basis for how the categorization of SSCs will be performed for low power and shutdown events, and how it is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1.

APS Response to RAI 19 APS will utilize a quantitative PRA model for categorization of at power events in plant Modes 1 and 2. For plants without a low power and shutdown PRA, such as Palo Verde, NEI 00-04, as endorsed by RG 1.201, allows the use of a modified process based on the NUMARC 91-06 program to address categorization in plant Modes 3 through defueled. The categorization process will follow the guidance and criteria in Section 5.5 of NEI 00-04 to address low power and shutdown risk. That process, for Palo Verde, is described in procedure 70DP-0RA01, Shutdown Risk Assessments. Below is a summary of the NEI 00-04 process and requirements.

The overall process for addressing low power and shutdown risk is illustrated in Figure 5-7 of NEI 00-04. NUMARC 91-06 specifies that a defense-in-depth approach be used with respect to each defined low power and shutdown key safety function.

The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs. NEI 00-04 provides two criteria for SSCs to be considered preliminary HSS.

1. If a system/train supports a key safety function as the primary or first alternate means, then it is considered to be a primary low power and shutdown safety system and is categorized as preliminary HSS. Procedure 70DP-0RA01, Shutdown Risk Assessment, which is consistent with NUMARC 91-06, is used as a guide to identify primary and first alternative means. NEI 00-04 defines a primary low power and shutdown safety system as also having the following attributes:

• It has a technical basis for its ability to perform the function.

• It has margin to fulfill the safety function.

• It does not require extensive manual manipulation to fulfill its safety function.

2. If the SSCs failure would initiate an event during low power and shutdown plant conditions (e.g., loss of shutdown cooling, drain down), then that SSC is categorized as preliminary HSS.

As stated in NEI 00-04, If the component does not participate in either of these manners, then it is considered a candidate as low safety significance with respect to low power and shutdown safety.

Page 51 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 20 APLA(B) - Reported Baseline Risk Values Attachment 2, Total Unit 1/2/3/ Baseline Average Annual CDF/LERF, of the LAR provides the CDF and LERF values for internal events, internal flooding, internal fire, and seismic events for PVNGS Units 1, 2, and 3. The CDF and LERF values of each hazard presented in LAR Attachment 2 are identical for each unit. Typically, differences in CDF and LERF results exist for multiple-unit plants, even if the differences are not significant. Also, the LAR states numerous times that the licensees risk management process ensures the PRA model used in the application reflects the as-built and as-operated plant for Units 1, 2, and 3. It is not clear to the NRC staff whether the risk values reported in LAR Attachment 2 are the results of separate PRAs performed for each unit or whether PRAs were performed only for a given unit and assumed to represent all three units.

a. If the PRAs were performed only for a given unit and assumed to represent all three units, then for each hazard:

i. Justify that the PRA model is an adequate representation of all three units.

ii. Include a discussion of SSCs that are shared between units and how these were implicitly or explicitly modeled.

iii. Indicate how this assumption will be confirmed going forward if plant modifications vary between units.

b. If the PRAs were performed for each unit separately, explain why the risk results are identical.

APS Response to RAI 20

a. The PRAs were developed based on Unit 1 and modified to capture the scenario impacts and system responses to represent all three units. Delta assessments for differences between Unit 1 (base model) and Units 2 and 3 have been documented and incorporated as appropriate in a composite PRA model. The composite PVNGS PRA model for Units 1, 2, and 3 was confirmed to be representative of the as-built condition of Units 2 and 3 and is not overly conservative for the representation of the as-built condition of Unit 1.

i. Delta assessment summaries for each hazard:

Internal Events PRA The PVNGS units are three physically separate and independent units that are nearly identical in design, construction, maintenance, and operation. Given that the units are nearly identical, one internal events PRA model was developed using Unit 1 as the base case model. There are some minor electrical differences between Unit 1 and the other two units:

a) Unit 1 has a breaker between the Non-class 1E 13.8 kV Intermediate Start-up Switchgear (NANS05) and the Non-class 1E 13.8 kV Onsite Page 52 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Switchgear (NANS03), and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not.

b) Unit 1 is unique in supplying normal power from the Start-up Transformers to the switchyard and to the Water Resources Facility (WRF) via the non-Class 1E 13.8 kV intermediate start-up switchgear.

c) The units connect to three separate, shared, startup transformers for normal and backup power. The startup transformers are identical, so the functions are identical, and the only difference is that different startup transformer and switchyard breaker component numbers are mapped to the basic events for the three units.

These differences represent additional failure modes for Unit 1 components and systems, but are insignificant in the base case model. The results for Unit 1 bound Units 2 and 3.

Internal Fire PRA A review of all unit specific inputs to the internal fire PRA (FPRA) model was conducted and documented to identify unit differences that potentially impact the model. The review identified various as-built/as-operated differences between the PVNGS units. Those that impact the fire PRA modeling are:

• Relocated ignition source target raceways,

• Required cable routing through alternate raceways or fire compartments,

• Distances from ignition source to 1st target or 1st tray,

• Hot Gas Layer timing, and

• Protected raceways (fire wrap)

An equivalency determination was made regarding each difference with respect to the modeling based on Unit 1 input data. Where Unit 2 and Unit 3 specific input data was not equivalent or bounded by the Unit 1 modeling, revised data was provided to construct a composite FPRA model that represents all the fire induced impacts in all units.

An evaluation of the FPRA composite model quantification results was conducted to assess any potential over- or non-conservatism in using either the Unit 1 based FPRA model or the FPRA composite model.

Recently completed plant modifications and model refinements have resulted in the as-built/as-operated units being more closely aligned.

The resulting delta risk between the FPRA baseline model (based solely on Unit

1) and the FPRA composite model (based on all fire impacts from all three units) is less than 0.5% for CDF and 0.1% for LERF. The FPRA composite model most accurately represents Unit 3, but is a very reasonable representation of all three units. The FPRA composite modeling is not overly conservative for the representation of the as-built condition of Unit 1.

Page 53 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Comparison of the FPRA baseline model to the FPRA composite model also concluded:

• The (unit specific) impacted scenarios do not significantly change in dominance amongst all ignition source scenarios,

• The ignition source relative contributions were not significantly rearranged,

• All dominant scenarios represent ignition sources existing in all three units, and

• Total fire compartment risk contributions also did not significantly change Consequently, it is concluded that the relative importance of impacted components is not significantly affected. The minor differences between the units are not expected to result in any impact on the importance of individual components as modeled for risk-informed applications.

Internal Flood PRA The internal flood PRA (IFPRA) was developed for Unit 1. Walkdowns have been performed to confirm/verify the applicability of the Unit 1 flooding analysis to the other two units. No significant flooding related differences were noted between the three units for internal flooding. Therefore, Unit 1 is an adequate representation of all three units.

Seismic PRA The seismic PRA (SPRA) developed for Unit 1 was assessed for applicability to Units 2 and 3. Non-significant differences were observed in the SPRA hazard evaluations and a limited subset of the equipment was judged to warrant unit-specific fragility evaluations. The unit specific fragilities were quantified with both the composite hazard and the Unit 1 SPRA model. The differences in CDF and LERF are, as expected, minimal.

The seismic hazard evaluation was calculated with a composite profile with a single set of amplification factors, with uncertainties representing differences in site profiles among the three units. A sensitivity analysis was then performed to evaluate the difference in seismic hazard between the three units. The conclusion of the sensitivity study was that from the perspective of seismic hazard, the general differences that can be observed between the composite hazard and the unit-specific hazard do not appear to be significant.

Despite the similarity between the three units, dedicated fragility walkdowns have been performed to confirm/verify the applicability of the Unit 1 analysis to the other two units. Following the walkdowns, a limited number of deviations between the three units have been observed that were warranting the development of dedicated Unit 2 and Unit 3 fragility estimates. The fragility analyses for Units 2 and 3 were performed with the same composite hazard developed for the base case (i.e., Unit 1). A limited number of unit-specific fragility parameters were developed where Unit 2/Unit 3 were expected to be different from the Unit 1 fragility parameters. The master fault tree file was Page 54 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 modified for Units 2 and 3 and the SPRA results of the quantification are summarized below.

The following list of components is a summary of structural/interaction deviations from Unit 1 that required unit-specific fragility parameters:

• Unit 2 Diesel Generator A Air Intake Structure

• Unit 2 Diesel Generator Room Essential Exhaust Fans

• Unit 3 Diesel Generator Room Essential Exhaust Fans

• Unit 2 Essential Cooling Water A and B Heat Exchangers

• Unit 2 Auxiliary Feedwater Pump A

• Unit 3 480 V Motor Control Center M32

• Unit 3 DC Battery C

• Unit 3 DC Battery D

• Unit 3 Essential Cooling Water B Heat Exchanger

• Unit 3 Diesel Generator A and B Fuel Oil Storage Tanks The resulting delta risk between the baseline SPRA Unit 1 model and the SPRA Unit 2 and Unit 3 models is less than 0.01% for CDF and LERF. Therefore, Unit 1 is an adequate representation of all three units.

ii. The shared systems between the units are as follows:

1. In normal line-up, the three startup transformers each supply one source of off-site power to two units through separate secondary windings. Thus, loss of one start-up transformer would cause a single train of Engineered Safety Feature (ESF) equipment on two units to lose normal off-site power. Each startup transformer also supplies backup off-site power to both trains in one unit. Class 1E buses would be powered by the emergency diesel generator on a loss of power and then manually transferred back to off-site power by the operators. Loss of off-site power to one ESF bus is not an initiating event. If the unit auxiliary transformer is lost, non-Class 1E power is transferred using a fast bus transfer to the normally aligned start-up transformer (e.g., reactor coolant pumps remain powered). If one unit is on its normal start-up transformer and another unit on its alternate start-up transformer due to maintenance, they share a transformer winding and one unit will block fast transfer of their non-Class 1E 4160V buses. These electrical alignments are included in the PRA model. Unit 1 has a breaker between the non-Class 1E intermediate start-up switchgear (NANS05) and the non-Class 1E onsite switchgear (NANS03) and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not. Unit 1 is also unique in supplying normal power from the start-up transformers to the switchyard and to the Water Page 55 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Resources Facility (WRF). Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

2. Layout and functional alignment of the main control boards is equivalent between the units with the exception of main control board B01 for switchyard controls. Units 2 and 3 have mimic boards (indication) for the switchyard and startup transformers, but only have control for closing their own units breakers and must coordinate with Unit 1 for operation of the station blackout generators (SBOGs). SBOG HFEs were already captured with the Unit 1 modeling. The impact of the Unit 1 Control Room breaker control circuits on Units 2 and 3 was screened out based on the hot-short opening of a breaker due to a fire in Unit 1 impacting Units 2 or 3 being below the quantitative screening criteria [< 1.0E-7/yr for core damage frequency (CDF) and < 1.0E-8/yr for large early release frequency (LERF)], lack of impact to any of the mitigating equipment, the rare occurrence of an internal fire initiated loss of off-site power (LOOP) in industry, the inclusion of industry historical data in the PVNGS values for plant centered LOOP and switchyard centered LOOP, and the small contribution of LOOP to internal fire CDF and LERF. Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

3. Another common electrical connection is to the SBOGs. It is not expected that more than one unit would ever be lined up to receive power concurrently from the SBOGs, although procedures exist to provide limited power to Units 1 and 2 or 1 and 3 (not modeled in the PRA). The likelihood of two units experiencing a simultaneous station blackout is screened out due to its low probability. When a loss of off-site power is experienced on one or both ESF buses in any unit, operators are dispatched to manually start the SBOGs within one hour. As indicated above, SBOG HFEs were already captured with the Unit 1 modeling.

4. The PVNGS fire water supply is also shared between the units.

There are two separate, reliable fire water supply tanks located near the Water Resource Facility boundary. Both tanks are interconnected and the fire protection pumps can take suction from either or both. The headers are arranged in a loop system with two headers running from the pump house along the north and south sides of the power plants. A significant leak in one tank or its piping will initiate a low level alarm alerting operators in the Unit 1 Control Room. Three redundant and diverse (one electrical and two diesel driven) fire pumps are available to supply pressure for the fire main when it exceeds the capacity of the jockey pump.

A seismic failure of the fire protection water main is a potential source of common cause failure of the fire water suppression system. The fire protection water main consists primarily of a Page 56 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 closed 12-inch underground loop encompassing all units, the service and administration buildings, and site construction buildings. The yard main is provided with post-indicator valves for sectional control. Post-indicator valves are also located such that the yard loop for any individual power block can be isolated from the yard loops of the remaining units. Outside hydrants are provided at approximately 250-foot intervals within the power block area and as required near other hazards and near other remote buildings. Hydrants are equipped with 2-1/2 inch hose connections.

According to the Updated Final Safety Analysis Report (UFSAR),

Revision 19, in the unlikely event that the plant fire pumps cannot furnish an adequate water supply to the distribution system, the yard main includes pump connections for obtaining water from the circulating water system cooling tower basin by using portable pumping units. 14OP-0FP05, Isolation of the Fire Water Suppression System, Revision 5, directs the fire protection personnel in the correct operation of isolating specific portions of the fire water suppression system. In doing so, a damaged section of the fire protection water main can be isolated to ensure proper operation elsewhere.

Another mode of failure for the fire water system is seismically induced common cause failure of the fire water pumps. During normal operation, the fire protection water system is kept continuously full and pressurized by the jockey pump. When significant flow (more than 40 gallons per minute) is required to the fire water system, the fire pumps are designed to start sequentially on decreasingly lower pressures in the fire main. Normally, the first fire pump to start would be the motor-driven fire pump when the pressure in the fire main header drops to 95 psig. If the fire main pressure drops below 90 psig and remains below that point for at least 20 seconds, the first diesel-driven fire pump cycles on. The second diesel-driven fire pump will cycle on if the pressure in the fire main header drops below 85 psig and remains below that pressure for at least 30 seconds, according to the UFSAR. Common cause or correlated seismic failure of all fire pumps is mitigated with the availability of a backup fire pump configuration outlined in 14OP-9FP07, Backup Fire Pump Installation, Revision 0.

Low-pressure carbon dioxide systems are provided for total flooding and local hand hose application in those areas indicated in Table 9.5-1 of the UFSAR. In addition, Halon 1301 fire suppression flooding systems are provided to protect additional areas. Each area has its own main and auxiliary gas bottles that are anchored.

Therefore, given each area has its own localized source and components, common cause failure due to seismically induced failure is not a concern.

Page 57 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 Finally, the PVNGS Fire Department has recently purchased five fire protection apparatus: three pumpers, one 78 foot aerial ladder/pumper, and one nuclear emergency response vehicle (NERV). The three pumpers are Tilt Table qualified to 26.5 degrees. The NERV is Tilt Table qualified to 30 degrees. All of these firefighting vehicles comply with the UFSAR requirement to address fire header decapitation and supply water to the fire protection systems within each unit.

Therefore, common mode failure of the fire water system to more than one unit is screened out.

5. The units are also connected via the auxiliary steam system, which supplies process steam for water processing and turbine gland seals during secondary plant start-up. The normal line-up of this system is one unit supplying auxiliary steam for all three units. This sharing is done primarily to keep the lines warm and the water within them in good condition. Malfunctions of the system are not significant enough perturbations to cause a trip or shutdown; nor is the system credited in the PRA for mitigating any transients or accidents. For these reasons, the auxiliary steam system is not modeled in the PRA. Procedures do exist, to transfer condensate from one unit to another, if needed.

6. The tower make-up and blowdown system supplies makeup condenser cooling water to all three units to make up for evaporation and blowdown. Its failure would lead to the shutdown of all three units due to lowering level in the circulating water intake for each of the units. It has redundant pumps powered by redundant power supplies, making it highly reliable. Should it ever fail, it would most likely be manifest as a normal shutdown for all three units. At worst, it could lead to loss of condenser vacuum and loss of plant cooling water. It is not required for safe shutdown. For these reasons, the tower make-up and blowdown system is not modeled in the PRA.

iii. PVNGS process going forward if plant modifications vary between units.

As plant modifications and model refinements are developed, the relative impact on the composite PRA model will continue to be assessed. Since plant modifications are usually installed during refueling outages, the three PVNGS units will have different combinations of modifications installed. Significant impacts will be incorporated by updating the composite [backbone] model with the plant modification and implemented for the specific unit(s) in which the modification(s) have been installed. This may require several official model revisions be maintained to accurately represent the status of implemented modifications. Each Model of Record (MOR) revision will be maintained under the PRA model control procedure Page 58 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 70DP-0RA03, Probabilistic Risk Assessment Model Control, Revision 15.

b. PRAs were not performed separately for each unit.

Page 59 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 21 APLA - Fire Hazards Section 3.2.2, Fire Hazards, of the LAR states in part, the Internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes NRC approved methods. As part of the ongoing PRA maintenance and update process described in Section 3.2.6, APS will address Internal Fire PRA methods approved by the NRC since the development of the Internal Fire PRA. Furthermore, in Section 3.3 of the LAR, the licensee specifies that a full-scope FPRA model peer review was performed in December 2012 and a focused scope FPRA model peer review was conducted in December 2014.

There have been numerous changes to the FPRA methodology since the last full-scope peer review of the PVNGS FPRA. The integration of NRC-accepted FPRA methods and studies described below that are relevant to this submittal could potentially impact the 10 CFR 50.69 risk categorization results and/or risk acceptance guidelines for total CDF and total LERF:

• NRC letter, Recent Fire PRA Methods Review Panel Decisions and EPRI 1022993, Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires, dated June 21, 2012 (ADAMS Accession No. ML12171A583), providing staff positions on (1) frequencies for cable fires initiated by welding and cutting, (2) clarifications for transient fires, (3) alignment factor for pump oil fires, (4) electrical cabinet fire treatment refinement details, and (5) the EPRI 1022993 report.

• NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 2, Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced electrical Circuit Failure (ADAMS Accession No. ML14141A129), which is supported by a letter from the NRC to NEI, Supplemental Interim Technical Guidance on Fire-Induced Circuit Failure Mode Likelihood Analysis (ADAMS Accession Nos. ML14086A165 and ML14017A135).

• NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database:

United States Fire Event Experience Through 2009 (ADAMS Accession No. ML15016A069).

Section 2.5.5 of RG 1.174, provides guidance that indicates additional analysis is necessary to ensure that contributions from the above influences would not change the conclusions of the LAR.

a. Provide a detailed justification for why the integration of the above NRC-accepted fire PRA methods and studies would not change the conclusions of the LAR, and subsequently change the categorization process results. As part of this justification, identify potential fire PRA methodologies used in the fire PRA that are no longer accepted by the NRC staff. Provide technical justification for its use and evaluate the significance of its use on the risk metrics for the application (RG 1.174) provided in Attachment 2 of the LAR.

OR Page 60 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

b. Alternatively, for each NRC-accepted fire PRA method described above, provide the following:

i. Explain how each method is addressed in the fire PRA that will be used during the 10 CFR 50.69 categorization process, and provide updated results for the risk metrics in Attachment 2 of the LAR.

ii. Indicate whether any changes to the fire PRA to address the methods are PRA maintenance or a PRA upgrade as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2, along with justification for the determination.

iii. Discuss the focused scope (or full-scope) peer review(s) that has been performed to evaluate the changes that were determined in Part b.ii above to constitute a PRA upgrade, providing the date for when the peer review(s) was performed and when the peer review report(s) was approved that evaluated the incorporation of the method(s).

c. Provide the findings of the peer review(s) performed from Part b.iii (above) and the disposition for each finding as it pertains to the impact on the 10 CFR 50.69 application.

APS Response to RAI 21 APS will revise the fire PRA model to incorporate more recently endorsed fire PRA guidance prior to implementation of the 50.69 program as part of the maintenance and update process. APS will provide the updated PRA model CDF and LERF values after these and other changes described in other RAI responses are incorporated.

APS will provide the estimated PRA model CDF and LERF values as described in Attachment 1. The estimated CDF and LERF values will include a list of changes made to the baseline PRA model reported in the LAR Attachment 2, Total Unit 1/2/3 Baseline Average Annual CDF/LERF, and to demonstrate that the total CDF and total LERF are below the limits established in RG 1.174, which are 1E-4/year for CDF and 1E-5/year for LERF. APS has a detailed schedule for incorporating these changes in the PRA models, including activities to review results and perform sensitivity and uncertainty analyses. Upon implementation of the noted changes, APS will categorize each change as maintenance or upgrade and perform focused scope peer review(s) as described in Attachment 1.

APS plans to complete the following prior to implementation of the 50.69 program:

1. Incorporate the updated Fire Ignition Frequencies and non-suppression probabilities (NSP) provided in NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, January 2015. Incorporate a 0.001 floor value directly into the manual suppression NSP calculations.

2. Incorporate the updated Electrical Cabinet Heat Release Rates provided in NUREG-2178, Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE), May 2016. [APS does not plan to implement the Obstructed Plume methodology upgrade.]

Page 61 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

3. Update the transient and oil fire growth rates per FAQ 08-0052.

4. Update the KERITE cable type per FAQ 08-0053.

5. Update component binning per FAQ 12-0064. APS plans to retain the transient fire weighting factor methodology of NUREG/CR-6850 and does not plan to take credit for adjusting weighting factors to values between 0.0 and 1.0, as allowed by the methodology in NFPA-805 FAQ 12-0064.

PVNGS Fire PRA ignition source weighting factors are established based on the guidance provided in NUREG/CR-6850 section 6.5.7.2 (and Table 6-3) and the process is documented in fire PRA (FPRA) studies. Knowledgeable plant staff was surveyed; including a PRA engineer, fire protection engineer, fire marshal, operations representative, work management scheduler, mechanical maintenance representative, and an electrical journeyman. The results were qualitatively adjusted (calibrated) as necessary to maintain the Medium (3) factor as the normative value. The full range of influence factor rating values of No (0), Low (1), Medium (3), High (10), and Very High (50) were exercised.

Influence factor rating values of Extremely Low (0.1) and Very Low (0.3) were not used.

Two fire compartments are assigned Zero (0) for both maintenance and occupancy influence factors with a storage factor of One (1) assigned to ensure a frequency greater than zero is assigned to each Plant Analysis Unit: Filter and Ion Exchanger Pits (Fire Compartment, FC49A-G) and Volume Control Tank room (Fire Compartment, FC51A). These compartments are encased in concrete and inaccessible at power.

6. Incorporate the updated guidance on treatment of Sensitive Electronic damage thresholds per FAQ 13-0004.

7. Incorporate oil fire split fractions (counting) per NRC Position ML12171A583 Item 3 below.

8. Incorporate updated uncertainty analysis expectations per NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1.

RECENT FIRE PRA METHODS REVIEW PANEL - ML12171A583

1) Frequencies for Cable Fires Initiated by Welding and Cutting The Internal Fire PRA model, as documented in the LAR, adopted the revised hot work related cable fire ignition frequencies provided in NEI letter titled Recent Fire PRA Methods Review Panel Decision: Frequencies for Cable Fires Initiated by Welding and Cutting, submitted October 7, 2011, as endorsed in ML12171A583. The frequencies for cable fires initiated by welding and cutting utilized in the LAR model were implemented prior to the Full Scope Internal Fire PRA Peer Review, December 2012.

Prior to implementation of the 50.69 program, APS plans to incorporate the updated Fire Ignition Frequencies and Non-Suppression Probabilities provided in NUREG-2169 which will supersede the values endorsed by ML12171A583.

Page 62 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as qualified by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

2) Clarification for Transient Fires The Internal Fire PRA model, as documented in the LAR, adopted the screening transient Heat Release Rate (HRR) provided in NUREG/CR-6850, Appendix G, Table G-1, 98th percentile (317 kW) as clarified in NEI letter, Recent Fire PRA Methods Review Panel Decision: Clarification for Transient Fires and Alignment Factor for Pump Oil Fires submitted September 27, 2011 as endorsed in ML12171A583. The transient fire heat release rates utilized in the LAR model were implemented prior to the Full Scope Internal Fire PRA Peer Review, December 2012.

Further refinements may be applied to decrease the transient HRR to achieve realism in accordance with the methodology of NUREG/CR-6850 and within the clarifications endorsed by ML12171A583. Larger HRR transients are postulated in the Diesel Generator building [although the fire compartment is treated as hot gas layer (HGL) scenario], and in the Turbine building areas which are treated as effective HGL scenarios of very large areas considered to bound the upper limit of transient materials.

3) Alignment Factor for Pump Oil Fires The Internal Fire PRA model as documented in the LAR, adopted the oil fire ignition frequency alignment factors (count split fractions) provided in FAQ 08-0044 and NUREG/CR-6850 Appendix E.3. The alignment factor for pump oil fires utilized in the LAR model was implemented prior to the full scope internal fire PRA peer review conducted in December 2012.

Prior to implementation of the 50.69 program, APS plans to incorporate the updated refined treatment of oil pump endorsed by ML12171A583.

The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as endorsed by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

4) Electrical Cabinet Fire Treatment Refinement Details The electrical cabinet fire treatment refinement submitted by NEI on June 5, 2012, in letter, Recent Fire PRA Methods Review Panel Decision: Treatment of Electrical Cabinets was not endorsed by the NRC. This methodology was never adopted in the PVNGS PRA model.

Page 63 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

5) EPRI 1022993 - Evaluation of Peak Heat Release Rates (HRRs) in Electrical Cabinet Fires The preliminary approach to evaluating peak HRRs in electrical cabinets published in EPRI 1022993 was not endorsed by the NRC. This methodology was never adopted in the PVNGS PRA model.

NUREG/CR-7150 Vol 2 - Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE)

The Internal Fire PRA model as documented in the LAR, adopted the guidance and methodology of NUREG/CR-7150. The guidance and methodology of NUREG/CR-7150 were incorporated into the Fire PRA model prior to the Focused Scope Fire Peer Review, conducted December 2014. Implementation of NUREG/CR-7150 was within the scope of the focused scope peer review.

NUREG-2169 - Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database Prior to implementation of the 50.69 program, APS plans to incorporate the updated Fire Ignition Frequencies and Non-Suppression Probabilities provided in NUREG-2169. The change to the fire PRA to address the updated data is considered PRA maintenance as defined in ASME/ANS RA-Sa-2009, Section 1-A.3.3, as endorsed by RG 1.200, Revision 2. Upon completion of the final model, the change would be reviewed for significance to the application.

The Attachment 7, Table 7-1 provides the internal fire focused scope peer review finding and its disposition relevant to implementation of the above NRC-accepted fire PRA methods.

Page 64 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 22 APLA - Integrated PRA Hazards Model NEI 00-04, Section 5.6, Integral Assessment, discusses the need for an integrated computation using the available importance measures. It further states, in part, that the integrated importance measure essentially weights the importance from each risk contributor (e.g., internal events, fire, and seismic PRAs) by the fraction of the total core damage frequency [or large early release frequency] contributed by that contributor. The guidance provides formulas to compute the integrated Fussell-Vesely (FV), and integrated Risk Achievement Worth (RAW).

To address the integration of importance measures, some licensees have updated their PRA model to a one-top model that integrates the PRA model(s) across all hazards (i.e., internal events, internal flooding, fire, seismic, high winds, external flooding).

To confirm that the importance measures generated for use in the 10 CFR 50.69 process is consistent with the NEI guidance and does not inadvertently introduce a deviation from the computations for FV and RAW provided in the NEI 00-04 guidance, as endorsed by RG 1.201, Revision 1:

a. Explain whether the PRA model that will be used in the 10 CFR 50.69 categorization process is an integrated one-top model across multiple PRA hazards and if the integrated one-top model includes accident sequence(s) modeling to support quantification of both CDF and LERF.

If using an integrated one-top model across multiple PRA hazards, provide the following:

i. Discuss the process used to validate and confirm the integration of the PRA hazards into a one-top model to ensure that after the PRA model change was performed, SRs QU-F2 and SR FQ-F1 continue to be met (e.g., cutset reviews, identification of non-minimal cutsets, peer review).

ii. Discuss how the individual importance measures (i.e., FV and RAW) for the PRA one-top all hazards model are derived from the one-top model, and justify why the importance measures generated do not deviate from the NEI guidance. If the practice or method used to generate the integrated importance measures is determined to deviate from the NEI guidance, justify why the integrated importance measures computed are appropriate for use in the categorization process.

Page 65 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 APS Response to RAI 22

a. The PRA model that will be used for the 10 CFR 50.69 categorization process will be an integrated one-top model that includes internal events, internal flooding, internal fire, and seismic PRA hazards. This model will support quantification of both CDF and LERF.

i. The individual hazard models are individually verified to meet their respective portions of ASME/ANS RA-Sa-2009 per the normal process of technical verification and peer review. These individual hazard models will be considered the Palo Verde models of record, from which application-specific models will be developed. The one-top model to be used for 50.69 categorization will be such an application-specific model. The integrity of the one-top model will be verified by comparing its results (i.e. cutsets) against those generated by the RG 1.200, Revision 2, compliant peer-reviewed individual hazard models of record. Demonstration that the one-top model produces the same results as the separately peer-reviewed individual hazard models will be documented, along with analysis of any results that diverge from the individual hazard PRA model results. The one-top model itself will not undergo peer review, as it is an application-specific model derived from the individual hazard PRA models of record.

ii. Importance measures such as Fussell-Vesely (F-V) and RAW will be generated per the guidance and methodologies defined in NEI 00-04. Palo Verde does not plan to deviate from the NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, Revision 0, guidance and will thus consider both the individual hazard importance measures (i.e. F-V, RAW, etc. generated by each individual hazard model) as well as the integrated importance measures generated using the one-top PRA model. The integrated importance measures that are derived from the one-top model will be generated using industry standard methodologies, such as the EPRI SYSIMP tool.

Page 66 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 RAI 23 APLA - 10 CFR 50.69(e), Feedback and Adjustment Process Section 50.69 of 10 CFR delineates that a licensee voluntarily choosing to implement this section shall submit an application for license amendment under Section 50.69 that contains the following information. Paragraph 50.69(e)(1) of 10 CFR, Feedback and process adjustment-RISC-1, RISC-2, RISC-3 and RISC-4 SSCs, states, in part, [t]he licensee shall review changes to the plant, operational practices, applicable plant and industry operational experience, and, as appropriate, update the PRA and SSC categorization and treatment processes.

NEI 00-04, Section 11.2, Following Initial Implementation, discusses that

[t]he periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes. Specifically, NEI 00-04, Section 12.1 discusses cases for which, in some instances, an updated PRA model could result in new RAW and FV importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization.

Explain how this periodic review will be administered. At minimum, discuss the following:

a. Participants involved in the review;

b. Sources of material identified to be reviewed;

c. Periodicy for when the review will be performed;

d. Documentation of the review performed (e.g., corrective action program, engineering evaluation, etc.); and

e. Criteria used to determine if the change being reviewed has any impact to a modeled PRA hazard(s) and/or any SSC categorized by the 10 CFR 50.69 process.

APS Response to RAI 23 a) The review will be completed by a system engineer and a PRA engineer.

b) To assess the impact of plant changes on RISC-1, RISC-2, RISC-3, and RISC-4 SSCs, the following items are reviewed to ensure the continued validity of categorization results for SSCs that have been categorized:

• Plant modifications since the last review that could impact the SSC categorization (system engineer and PRA engineer)

• Plant specific operating experience that could impact the SSC categorization (system engineer)

Page 67 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69

• The impact of the updated risk information (that is, PRA model or other analysis used in the categorization) on the categorization process results (PRA engineer)

• Importance measures used for screening in the categorization process. If a review of the importance measures indicates that the SSC should be reclassified, then both the relative and absolute values of the risk metrics will be considered by the IDP.

(PRA engineer)

• An update of the risk sensitivity studies performed for the categorization (PRA engineer)

• Applicable plant and industry operational experience for impact on existing categorizations. (system engineer)

• Input from Regulatory Affairs and Operations regarding changes that may affect the bases for the categorization results. (system engineer) c) The periodic review is completed at least once every other Unit 1 refueling outage. The Periodic Review Process will be completed in accordance with 01DP-0RS12, Requirements for Immediate Reviews, Periodic Reviews, and Performance Monitoring.

d) The system engineer compiles a periodic review report containing the following:

• Summary of plant changes and impact on the categorization results

• Summary of condition reports

• Summary of performance monitoring results of RISC-3 SSCs

• Results of review of SSC failures by component group

• Results of functional failure trends reviews

• Summary of maintenance rule issues, if applicable

• Summary of performance indicators, if available

• Summary of issues affecting the system

• Regulatory Affairs review

• Operations review The Integrated Decision Making Panel (IDP) will review the report and make the final decision regarding recategorizations.

Page 68 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 e) The periodicity of the periodic review coincides with the frequency of PRA model updates. The PRA model update results will be reviewed for components that have been categorized by the 50.69 process.

Attachment 8, Table 8-1 lists the criteria from NEI 00-04 that will be used to determine PRA-based high safety significant (HSS) vs low safety significant (LSS) ranking for components.

Page 69 of 70

Enclosure APS Response to RAIs for License Amendment Request to Adopt 10 CFR 50.69 References

1. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009

2. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

4. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

5. NUREG/CR-INEEL/EXT 04-02326, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003, October 2004

6. WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008

7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007

8. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA)

Frequencies through the Elicitation Process, Draft

9. WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, Revision 0, March 2007

10. 79IS-9ZZ07, PVNGS Extended Loss of All Site AC Guideline, Modes 1-4, Rev. 7

11. NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, August 1983

12. NUREG/CR-6850 (EPRI TR-1011989), EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Electric Power Research Institute, Palo Alto, CA, and U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, Rockville, MD, September 2005

13. EPRI Report 3002008101, Loss of Offsite Power at U.S. Nuclear Power Plants Through 2015, July 2016

14. Nuclear Energy Institute (NEI) 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012 Page 70 of 70

Attachment 1 Palo Verde 10 CFR 50.69 PRA Implementation Items

Enclosure Attachment 1 Attachment 1 Palo Verde 10 CFR 50.69 PRA Implementation Items Table 1-1 below identifies the items that are required to be completed prior to implementation of the 10 CFR 50.69 categorization process at Palo Verde Nuclear Generating Station, Units 1, 2 and 3. Issues identified below will be addressed and any associated changes made, focused scope peer reviews performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and findings resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Table 1-1 Palo Verde 10 CFR 50.69 PRA Implementation Items Description Resolution

1. The June 2017 F&O Closure Review of peer Conduct an augmented F&O closure review of the review findings did not include: June 2017 F&O Closure Review findings to include:

a. Documentation of the basis for the a. Documentation of the basis for the maintenance vs update determination maintenance vs update determination for for each reviewed F&O finding each reviewed F&O finding

b. A review of F&O findings from prior b. A review of F&O findings from prior peer peer reviews associated with supporting reviews associated with supporting requirements determined to meet requirements determined to meet Capability Capability Category II of the ASME/ANS Category II of the ASME/ANS RA-Sa-2009 as RA-Sa-2009 as endorsed by RG 1.200, endorsed by RG 1.200, Revision 2 Revision 2 c. Documentation of the review of supporting

c. Documentation of the review of requirements determined to not meet supporting requirements determined to Capability Category II from the self-not met Capability Category II from the assessment of the internal events PRA model self-assessment of the internal events against all supporting requirements in PRA model against all supporting ASME/ANS RA-Sa-2009 as endorsed by RG requirements in ASME/ANS RA-Sa-2009 1.200, Revision 2 as endorsed by RG 1.200, Revision 2 These actions are indicated in the response to RAIs This condition is described in response to RAIs 01.a, 05.b, 05.d, 09.d, and 17 in APS letter dated 01.a, 05.b, 05.d, 09.d, and 17 in APS letter May 9, 2018.

dated May 9, 2018.

2. Four PRA model upgrades were identified from Conduct a focused scope peer review for the a review of all PRA model changes not reviewed following PRA model upgrades:

by peer reviews: a. The common cause methodology change

a. The common cause methodology was from the multiple greek letter (MGL) method changed from the multiple greek letter to the alpha factor method (MGL) method to the alpha factor b. The human reliability analysis (HRA) method methodology change from the systematic

b. The human reliability analysis (HRA) human action reliability procedure (SHARP) methodology was changed from the model to the EPRI HRA Calculator software systematic human action reliability c. PRA Impact 2003-301 that incorporated new procedure (SHARP) model to the EPRI modeling for pressure-induced steam HRA Calculator software generator tube rupture (SGTR) using CE

c. PRA Impact 2003-301 incorporated new NPSD-1124 Methodology for Modeling Main modeling for pressure-induced steam Steam Line Breaks, Revision 0 generator tube rupture (SGTR) using CE d. PRA Impact 2013-151 that significantly NPSD-1124 Methodology for Modeling impacted the results from the internal flood Main Steam Line Breaks, Revision 0 PRA model

d. PRA Impact 2013-151 updated the internal flood PRA model resulting in a These actions are indicated in response to RAIs significant impact on the results 03.c, 06, 09.c, 09.d, in APS letter dated May 9, 2018.

This condition is described in response to RAIs 03.c, 06, 09.c, 09.d, in APS letter dated May 9, 2018.

Page 1 of 3

Enclosure Attachment 1 Table 1-1 Palo Verde 10 CFR 50.69 PRA Implementation Items Description Resolution

3. The PRA models are being revised to incorporate Revise the PRA models to incorporate resolutions to all resolutions to all open F&O findings and fire PRA open F&O findings and fire PRA guidance more guidance more recently endorsed by the NRC as recently endorsed by the NRC as indicated in the indicated in response to RAI 21 in APS letter license amendment request to adopt 10 CFR 50.69, dated May 9, 2018. The PRA model total CDF and Risk-Informed Categorization and Treatment of total LERF after these changes are incorporated Structures, Systems, and Components for Nuclear must meet RG 1.174 risk limits of 1E-4/year for Power Reactors dated July 19, 2017.

CDF and 1E-5/year for LERF as indicated in License Amendment Request to adopt 10 CFR This action is indicated in the response to RAIs 50.69, Risk-Informed Categorization and 02.d, 07, 08, and 21 in APS letter dated May 9, Treatment of Structures, Systems, and 2018.

Components for Nuclear Power Reactors dated July 19, 2017. Ensure after these changes are incorporated as indicated in the response to RAI 21 that the PRA This condition is described in the response to model total CDF and total LERF are below the RAIs 02.d, 07, 08, and 21 in APS letter dated limits established in Regulatory Guide (RG)

May 9, 2018. 1.174, which are 1E-4/year for CDF and 1E-5/year for LERF.

Page 2 of 3

Enclosure Attachment 1 Attachment 1 Additional Conditions Operating License No. NPF-41, NPF-51, and NPF-74 APS proposes the following license conditions, Table 1-2, be added to Appendix D of the PVNGS Units 1, 2, & 3 Renewed Operating Licenses:

Table 1-2 Additional Conditions Amendment Additional Conditions Implementation Number Date APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) specified in license amendment [NUMBER] dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g.,

change from a seismic margins approach to a seismic probabilistic risk assessment approach).

[NUMBER] APS will complete the implementation items listed in the Prior to implementation of Enclosure of APS letter 102-07546, dated July 19, 2017, to 10 CFR 50.69.

the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Page 3 of 3

Attachment 2 Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models

Enclosure Attachment 2 ATTACHMENT 2 Significant Changes to the Palo Verde Internal Events, Internal Flooding, Seismic and Fire PRA Models

RAI 09

As discussed in APS Response to RAI 09, all changes to the PRA have been reviewed against the information provided in ASME/ANS RA-Sa-2009 PRA Standard and RG 1.200, Revision 2, to classify each as either an upgrade or maintenance.

The process used for the classification of the changes and the results of the review are documented in Engineering Evaluation EWR 18-00619-003. This Attachment provides the list of significant changes included in the EWR along with a brief summary of the process used for the classification.

Justification/Basis for an Upgrade classification includes any one of the following:

• Methodology Change

• Scope Change

• Capability Change In order to provide the basis or justification for those items determined to be Maintenance, the changes were reviewed against Section 1.A-2 and the examples provided in Section 1-A.3 of the ASME/ANS RA-Sa-2009 PRA Standard Nonmandatory Appendix 1-A. These were used to identify that which most closely corresponds to the change being made to the PVNGS PRA model. Consistent with the ASME Standard, Maintenance changes have been determined to have no significant change to risk insights and no impact on significant accident sequences.

Table 2-1 provides the significant changes to the Internal Events PRA Model and Table 2-2 provides the significant changes to the Internal Flooding, Fire and Seismic PRA Models, along with their classification and associated justification/basis.

Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 2/19/2002 1998-35 Address miscalibration of critical sensors. Upgrade Methodology Change -

F&O HR-03 New THERP approach to common cause New THERP HRA method failure of miscalibration of sensors. used 2/4/2003 1998-37 Update ECCS success criteria to be Maintenance Implemented change to the consistent with CE NPSD-1072-P and new PRA model due to new MAAP case entries and update common industry and plant cause modeling conditional upon Line knowledge using processes Break previously applied 2/19/2002 1999-177 Correct modeling of SG downcomer and Maintenance Implemented model bypass flow feed control logic, missing corrections were neither so CCF events for block and bypass valves, numerous nor so large that HRA missing procedure steps, and the significant changes to risk existing common cause event for the insights or accident control valve(s). The correction results in sequences result a less than 1% change in CDF.

Page 1 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 7/13/2001 1999-6 Model DMWOs 746729 and 805235 Maintenance Incorporated model changes installation of digital feedwater control to reflect plant design systems. FWCS will have dual power changes consistent with supplies, NNND11 and NNND12, rather ASME PRA Standard Section than FWCS1 from NNND11 and FWCS2 1-A.2 from NNND12.

2/19/2002 2001-167 Update model to reflect DWG 13-10407 Maintenance Incorporated model changes J104-76-9 which indicates a modification to reflect plant design that changed the power supply to one of changes consistent with the two fans in each BOP-ESFAS cabinet ASME PRA Standard Section and revise loss of cabinet cooling 1-A.2 operator response 2/19/2002 2001-2 Incorporate changes to LERF Model in Maintenance Implemented model order to account for Boundary Conditions corrections were neither so defined in the Level 1 Trees. numerous nor so large that significant changes to risk insights or accident sequences result 2/19/2002 2001-210 Add the alternate off-site power supply to Maintenance Implemented change to the each ESF bus, as well as the GTGs, in the PRA model due to new IE trees for losses of power which splits industry and plant the ESF bus and OSP loss initiators from knowledge using processes the PN IEs. previously applied 2/19/2002 2001-212 Replace Basic Events SYFAULTSXM3-- Maintenance Implemented change to the 2PW and SYFAULTSXM2--2PW with PRA model using processes developed fault trees for switchyard previously applied components to support Maintenance Rule risk evaluations for the switchyard. Also address scheduled maintenance time.

2/4/2003 2002-182 Correct modeling for testing ESF trip Maintenance Implemented model initiation logic to reflect relay test corrections were neither so configuration of trip vs. bypass and numerous nor so large that reflect potential increase in spurious trip, significant changes to risk revise assumption for modeling UV relay insights or accident testing (32ST-9ZZ03), and add sequences result assumption describing modeling for testing that bypasses ESFAS channels.

2/4/2003 2002-218 Change status logic for PKA and PKB Maintenance Implemented model batteries. Correct CM logic for IA corrections were neither so compressors. Add a term to the delete- numerous nor so large that term fault tree to remove LOOP--2PW significant changes to risk with IEDCHVAC; alter logic for setting insights or accident running chillers and air compressors. sequences result 12/30/2010 2002-3 Modify LERF trees to address more recent Maintenance Data update using new PVNGS, industry and regulatory technical industry and plant-specific positions regarding AFW level control, data and Bayesian update AFW PRA success, and probability of process previously Pressure and Thermally induced SG tube employed ruptures.

6/2/2004 2003-1 Change the exchanges in RS with Maintenance Implemented model negated logic to avoid mapping corrections were neither so difficulties in EOOS. Also, delete numerous nor so large that exchange for HJBZ04 OOS in gate significant changes to risk GECB12. insights or accident sequences result 6/2/2004 2003-176 Change SG blowdown pathway from the Maintenance Implemented model Blowdown Flash Tank to the condenser. corrections were neither so Maintenance events may no longer be numerous nor so large that valid for different pathway. significant changes to risk Page 2 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade insights or accident sequences result 6/2/2004 2003-301 Incorporate Pressure-Induced SGTR Upgrade Methodology Change -

modeling into SLB event tree. New methodology used for PI-SGTR modeling 1/11/2006 2004-132 Revise model to properly reflect S/U Maintenance Implemented model Transformer SWYD breakers OOS corrections were neither so condition. Currently power to NAN-S05/6 numerous nor so large that is failed even when loads are transferred significant changes to risk to the Alternate S/U Transformer insights or accident sequences result 1/11/2006 2005-122 Incorporate PPS Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-123 Incorporate EC and WC Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-124 Incorporate GT Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-125 Incorporate PN Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-126 SI Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-127 CD (Altfw) Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-163 SG Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-164 CL (Containment Isolation) Common Upgrade Methodology Change -

Cause Modeling Changes from MGL to Common Cause Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-165 EW Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-166 HJ Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor Page 3 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 1/11/2006 2005-167 IA-GA Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-170 PK System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-171 DG, PB, PE and Off-Site Power Systems Upgrade Methodology Change -

Common Cause Modeling Changes from Common Cause MGL to Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-172 RC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-173 SP System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-174 NC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-2 Modify Small LOCA event tree to reflect Maintenance Implemented change to the testing and analysis done in support of PRA model due to new the sump air entrainment issue under industry and plant CRDR 2726509. knowledge using processes previously applied 1/11/2006 2005-207 Incorporate Alpha Factor Parameters for Upgrade Methodology Change -

Common Cause Modeling Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-97 AF Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 9/28/2007 2006-124 Calculation of control circuit risk based on Maintenance Implemented model individual components may overestimate corrections were neither so its risk contribution. This impact numerous nor so large that consolidates the control circuit failure significant changes to risk contribution back into the start failure insights or accident rate for motor operated pumps and DGs. sequences result 9/28/2007 2006-226 Update MSIV modeling due to DMWO Maintenance Incorporated model changes 2417258, which added redundant closing to reflect plant design solenoid on each train of hydraulics. changes consistent with ASME PRA Standard Section 1-A.2 Page 4 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 9/28/2007 2006-294 Correct mission times for DC power Maintenance Implemented model systems to better reflect support needed corrections were neither so for bringing in off-site or GTG power. numerous nor so large that Also, limit battery FTR applicability to significant changes to risk SBO conditions. insights or accident sequences result 9/28/2007 2007-140 Assumption to not credit MFW for greater Maintenance Implemented model than 30 minutes has resulted in corrections were neither so significant dominant cutsets in latest numerous nor so large that revision (C29 r15 working copy dated significant changes to risk 7/12/07) to be inappropriate. insights or accident sequences result 12/18/2008 2007-207 The Fault Tree that contained 1RCS- Maintenance Implemented model DEPRESS-2HR was deleted by impact corrections were neither so 2007-38. The HRA was inadvertently not numerous nor so large that restored. However, the HRA is called on significant changes to risk by a function event. This Impact restores insights or accident the HRA. sequences result 12/17/2008 2007-209 EDG failures need to be parsed into three Maintenance Implemented change to the categories to conform to NRC data and PRA model due to new MSPI program. industry and plant knowledge using processes previously applied 1/7/2010 2007-67 There is an inconsistency between how Maintenance Implemented model the primary safety fail open event and an corrections were neither so SLOCA are modeled for CS. The primary numerous nor so large that safety failure does not credit CS, but the significant changes to risk SLOCA does and the largest SLOCA is the insights or accident same as the primary safety fail open sequences result event hole size.

1/7/2010 2009-153 Add modeling for fuel oil transfer pumps, Maintenance Implemented change to the DFA(B)P01. MSPI is expected to have PRA model due to new these as separate components. industry and plant knowledge using processes previously applied 2/3/2010 2009-247 Add modeling for the UV relays that Maintenance Implemented change to the cause turbine trip after reactor trip. This PRA model due to new would allow use of the favorable MTC industry and plant fraction on the success branch and knowledge using processes eliminate need of the unfavorable previously applied fraction.

12/30/2010 2010-219 Use of HRA Calculator vs. manual SHARP Upgrade Methodology Change -

HRA worksheets and Dependency SHARP HRA conversion to Analysis changes. HRA Calculator 12/7/2014 2015-836 This impact documents, by reference, the Maintenance PRA Software code change changes to the internal events model from one fault tree linking from Risk Spectrum Rev 20 to CAFTA code to another with new model. code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes Page 5 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 11/16/2013 2013-151 Update internal flood PRA model to address Upgrade Capability Change -

results from associated CRAIs from CRDR Impact to Significant 3590575. Sequences (2 Orders of Magnitude difference) 11/16/2013 2015-868 Incorporate Internal Flood Model Impact Maintenance PRA Software code 2013-151 into CAFTA. change from one fault tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 11/11/2014 2018-2448 Tripping RCP Breaker Locally Maintenance Implemented model DRC R55 40OP-9ZZ19 allows for local RCP breaker trip corrections were neither with AO pre-stationed during fires in specific so numerous nor so fire zones. FPRA allows 45-60 minutes to large that significant stop RCPs which is sufficient time for AO to changes to risk insights respond locally for any fire without pre- or accident sequences staging prior to need. result 3/6/2014 CS-A6-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new cable and results provided in Report 0001-0013- selection methodology 001-002 Revision 0 (Hughes Associates) for regarding fire-induced active tripping of an overcurrent fault to the loss of active tripping Fire PRA model. capability electrical protection.

12/6/2014 PRM-B2-n/a Palo Verde Fire PRA is developed in the Maintenance PRA Software code CAFTA suite of software, which is a different change from one fault fault tree tool than Risk Spectrum. tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 9/27/2014 CS-B1-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new breaker and results provided in Report 0001-0013- coordination 001-003 Revision 1 (Hughes Associates) with methodology that also respect to breaker coordination impacted significant sequences.

Page 6 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 12/7/2014 QLS-A1-01, Based on the resolution of F&Os QLS-A2-01 Upgrade Methodology Change -

QLS-A2-02, and QLS-A2-02, using the revised qualitative New Qualitative QLS-A2-01 screening criteria Based on the resolution of Screening Methodology F&Os QLS-A2-01 and QLS-A2-02, using the employed revised qualitative screening criteria documented in the Screening and Quantification study section 4.2.1, the study was revised and documents the basis for screening any fire compartments 10/16/2014 FSS-D1-01 Incorporate Report 0001-0014-002-001 Upgrade Methodology Change -

Revision 0 for HGL New Hot Gas Layer methodology applied 10/11/2014 2018-2448 Revised sources to include transitioned Upgrade Methodology Change -

DRC T107 segmented bus duct method New Bus Duct Methodology utilized 12/6/2014 PRM-A3-01 A comprehensive re-evaluation of the Loss of Upgrade Methodology Change -

RCP Seal Cooling accident progression and New Loss of RCP Seal success criteria was conducted to bound the Cooling Modeling scope of failure scenarios Methodology.

8/27/2013 SHA-E1-01 New site specific data was subsequently Upgrade Methodology change -

collected as part of the Near Term Task Implements a different Force (NTTF) 2.1 analysis. Lettis Consultants methodology for seismic International, Inc. Project Report 221-PR-04 hazard evaluation than Revision 4 documents the updated seismic previously applied.

hazard evaluation for Palo Verde.

Page 7 of 11

Enclosure Attachment 2 , Table 2-3 below provides those Internal Events PRA changes that were determined to be PRA Upgrades.

Table 2-3 Identified PVNGS Internal Events PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 1998-35, 2/19/02 New HRAs in the area of Methodology New THERP HRA Events F&O HR-03 miscalibration of critical sensors. Change approach to common cause failure of miscalibration of sensors 2003-301 6/2/04 Incorporate Pressure-Induced Methodology New PI-SGTR SGTR modeling into SLB event Change Methodology tree.

2005-122 thru - 1/11/06 System Common Cause Methodology Common Cause 127, 2005-163 Modeling Changes: Change Methodology thru 2005-167, PPS, EC/WC, GT, PN, SI, CD changed from MGL 2005-170 thru - (Altfw), SG, EW, IA-GA, PK, DG, to Alpha Factor.

174, 2005-207, PB, PE and Off-Site Power, RC, 2005-97 SP, NC, DC, AF 2010-219 12/30/10 Use of HRA Calculator vs. Methodology SHARP HRA manual HRA worksheets and Change conversion to HRA Dependency Analysis Calculator Methodology changes.

Page 8 of 11

Enclosure Attachment 2 , Table 2-4 below provides the Internal Events PRA upgrades identified in RAI 09, Part (b).

Table 2-4 Peer Reviews of Internal Events PRA Upgrades Upgrade Review Change Hazard Description Upgrade Review Results / New Date Findings Internal 2/19/02 New THERP approach to Finding Level Fact and F&O Closed.

Events common cause failure Observation Closure Review Associated HR TEs of miscalibration of conducted April 19, 2017 (HR-4, HR-5, HR-6, sensors through June 23, 2017. and HR-7) met Report Date: June 23, 2017 6/2/04 New PI-SGTR Focused Scope Peer Review TBD Methodology as described in Attachment 1.

1/11/06 Common Cause TBD Methodology changed from MGL to Alpha Factor.

12/30/10 SHARP HRA conversion TBD to HRA Calculator Page 9 of 11

Enclosure Attachment 2 Attachment 2, Table 2-5 below provides those changes that were determined to be PRA Upgrades.

Table 2-5 Identified Internal Flood, Internal Fire and Seismic PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 2013-151 11/16/13 Update internal flood PRA Capability Impact to Significant Flooding model to: Change Sequences (2 Orders of Magnitude

1) Updated pipe rupture difference in results) frequency values

2) Incorporate realistic flow rates used for time dependent flood levels

3) Incorporate flood isolation actions

4) Incorporate plant modification that increased pipe length Internal CS-A6-01 (F) 3/6/2014 Cable Selection and Circuit Methodology New cable selection Fires Analysis study was revised Change methodology to incorporate the regarding fire-methodology and results induced loss of provided in Report 0001- active tripping 0013-001-002 Revision 0 capability for electrical protection.

CS-B1-01 (F) 9/27/2014 Cable Selection and Circuit Methodology New breaker Analysis study was revised Change coordination to incorporate the methodology methodology and results provided in Report 0001-0013-001-003 Revision 1 QLS-A1-01 (F) 12/7/2014 Revised qualitative Methodology New Qualitative QLS-A2-01 (F) screening criteria Change Screening Criteria QLS-A2-02 (F) documented in the Screening and Quantification study section 4.2.1 PRM-A3-01 (F) 12/6/2014 A comprehensive re- Methodology New Loss of RCP evaluation of the Loss of Change Seal Cooling RCP Seal Cooling accident modeling progression and success methodology criteria was conducted to bound the scope of failure scenarios FSS-D1-01 (F) 10/16/2014 Incorporate Report 0001- Methodology Methodology Change 0014-002-001 Revision 0 Change for HGL treatment for HGL 2018-2448 10/11/2014 Revised sources to include Methodology New segmented bus DRC T107 transitioned segmented bus Change duct methodology duct method Seismic SHA-E1-01 (F) 8/27/2013 New site specific data was Methodology Different subsequently collected as Change methodology for part of the Near Term Task seismic hazard Force (NTTF) 2.1 analysis. evaluation Page 10 of 11

Enclosure Attachment 2 , Table 2-6 provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g.,

additional findings, closure, etc.).

Table 2-6 Peer Reviews of Internal Flooding, Internal Fires and Seismic PRA Upgrades Upgrade Review Change Hazard Description Upgrade Review Results / New Date Findings Internal 11/16/13 Impact to Significant Focused- Scope Peer Review, TBD Flooding Sequences (2 Orders of as described in Attachment 1.

Magnitude difference)

Internal 3/6/2014 New cable selection Focused scope Fire PRA Peer SR CS-A6 met Fires methodology regarding Review conducted December *SR CS-C4 to be fire-induced loss of 8-12, 2014. Report Date: reviewed by augmented active tripping January 22, 2015 F&O closure review capability for electrical protection.

• Augmented F&O closure 9/27/2014 New breaker review, as described in SR CS-B1 met CC II/III coordination Attachment 1.

methodology 12/7/2014 New Qualitative SR QLS-A1 met Screening Criteria New F&O QLS-A1-01[14FS]

SR QLS-A2 met 12/6/2014 New Loss of RCP Seal SR PRM-A3 met Cooling modeling New F&O PRM-A3-01 methodology [14FS]

• SR ES-B3 to be reviewed by augmented F&O closure review 10/16/2014 Methodology Change SR FSS-D1, FSS-D4, for HGL treatment FSS-D11, and FSS-E1 all met New F&O FSS-D2-01[14FS]

10/11/2014 New segmented bus SR IGN-A7 met duct methodology Seismic 8/27/2013 Different methodology Finding Level Fact and F&O Closed.

for seismic hazard Observation Closure Review SR SHA-E1 meets CC-evaluation conducted April 19, 2017 II/III through June 23, 2017.

Report Date: June 23, 2017 Page 11 of 11

Attachment 3 Disposition of Key Assumptions/Sources of Uncertainty

Enclosure Attachment 3 Attachment 3 Disposition of Key Assumptions/Sources of Uncertainty

RAI 10

Attachment 3, Table 3-1 below describes the disposition of key assumptions and sources of uncertainty identified in the seismic PRA.

Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Human Failure Events Accessibility for completion of non- A sensitivity analysis was performed evaluating the (HFEs) during a seismic screened human failure events impact of not crediting the subject HFEs and there was event (HFE) during a seismic event is minimal impact on the CDF and LERF. Therefore, no assumed possible for all non- additional sensitivity analysis is required for 10 CFR screened HFEs besides those which 50.69.

are assumed to fail in the case where the corridor building or turbine building collapses. Both the collapse of the corridor building and turbine building and their impact on the access to the Main Steam Support Structure is considered in the Seismic PRA model. There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed.

Seismic performance Seismic-only PSFs applied to the This is considered a conservative assumption.

shaping factors (PSFs) with internal events HEPs will over-ride Therefore, no sensitivity analysis is required for 10 CFR respect to seismic-induced the flooding PSFs based on the 50.69.

flooding. consideration that the seismic events are more global events than the specific flooding events.

No additional modifications are made to the internal events HEP to consider the possibility of seismic-induced flooding events.

The Seismic PRA HFE The Seismic PRA dependency The modification of the timing available due to seismic dependency analysis analysis assumes that once an considerations may result in a longer response or accident sequence is initiated, the identification time and consequently a higher HEP.

operator action timing for a seismically induced event is similar A sensitivity analysis was performed in the seismic PRA to that of an internally induced quantification increasing all the Seismic PRA human event for main control room failure events (HFEs) derived from the internal events actions. PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

The change in CDF and LERF was 9.7% and 5.3%,

respectively. Therefore, the current Seismic PRA model used for the 50.69 Program will increase all Seismic HFEs by a factor of 3 to address uncertainty.

Page 1 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Seismic PRA Weighting There is no standardized method PVNGS uses all three accepted approaches for factors applied to three to calculate human error developing the PVNGS Unit 1 seismic PRA with more approaches probabilities (HEP) in a seismic emphasis given to the Surry method with a weighting PRA. Therefore, a mean HEP for factor of 0.7 while the other two methods are given a each basic event was calculated by lower and equal weight (i.e., 0.15). Since the Surry combining three accepted approach was a selective combination of previous approaches (Surry, Kernkraftwerk approaches and the most recently performed and Muhleberg (KKM), and Swiss published method, the greatest weight was applied to Federal Nuclear Safety the seismic HEPs developed according to it. However, Inspectorate (ENSI)) using the the Surry method has the potential to be the least following weighting factors: 0.7, conservative approach among the three methods, the 0.15, and 0.15, respectively. assumption associated with the weighting factor is an assumption that carries epistemic uncertainties. A sensitivity analysis was performed that ran the Seismic PRA model using only the KKM and ENSI approaches, equally weighted. The change in CDF and LERF was -

1.63% and 0.42%. Therefore, no additional sensitivity analysis is required for 10 CFR 50.69.

Relay chatter correlation Relay chatter between relays of This is a conservative assumption because the demand the same manufacturer, model experienced by a relay is dictated by in-cabinet number, and plant location, i.e., response and not the in-structure response spectra building and elevation were (ISRS) which the binning is based. Therefore, no assumed to be fully correlated. sensitivity analysis is required for 10 CFR 50.69.

Also, each relay identified as a control switch, push button, or motor starter are fully correlated with other generic, like components.

Simplified Relay Fragility Low risk importance relays (based This assumption is reasonable given that none of the c Parameters on Risk Achievement Worth) were values for the relays evaluated using the detailed treated with a simplified fragility fragility analysis were determined to have a c below analysis and higher importance 0.33 and most had c of around 0.5. Therefore, no relays (10 different types) were sensitivity analysis is required for 10 CFR 50.69.

treated with a detailed fragility analysis. The simplified relay chatter fragility analysis assumed a c of 0.35 based on engineering judgment.

Seismic failure of relays and For the relays modeled in the PRA analyst experience is credited in the selection of basic event mapping Seismic PRA, the basic event the appropriate internal events PRA model component associated with the seismic failure failure modes to reflect postulated seismic PRA model of the relay must be mapped to an component failure modes. This selection was performed existing internal events target by Westinghouse PRA seismic experts and reviewed by basic event. A key source of APS PRA engineers. Therefore, no sensitivity analysis is modeling uncertainty is associated required for 10 CFR 50.69.

with the mapping of seismic basic events. Failure modes postulated for the PVNGS internal events model may not fully align with their assigned seismic counterparts.

Seismic PRA uses internal The PVNGS Seismic PRA assumes The internal events PRA that was used to develop the events PRA as a starting that the internal events PRA that is Seismic PRA was evaluated separately for its PRA point used as a starting point meets the quality and was determined to meet Capability requirements of Capability Category II of the PRA standard. Therefore, no Category II of the PRA standard. sensitivity analysis is required for 10 CFR 50.69.

Page 2 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Success criteria for Seismic If not otherwise specified, the The base case Seismic PRA uses a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time PRA success criteria associated with the for the run time of mitigating equipment. A sensitivity internal events PRA logic are case was developed to assess the impact of using a 72 considered valid and applicable to hour mission time for equipment run failures. The accident sequences initiated by a change in overall CDF and LERF for this case is 2.73%

seismic event. However, a and 0.69%, respectively. Therefore, no additional standard 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time sensitivity analysis is required for 10 CFR 50.69.

may not be suitable for a seismic-induced accident scenario because of the longer time needed for offsite power recovery.

Seismic failure correlation Seismic failures are assumed to be The validity of this assumption of complete correlation completely correlated. This is still being discussed at the industry level. This is assumption implies that a single considered a conservative assumption. Therefore, no basic event is used to model the sensitivity analysis is required for 10 CFR 50.69.

seismic failure of components that are identified as pertaining to the same fragility. Theres one exception to this where failures in the steam path in the Turbine Building are not considered correlated with failures of the feedwater lines.

Seismically induced Loss of The seismically induced LOOP is The basis for this assumption is that seismically Offsite Power (LOOP) assumed to bound the fragility of induced LOOP has a generally low seismic capacity.

non-seismic class systems. This Scenarios where the non-seismic support systems incur assumption implies that a number seismically induced failures while offsite power is still of non-seismic class systems are available are considered realistic only for very low not addressed with a specific magnitude seismic events. Therefore, the most seismic failure. significant mitigating equipment will still be available.

This is considered a conservative assumption.

Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Seismic PRA LOOP recovery In the Seismic PRA, LOOP recovery It is realistic to consider that offsite power recovery is is not credited for any seismic available for low magnitude seismic events. The event above the safe shutdown selection of the SSE as a threshold between earthquake (SSE), while it is recovery/no-recovery of offsite power is arbitrary and credited with unchanged conservative. Therefore, no sensitivity analysis is probability for a seismic event required for 10 CFR 50.69.

below the SSE.

Screening of equipment in Screening of equipment in the Using a surrogate event for a number of components the Seismic Equipment List Seismic Equipment List (SEL) is that have been screened out introduces a conservative (SEL) based on fragility analysis. failure mode. The uncertainty introduced by the use of Equipment screened by the surrogate equipment for the seismic class I system is fragility team as inherently rugged judged to have a limited impact on the model.

is not modeled in the Seismic PRA Therefore, no sensitivity analysis is required for 10 CFR for their seismic induced failure. In 50.69.

order to quantitatively capture the impact of screened out equipment, generic fragility parameters for the building that housed the screened out equipment were used. The screened equipment are modeled through a surrogate basic event at a system level.

Page 3 of 4

Enclosure Attachment 3 Table 3-1 Disposition of Key Assumptions/Sources of Uncertainty Seismic PRA Assumption / Discussion Disposition Uncertainty Operators tripping the It is assumed that the operators This is considered a conservative assumption.

reactor above operating will always trip the reactor in case Therefore, no sensitivity analysis is required for 10 CFR basis earthquake (OBE) of a seismic event above OBE if 50.69.

even the option for a controlled shutdown is allowed.

Train N Auxiliary Feedwater The AFN Pump is assumed to A sensitivity case was developed to assess the (AFN) Pump (AFN) is remain functional with small uncertainty in crediting the AFN pump and not the assumed to remain breaks or leaks at instrument associated piping network. The capacity of the AFN functional following a design tubing. The fragility analysis pump was reduced to the same system level fragility basis earthquake associated with the AFN Pump only parameters associated with the instrument air system.

addresses the pump and not the CDF and LERF increased by 0.08% and 0.03% and entire piping network. indicates little significance of uncertainty in this simplification of the analysis. Therefore, no additional sensitivity analysis is required for 10 CFR 50.69.

Main steam line relief valves Main steam line relief valves are A sensitivity case is developed to assess the impact of not explicitly included in the screened out of the analysis on the this assumption. A fully dependent seismic failure SEL. basis that the steam generator and across all 20 relief valves is modeled. CDF and LERF related piping & valves are values did not change when compared to the base case considered very rugged. For this results. This indicates that there is no significant reason, the seismic failure of the uncertainty. Therefore, no additional sensitivity analysis main steam line relief valves is not is required for 10 CFR 50.69.

modeled.

Structural failures of Structural failures of building are This is a conservative assumption since the fragility buildings assumed to result in major parameters provided are addressing the beginning of collapse and failure of all the structural failure, and a failure of limited areas of equipment housed inside the the building may result in failure of only a limited building. number of equipment inside the building. The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the CST tunnel. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

The Anticipated Transient The ATWS logic for seismic PRA Moderator Temperature Coefficient (MTC) and ATWS Without Scram (ATWS) logic assumes that the RCS pressure will pressure transient are not influenced by the fact that for seismic PRA be above the HPSI shutoff head for the event is initiated by a seismic event rather than a only a short period of time. spurious failure. Therefore, the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Page 4 of 4

Attachment 4 IDP Changes from Candidate HSS to LSS

Enclosure Attachment 4 Attachment 4 IDP Changes from Candidate HSS to LSS RAI 11 , Table 4-1 below summarizes IDP limitations described in NEI 00-04.

Table 4-1 IDP Changes from Candidate High-Safety-Significant (HSS) to Low or no Safety-Significance (LSS)

Categorization IDP Drives Step - Change Associated Element Evaluation Level NEI 00-04 HSS to Functions Section LSS Internal Events Base Not Allowed Yes Case - Section 5.1 Fire, Seismic and Other External Events Base Allowable No Risk (PRA Case - Section 5.2 Component Modeled) PRA Sensitivity Studies Allowable No

-Section 5.1 Integrated PRA Assessment - Section Not Allowed Yes 5.6 Fire, Seismic and Other Component Not Allowed External Hazards - No Risk (Non-modeled)

Shutdown - Section 5.5 Function/Component Not Allowed No Core Damage - Section Function/Component Not Allowed Yes Defense-in- 6.1 Depth Containment - Section Component Not Allowed Yes 6.2 Qualitative Considerations -

Function Allowable N/A Criteria Section 9.2 Passive Passive - Section 4 Segment/Component Not Allowed No Page 1 of 1

Attachment 5 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models

Enclosure Attachment 5 Attachment 5 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models

RAI 15

Attachment 5, Table 5-1 identifies the key assumptions and sources of uncertainty and their dispositions for internal events, internal flooding and internal fire PRA models used for the 10 CFR 50.69 Program.

Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty There are two plant systems 1. SBOGs can be aligned to multiple units 1. The existing PRA model does not modeled in the PRA that are to supply limited loads. However, credit SBOGs in more than one unit.

shared between the three units. simultaneous multiple unit station Therefore, no sensitivity analysis is They are assumed to be aligned blackout conditions are screened out required for 10 CFR 50.69.

as follows: based on low probability. 2. Since each of the three startup

1. The station blackout 2. Each 13.8 kV bus has a normal and transformers are the same, there is generators (SBOGs) are alternate startup transformer supply no difference in risk except during assumed aligned to only source. The alignment is only changed maintenance, when fast bus transfer one unit during an event. for maintenance conditions. If one unit is is blocked. As part of the unavailability

2. The switchyard and startup on its normal source and another on its sensitivity analysis for the 13.8 kV transformers that supply alternate source, they share a non-Class 1E Power System (NA) and off-site power to the units transformer winding and one unit will 4.16 kV non-Class 1E Power System are assumed aligned to the block fast transfer of their non-Class 1E (NB), APS will increase the normal breaker on each 4160V buses. In this unique condition, unavailability of fast bus transfer by a Units 13.8 kV buses. loss of one train of power in the unit factor of 3 to address the increase in Alternate power from blocking fast bus transfer will result in a risk during start up transformer another transformer is reactor trip due to loss of two reactor maintenance.

modeled for out of service coolant pumps.

conditions.

Page 1 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Reactor Coolant Pump (RCP) RCP Seal Leak or Rupture is not modeled as No sensitivity analysis is required for 10 Seal Leak or Rupture a loss of Reactor Coolant System (RCS) CFR 50.69.

Inventory safety function. Based on WCAP-15749 Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, (Reference 6) and vendor information [refer to WCAP-16175-P-A Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, (Reference 9)] the very tight clearances would limit RCS leakage into the seal package to 17 gallons per minute (gpm) per pump. WCAP-15749 was based on WCAP-16175-P-A, which the NRC endorsed. WCAP-16175-P-A specifies an assumed 17 gpm per pump seal leakage rate for Palo Verde. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA. An analysis showed that continuing to model RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF.

Loss of Coolant Accident (LOCA) NUREG/CR-6928 (Reference 7) restated the The slight variance in the range of break Frequencies results from NUREG-1829 (Reference 8). The sizes for different LOCAs is not significant LOCA frequencies are based upon expert and is judged to have minimal impact on elicitations. The LOCA sizes identified by the LOCA frequencies, within the NRC are different from those estimated for uncertainties associated with the expert PVNGS. elicitation values, and of insignificant impact. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

Loss of Off-site Power (LOOP) The national LOOP data presented in the The LOOP frequencies are based on Frequency periodically updated EPRI events report recent industry data and are appropriate (Reference 13) was used to obtain point- to represent plant-specific conditions.

estimates for switchyard centered and severe SBOGs, as well as other additional electric weather related LOOP frequencies. The EPRI power supplies, are available on site to reports indicate that the generic LOOP data is mitigate LOOP. Therefore, no sensitivity subject to user modifications and screenings analysis is required for 10 CFR 50.69.

to fit the local plant designs and environmental conditions. This approach of LOOP screening is considered reasonable and necessary to avoid erroneous skewing of the LOOP data. The frequency of extreme weather LOOP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid related LOOP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 5).

Page 2 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Loss of Off-site Power at The probabilities of offsite power non- The offsite power non-recovery Switchyard (LOOP) Associated recoveries were obtained from Table 4-1 of probabilities are based on the best Non-Recovery Probabilities the draft NRC NUREG/CR-INEEL/EXT available data and are appropriate to 02326 (Reference 5). The error factors represent plant-specific conditions.

associated with LOOP frequencies and LOOP Diesel Generators, SBOGs, as well as non-recovery probabilities were obtained other additional electric power supplies, from draft NRC NUREG/CR-INEEL/EXT are available on site to mitigate LOOP.

02326 (when provided); otherwise, by using Therefore, no sensitivity analysis is available in-house statistical programs for required for 10 CFR 50.69.

lognormal and Weibull distributions.

Battery Life Assumptions The PVNGS batteries are conservatively The PRA model used to support the 10 CFR assumed to be discharged after 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 50.69 Program will be controlled by PVNGS even though greater margin is available. procedures to reflect the as-built, as-79IS-9ZZ07 Extended Loss of All Site AC operated plant condition. Therefore, no Guideline, Modes 1-4 (Reference 10), Appendix sensitivity analysis is required for 10 CFR A is available for load shedding during an 50.69.

Extended Loss of AC Power (ELAP) to extend Class 1E 125 VDC (PK) battery life in order to provide power to a reduced set of loads, allowing control room operation of Atmospheric Dump Valves (ADVs) and the steam driven Train-A Auxiliary Feedwater pump (AFA-P01).

This is the only battery load shedding strategy employed at the PVNGS units. The battery load-shedding strategy results in a safe stable end-state at the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time and supports a minimum of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> of ELAP conditions with the expectation that the 480V FLEX generators are deployed and operational within 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> to restore AC power to the battery chargers. 4160V portable generators are also available to restore AC power to the unit.

The 79IS-9ZZ07 Extended Loss of All Site AC guideline was issued after the PRA Model of Record utilized for the LAR. The impact to the PRA Model of this new guideline will be evaluated in accordance with the PRA Model Control procedure. The evaluation will consider, at minimum, the effects of extending battery life, applicability to specific ELAP scenarios, and the impact of shed loads.

All flood scenarios on the 40ft A cutset review showed that the contribution This is a conservative approach and and 51ft elevations of the of Fire Protection (FP) initiators is very low would not have a significant impact on Auxiliary Building assume that a and that the Internal Flood results are not the baseline Internal Flood model.

pipe failure drains the Refueling being skewed by this conservatism. Therefore, no sensitivity analysis is Water Tank (RWT). required for 10 CFR 50.69.

A single internal events PRA There are no significant differences between It is a realistic assumption that the Unit 1 model was developed to the units for Internal Flood. The Unit 1 SSC designators are used, since there are quantify the plant flood risk for System, Structure, or Component (SSC) no major differences between the three multiple units. designators were used in the Internal Flood units in terms of internal flooding.

model. It was therefore assumed that the Therefore, no sensitivity analysis is quantification results are applicable to all required for 10 CFR 50.69.

units.

Page 3 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty All components within a flood This is a conservative assumption that This is a conservative approach that area where the flood originates simplifies the impacted component list. simplifies the impacted component list.

were assumed susceptible and Uncertainty exists where exactly the flood Therefore, no sensitivity analysis is failed as a result of the flood, would occur, the impact due to the geometry required for 10 CFR 50.69.

spray, steam, jet impingement, of the room and equipment, and the pipe whip, humidity, direction of the spray or splash for a given condensation and temperature scenario. This assumption raises CDF.

concerns except when component design (e.g.,

waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect.

Block walls are not credited in Unless a treatment is non-conservative, the This has no impact and is of low the analysis and are treated as block walls are analyzed on an individual consequence. Therefore, no sensitivity typical plant walls. basis. The amount of water that could flow analysis is required for 10 CFR 50.69.

through the gaps is unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment.

Breaks in pipes less than or The basis for this assumption is as follows: This is a conservative approach.

equal to two inches in 1. Provides a practical limit to bound the Therefore, no sensitivity analysis is equivalent diameter were only scope of the analysis to potentially large required for 10 CFR 50.69.

considered if the break would flow rate and significant consequence directly result in a plant trip or events.

result in a flood induced 2. Pipe sizes of less than or equal to two equipment failure that would inch diameter do not accurately reflect result in a plant trip or plant fluid system flood impacts (i.e. two immediate shutdown. inch diameter pipes produce significantly smaller flow rates).

3. At low flow rates, typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful. Such conditions enhance operator actions significantly to successfully mitigate the breaks in small bore pipes.

However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events. Specifically these events are considered in rooms without drains. Piping less than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented.

Closed-loop systems and tanks This is a conservative approach that allows This is a conservative approach.

were assumed to for the consideration of all consequences and Therefore, no sensitivity analysis is instantaneously release the does not require time based calculations. required for 10 CFR 50.69.

entire system inventory Control Room staff would be Human Error Probability (HEP) and This is a conservative approach.

unable to respond effectively to Performance Shaping Factors (PSF) Therefore, no sensitivity analysis is multiple events immediately adjustments were made during the early required for 10 CFR 50.69.

following the flooding event stages of a flooding event to account for the additional stress influencing factors. The CDF is higher with this assumption.

Page 4 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty No addition to the Control Room Operator actions to isolate the flood source It is a realistic assumption that there crew is credited early into a are required shortly after detecting that a would be no addition to the Control Room flood event when assessing Pressure Boundary Failure (PBF) has crew early into the flood event when human actions. occurred. Often when responding to flood assessing human actions. Therefore, no events operators are responding to multiple sensitivity analysis is required for 10 CFR alarms. 50.69.

It is assumed that pipes that are The assumption is conservative as it includes This is a conservative approach.

larger than 3" were capable of additional piping that may not be conducive Therefore, no sensitivity analysis is producing major floods unless it to major flooding. Since major floods are not required for 10 CFR 50.69.

was determined that the piping a major contributor to the Pressure Boundary was not capable of producing a Failure frequency, its contribution to risk major flood. would be considered minimal.

External tanks were not External tanks that are ruptured would not There is no significant impact on the considered as a flood source normally propagate into the plant. There model. Therefore, no sensitivity analysis unless there is a normally were no tanks identified outside the is required for 10 CFR 50.69.

available pathway into the plant protected area in this Internal Flood PRA whereby the tank contents could whose contents could propagate into the empty into a room within the plant. It was assumed that the impact of an main plant structures. external tank rupture was bounded by the evaluation performed for internal events.

Breach of an external tank was assumed to discharge to the yard area and there would be no flood-induced failures of PRA related components.

Floods are assumed to fail all Cases in which equipment is deemed as This assumption is a conservative equipment in the initiating room sufficiently high or flood barriers are not modeling technique that is used to and then propagate out of the expected to retain water to sufficient flood initially fail all equipment within an room to surrounding flood levels are treated on an individual basis. initiating compartment and if needed, areas. Additionally, splitting the flood areas would further refinement is applied to dominant generate an unreasonable number of cutsets to provide more realistic results.

scenarios with no added insight. The top Therefore, no sensitivity analysis is cutsets are impacted by this assumption and required for 10 CFR 50.69.

therefore very specific isolation actions were taken. The flood isolation actions for dominant cutsets were developed and proceduralized to mitigate flooding consequences. Supporting flood analyses for these isolation actions have been reviewed and documented in engineering evaluations and PRA studies. The PRA model reflects the as-built/as-operated plant configuration.

Floods are assumed to Water will flow down the path of least It is a realistic assumption and is of low propagate down pipe chases resistance therefore a pipe chase is the consequence. Therefore, no sensitivity rather than down stairwells in preferred path over a stairwell with a door in analysis is required for 10 CFR 50.69.

situations where pipe chases are front.

not surrounded by a curb and/or a door must be opened to enter into the stairwell.

Floods are assumed to The hydrostatic load that a door can handle It is a realistic assumption and is of low propagate through doorways is based on whether the door closes against consequence. Therefore, no sensitivity which open out, away from the the frame or away (with relation to the room analysis is required for 10 CFR 50.69.

initiating flood area more readily that the flooding initiates). A door that is rather than doorways which against the frame can withstand a greater open in, towards the initiating load as opposed to away from the door flooding area. frame.

Page 5 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Floor drains were assumed to be This assumption is based on the expectation It is a realistic assumption and is of low capable of controlling water that a spray event will not result in a consequence. Therefore, no sensitivity levels for spray events. significant accumulation of standing water. analysis is required for 10 CFR 50.69.

During plant walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank.

Such events were screened out as potential flooding sources.

The piping layout for flood To the extent possible, the similarities were It is a realistic assumption and is of low sources included in the Internal confirmed during the plant walkdowns. consequence. Therefore, no sensitivity Flooding PRA was estimated to Therefore, Units 2 and 3 pipe lengths were analysis is required for 10 CFR 50.69.

be similar for all three units. assumed to be identical to Unit 1 piping lengths. There are no major differences between the three units.

It is assumed that if a PBF were There are no operator procedures for This is a conservative assumption and is to occur in the Safety Injection isolating a flood event, therefore the most of low consequence. A sensitivity analysis (SI) or Chemical & Volume conservative and bounding location to isolate was performed in which each flooding Control (CH) system piping, that a flood of the SI or CH is one of the two pipe isolation HEP associated with the SI or CH the operator would isolate the headers. By isolating at this point it results in system piping (a total of four) for these flood at one of the two pipe the loss of at least one train of the ECCS. flooding isolation events were modified headers connecting the This does cause a trip. Therefore the overall from their original HEP of 5E-02 or less to Refueling Water Tank (RWT) to impact on the model is small. a highly conservative screening value of the CH and SI systems. 1.00. The change in overall CDF and LERF for this case is 0.6% and 0.4%,

respectively. Therefore, no sensitivity analysis is required for 10 CFR 50.69.

It is assumed that spurious Spurious actuation of a system relief valve This is of low consequence. Therefore, no actuation of system relief valves was not determined to be a credible flooding sensitivity analysis is required for 10 CFR would discharge a limited source because the inventory that was 50.69.

amount of inventory to a released would be retained within the discharge tank and such events flooding area and would not lead to an were screened out as potential applicable initiating event. The risk is flooding sources. considered negligible as this is not considered to be a significant source of inventory.

Limited or no access to an area There was no credit taken for mitigation This is of low consequence. Therefore, no where flooding initiation occurs when the equipment relied on for mitigation sensitivity analysis is required for 10 CFR was assumed. was located in the flooding initiation area. 50.69.

Operators cannot get into flooded areas.

Only one internal flooding The occurrence of simultaneous multiple It is a realistic assumption and is of low initiating event is assumed to independent internal flooding events was consequence. Therefore, no sensitivity occur at a time. considered to be very unlikely and was not analysis is required for 10 CFR 50.69.

considered in this evaluation. This is consistent with PRA modeling.

The breach of isolation This is a simplifying assumption that has a This is a conservative assumption and is barrier(s) that may result in a negligible impact on the model. Propagation of low consequence. Therefore, no maintenance-induced flooding pathways were made to be conservative for sensitivity analysis is required for 10 CFR event was assumed to have no all scenarios 50.69.

impact on altering the propagation paths related to other flooding mechanisms (i.e.,

pipe failure) for the flooding source.

Page 6 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty The indirect effects of a PBF on Closed looped systems were considered to be This is a conservative assumption and is the operability of a closed normally operating and provides cooling to of low consequence. Therefore, no looped system were considered equipment that is relied on to maintain the sensitivity analysis is required for 10 CFR to be immediate. plant in a power production state. It was 50.69.

therefore assumed that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity. A PBF would drain the system and in most cases an operator action to isolate the PBF would not be feasible. This assumption is conservative and raises CDF.

The spill rate resulting from a For a potentially unlimited source, a PBF that It is a realistic assumption and is of low PBF of a potential unlimited resulted in a spray event (<100 gpm) would consequence. Therefore, no sensitivity flooding source that causes a take an extraordinary amount of time to analysis is required for 10 CFR 50.69.

spray event is low enough (i.e., cause a loss of that system. Additionally,

<100 gpm) to have no given that for most of the large nearly significant impact on the unlimited sources the makeup capabilities of operation of the affected the system would generally exceed the flow system. rate generated by a spray event. It was therefore assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (i.e. the CH system) this assumption was not valid.

The flow rate from a PBF is The spill rate resulting from a PBF of piping is This is a conservative assumption and is assumed static at the maximum considered to be the highest flow rate of low consequence. Therefore, no possible rate and the scenario is possible from the system or piping, and for sensitivity analysis is required for 10 CFR only ended when the source was tank is was assumed to be constant at an 50.69.

exhausted or isolated. assumed flow rate, and for systems requiring pumps is considered the realistic pump flow rate, for the particular break in the originating flooding area until the flooding source was isolated or its water supply was limited or exhausted.

The accumulation of flood water in a flooding area was considered halted when the flooding source was terminated, or when outflow from the flooding area matches or exceeds the inflow of flood water to the flooding area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding.

Spill rates were assumed to fall within the following categories:

• Spray events: 100 gpm

• Flooding events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)

• Major flooding events: greater than 2000 gpm (or the maximum capacity of the system, whichever is lower)

Page 7 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty The treatment of main steam Recovery of feedwater is important for This is of low consequence. Therefore, no line break and main feedwater secondary side heat removal. The internal sensitivity analysis is required for 10 CFR line break internal events events analysis was believed to provide 50.69.

analysis was assumed to sufficient analysis to be used in the internal address the impact of these flooding model.

events in assessing whether main feedwater can be recovered following a reactor trip.

It was assumed that minimal or The flooding HRA dependency analysis did This is of low consequence. Therefore, no no dependency existed between not include large early release specific HFEs. sensitivity analysis is required for 10 CFR flood-specific and large early HFEs specific to large early releases (i.e., 50.69.

release specific Human Failure post-core damage operator actions) are Events (HFEs). generally performed several hours after the initiating event occurs.

No dependency between early and late operator actions. All HFE dependency analyses are evaluated in accordance with NUREG/CR-1278 Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, (Reference 11) and meet all requirements found in ASME/ANS RA-Sa-2009 (Reference 2). There is no impact on the model.

The fire areas defined by the Fire areas are required by regulation to be It is a realistic assumption and is of low Fire Hazards Analysis (which is sufficiently bounded to withstand the hazards consequence. Therefore, no sensitivity contained in the UFSAR, associated with the area as defined in analysis is required for 10 CFR 50.69.

Sections 9B.2.1 through Generic Letter 86-10 (Enclosure 1 Section 4).

9B.2.22) will substantially Fire zone boundaries are similarly assumed contain the adverse effects of adequate; however, because fire zones have fires originating from any a lesser pedigree than fire areas, their currently installed fixed ignition boundaries are verified adequately in this source or reasonably expected notebook by a fire hazard analysis (FHA) transient ignition source. Fire review and plant walkdowns. Fire zone zone boundaries are similarly boundaries that appear unable to withstand assumed adequate or combined. the fire hazards within the zone are combined. The fire PRA utilizes fire compartments which generally align with fire zones, but may be a combination of several fire zones.

Systems and equipment not The assumption that any fire fails all It is a realistic assumption and is of low credited in the fire-induced risk equipment lacking cable routing information consequence. Therefore, no additional model (e.g., systems for which has the potential to affect the assessed fire sensitivity analysis is required for 10 CFR cable routing will not be risk. The assumption that any fire will 50.69.

performed) are assumed to be minimally result in a loss of Main Feedwater failed in the fire-induced risk and subsequent reactor trip likely adds model. These systems and conservatism to the Fire PRA results.

equipment are failed in the However, the degree of conservatism is worst possible failure mode, relatively small compared with other including spurious operation modeling uncertainties, since Main Feedwater will trip for most transient events.

It is assumed that any fire will minimally result in a loss of The impact of these assumptions was Main Feedwater and subsequent evaluated by a sensitivity analysis case reactor trip. This is a simplifying which concluded that the risk reduction due and conservative assumption to crediting all components assumed always and is typical of Fire PRAs. failed was small.

However, it may not be true for all fires.

Page 8 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty It is assumed that the Reactor RPS design is sufficiently fail-safe and It is a realistic assumption and is of low Protection System (RPS) design redundant to preclude fire-induced failure to consequence. The low frequency of a fire is sufficiently fail-safe and scram: Consistent with the guidance in occurring coincident with the low redundant to preclude fire- NUREG/CR-6850 Section 2.5.1 (Reference probability of independent failure to induced failure to scram, or 12), type of sequences that can be generally scram results in a negligible contribution random failure to scram during eliminated from consideration in Fire PRA to fire risk. Therefore, no sensitivity a fire event, as a risk significant include sequences for which a low frequency analysis is required for 10 CFR 50.69.

contributor. argument can be made, and uses ATWS as a specific example, because fire-induced failures will almost certainly remove power from the control rods, resulting in a trip, rather than cause a failure to scram condition.

Properly sized and coordinated Electrical protection design calculations This is a conservative approach because electrical protective devices are provide the documentation of the electrical credited cable lengths have a margin of assumed to function within their coordination between overcurrent protective 20% or more applied to the credited design tripping characteristics, devices. An evaluation was performed to cable lengths to ensure that applicable thus preventing initiation of assess the Fire PRA power supply raceways were identified. Additionally, secondary fires through circuit coordination requirements in accordance with the fire-induced impact is modeled within faults created by the initiating NUREG/CR 6850 (Reference 12), and the credited cable length. Therefore, no fire. provides a link to relevant PVNGS electrical sensitivity analysis is required for 10 CFR coordination calculations that demonstrate 50.69.

selective tripping capability for each credited Fire PRA power supply. When selective tripping cannot be demonstrated, the current fire PRA model credits cable lengths to limit fault current that fails a power supply.

It is assumed that Fire PRA All raceways containing cables were assigned It is a realistic assumption and is of low targets were assigned the a radiant heat flux damage threshold of consequence. It was concluded that appropriate radiant heat flux 6kW/m2 and 205 °C. Raceways containing minimal benefit could be obtained by damage and temperature cables with thermoset insulation only may be further analysis to identify and model damage criteria depending on assigned a radiant heat flux damage raceways containing only thermoset the cable insulation information threshold of 11 kW/m2 and 330 °C but have insulation. Therefore, no sensitivity available. In other words, all been initially assigned the thermoplastic analysis is required for 10 CFR 50.69.

raceways containing cables with damage thresholds. A brief review of the thermoplastic or unknown cable dominant scenarios identified the existence insulation were assigned a of thermoplastic insulated cables within the radiant heat flux damage target raceways.

threshold of 6kW/m2 and 205

°C. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thresholds.

Page 9 of 10

Enclosure Attachment 5 Table 5-1 Disposition of Key Assumptions/Sources of Uncertainty Internal Events, Internal Flooding and Internal Fire Models Assumption /

Discussion Disposition Uncertainty Plant modifications and recovery All plant modifications credited in the LAR The PRA model reflects the as-built/as-actions were assumed in the submittal baseline probabilistic risk assessment operated plant configuration. Therefore, base case Fire model at the time (PRA) to address fire risk have been physically no sensitivity analysis is required for 10 of the LAR submittal. implemented in all three Units. Any model CFR 50.69.

and/or documentation updates as a result of these physical modifications are being tracked via our PRA model impact database.

All fire human failure event (HFE) recovery actions have been derived from the Internal Events PRA model. No unique HFEs have been created for the fire model. The augmented fire HFEs meet requirements found in Table 4-2.10-1 of ASME/ANS RA-Sa-2009 (Reference 2).

Page 10 of 10

Attachment 6 Other External Hazards Screening Peer Review Findings

Enclosure Attachment 6 Attachment 6 Other External Hazards Screening Peer Review Findings

RAI 17

Attachment 6, Table 6-1 documents the other external hazards screening peer review findings and their dispositions.

Table 6-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT-D1 01 The walkdown resulted in 1. Erosion of spoils piles from the excavation of the 45-acre unresolved issues. It is reservoir into the East Wash drainage path next to the East assumed these issues need to Wash Embankment has negatively impacted the design be resolved successfully to drainage through this area. (The plant had previously allow the screening process to identified this issue.) This item applies to all three units.

be complete and verified. Disposition: APS committed to removing the spoils piles from Until the issues are resolved, the vicinity of the East Wash channel in 2013 and the hazards cannot be subsequently removed those spoils piles. Therefore, this item considered screened. The is resolved.

issues are unanalyzed. The 2. The safety-related structures roof design (drains and report implies that a additional scuppers or holes in the parapet walls to limit the successful resolution is water level to 6 in.) did not appear to provide many holes in forthcoming, but no the parapet walls to limit water depth to 6 in. The design of commitment date is provided. the scuppers should be reviewed with respect to a probable Based on the information maximum precipitation (PMP) event. This item applies to all provided, the issues could three units.

remain unresolved for the life Disposition: A Palo Verde Action Request 3952605 concluded of the plant. If this is the that there was a nonconformance with respect to the PVNGS case, the current condition Updated Final Safety Analysis Report (UFSAR) description.

should be evaluated and However, a subsequent Engineering Evaluation (EWR shown to be compliant with 3956860) analyzed the scupper drainage capacity and the screening criteria. concluded that the roof loading would not exceed 30 psf (6 in.

of water) given the design basis 50-y/6-h PMP. Therefore, the as-built roof drainage design met the 1975 SER requirements.

This item is resolved.

3. The onsite ammonia tanks (1-M-SCN-T03C and D) inside the Turbine Building appear to contain NH2OH and Carbohydrazide rather than ammonia. This needs to be clarified with the authors of the control room habitability evaluations and inventory of onsite hazardous materials calculations. This item applies to all three units.

Disposition: Follow-on discussion indicated that additional contents within those tanks vary as needed. However, assuming ammonia as described is appropriate in the control room habitability analyses. Therefore, this item is resolved.

Page 1 of 2

Enclosure Attachment 6 Table 6-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT-D1 01 4. The onsite storage of PolyFloc AE1701 walkdown indicated (cont.) that the 11,000 gal tank at the Water Resources Facility (WRF) is no longer used. Only the 6,000 gal tank is used. This should be discussed with the authors of the control room habitability evaluations and inventory of onsite hazardous materials calculations. This item is conservatively assumed to apply to all three units. (Unit 1 is closest to the WRF storage location.)

Disposition: Assuming the 11,000 gal tank is being used is conservative. Also, it preserves the option of using it if the 6,000 gal tank system becomes unavailable. Therefore, this item is resolved.

5. The drainage ditch between Building A (Administrative building) and the parking lot south of the switchyard has a cement traffic barrier in it. The reason for this is not apparent.

This item applies only to Unit 3.

Disposition: Because of the location of the barrier drainage ditch, any overflow would be routed towards the southeast boundary of the site (based on site drainage design drawings) and would not be expected to impact Unit 3 (nearest to the barrier) or the other units. Therefore, this item is resolved.

EXT-D1 02 PVNGS is a three unit site. These issues applied to all three units and were resolved for The external hazards all three units as indicated above in F&O EXT-D1-01.

evaluation presumably applies to all three sites equally. The walkdown identifies 3 issues in the YARD [#1, #4, and

1. 5], which could be preferentially worse for one unit. Issue #2 and #3 should specify if this occurs at each unit, or one unit applicable to the whole site. There is no discussion of unit dissimilarities, based on orientation.

EXT-E2 01 For the analysis of the The calculations of hazard frequency and CCDP were transportation accident subsequently added to Section 6.35 of the final report and the resulting from the shipment tornado missile impact was documented in Section 6.7 of the of chlorine gas by railcars and revised report. After these changes, these events continued onsite delivery of ammonium to meet the screening criteria and the finding is now resolved.

hydroxide, the actual calculations of the hazard frequency and CCDP were not presented in Section 6.35 of the report. The bounding calculation performed for the tornado missile impact was not sufficiently documented in Section 6.7 of the report.

Page 2 of 2

Attachment 7 Internal Fire Focused Scope PRA Peer Review

Enclosure Attachment 7 Attachment 7 Internal Fire Focused Scope PRA Peer Review

RAI 21

Attachment 7, Table 7-1 below provides the internal fire focused scope peer review finding and its disposition relevant to implementation of the NRC-accepted fire PRA methods described in RAI 21-APLA.

Table 7-1 Internal Fire Focused Scope PRA Peer Review Observation ID /

Finding Description Documentation of Resolution F&O Number CF-A1-01 [14FS] A review of the FSS database, design drawings, and circuit This finding has been resolved by PRA failure supporting documentation identified several instances model and documentation changes. The where an inappropriate circuit failure probability was assigned in FSS database, circuit failure review the Fire PRA. worksheets and Cable Selection and

• Circuit failure review worksheets, highlighted elementary Circuit Analysis [CS/CF] study have been diagrams, and the FSS database for valve CHN-LV-110, revised to correct the unintended associated with BE 1CHELV110P-AVFC Failure of AOV Valve application of the circuit failure LV110P fails to Isolate following ISLOCA were reviewed. The probability.

review determined that cables 1ECH58NC1XA, 1ECH58NC1XB, and 1ECH58NC1XC were assigned an A review of the specific circuit types (i.e.,

aggregate CF probability of 0.56, based on Table 4-1 of instrumentation circuit failure NUREG/CR-7150 for SOV, single break, ungrounded dc, probabilities incorrectly assigned and thermo-set cable. Upon review of the circuit, the cables of MOV power cable identification and concern appear to be associated with instrumentation assignment of circuit failure probabilities) signals related to the control of the valve (4-20 mA signal for similar component type was cable as opposed to 125 vdc control cable). As discussed in performed.

Section 3 and 7.3 of NUREG/CR-7150, conditional spurious probability estimates should not be applied to The Cable Selection and Circuit Analysis instrumentation circuits. [CS/CF] study was revised to provide additional guidance when performing

• Circuit failure review worksheets, highlighted elementary cable failure mode likelihood calculations diagrams, and the FSS database for valve Component for instrument and power cables.

Functional State 1JHPBUV2:Closed:Closed, associated with Additionally, this finding is associated BE 1HPBP36V02-MV-RC Failure of MOV Globe VLV HPB- with SRs determined met to Capability UV002 to Remain Closed for CTMNT Isolation were reviewed. Category II and will be included in an The component is a normally closed, desired closed MOV. upcoming augmented F&O Closure The review determined that the power cables for this valve Review for determination of closure.

were identified as required for the valve functional state, although the power cables (i.e., 1EHP02BC1KA, and 1EHP02BC1KC) are not required for the valve to remain closed. In addition, these cables were assigned a spurious operation probability from Table 4-3 of NUREG/CR-7150, which is intended for grounded MOV single break control circuits (not power cables). Other instances were identified during the review where MOV power cables for passive MOVs that were analyzed only for spurious operation had their power cables identified as required and assigned spurious operation probability.

Page 1 of 2

Enclosure Attachment 7 Table 7-1 Internal Fire Focused Scope PRA Peer Review Observation ID /

Finding Description Documentation of Resolution F&O Number Identification of incorrect spurious operation probability for specific types can underestimate fire risk (e.g., AOV Valve LV110P example) or overestimate fire risk (e.g., MOV Globe VLV HPB-UV002 example).

Recommendation: Review the specific circuit types (i.e.,

instrumentation circuit failure probabilities incorrectly assigned and MOV power cable identification and assignment of circuit failure probabilities) for these components and other similar component types. Update the methodology and results in the Fire PRA Notebook Fire PRA Cable Selection and Circuit Analysis and any other necessary supporting documents and databases.

Page 2 of 2

Attachment 8 PRA Risk Criteria per NEI 00-04

Enclosure Attachment 8 Attachment 8 PRA Risk Criteria per NEI 00-04 RAI 23 , Table 8-1 below lists the criteria from NEI 00-04 that will be used to determine PRA-based high safety significant (HSS) vs low safety significant (LSS) ranking for components.

Table 8-1 PRA Risk Criteria per NEI 00-04 PRA Base Case Criteria Ranking HSS Sum of F-V for all basic events modeling the SSC of interest, including common cause events > 0.005 HSS Maximum of component basic event RAW values > 2 HSS Maximum of applicable common cause basic events RAW values > 20 LSS Any modeled SSCs that do not meet any of the HSS criteria Page 1 of 1