ML18243A280

Issuance of Amendment Nos. 207, 207, and 207 to Adopt 10 CFR 50.69 (CAC Nos. MF9971, MF9972, and MF9973; EPID L-2017-LLA-0276)

ML18243A280
Person / Time
Site:	Palo Verde
Issue date:	10/10/2018
From:	Michael Orenak Plant Licensing Branch IV
To:	Bement R Arizona Public Service Co
Orenak M
References
CAC MF9971, CAC MF9972, CAC MF9973, EPID L-2017-LLA-0276
Download: ML18243A280 (60)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 October 10, 2018 Mr. Robert S. Bement Executive Vice President Nuclear/

Chief Nuclear Officer Mail Station 7602 Arizona Public Service Company P.O. Box 52034, Mail Station 7602 Phoenix, AZ 85072-2034

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3-ISSUANCE OF AMENDMENT NOS. 207,207, AND 207 TO ADOPT 10 CFR 50.69, "RISK-INFORMED CATEGORIZATION AND TREATMENT OF STRUCTURES, SYSTEMS AND COMPONENTS FOR NUCLEAR POWER REACTORS" (CAC NOS. MF9971, MF9972, AND MF9973; EPID L-2017-LLA-0276)

Dear Mr. Bement:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment Nos. 207, 207, and 207, to Renewed Facility Operating License Nos. NPF-41, NPF-51, and NPF-74 for the Palo Verde Nuclear Generating Station, Units 1, 2, and 3, respectively. The amendments consist of changes to the licenses in response to your application dated July 19, 2017, as supplemented by letters dated May 9, July 13, and August 10, 2018.

The amendments add a new license condition to allow the implementation of risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors in accordance with Title 1O of the Code of Federal Regulations Section 50.69.

R. Bement A copy of the related safety evaluation is also enclosed. A notice of issuance will be included in the Commission's biweekly Federal Register notice.

Michael D. Orenak, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. STN 50-528, STN 50-529, and STN 50-530

Enclosures:

1. Amendment No. 207 to NPF-41

2. Amendment No. 207 to NPF-51

3. Amendment No. 207 to NPF-74

4. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-528 PALO VERDE NUCLEAR GENERATING STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 207 License No. NPF-41

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 19, 2017, as supplemented by letters dated May 9, July 13, and August 10, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and paragraph 2(C)14 of Renewed Facility Operating License No. NPF-41 is hereby amended to read as follows:

(14) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

In addition, the license is amended by changes as indicated in the attachment to this license amendment, and Appendix D, "Additional Conditions," to Renewed Facility Operating License No. NPF-41 is hereby amended to include a new license condition to read as follows:

APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using:

Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102- 07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-41 Date of Issuance: October 10, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, O.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-529 PALO VERDE NUCLEAR GENERATING STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 207 License No. NPF-51

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 19, 2017, as supplemented by letters dated May 9, July 13, and August 10, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and paragraph 2(C)9 of Renewed Facility Operating License No. NPF-51 is hereby amended to read as follows:

(9) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

In addition, the license is amended by changes as indicated in the attachment to this license amendment, and Appendix D, "Additional Conditions," to Renewed Facility Operating License No. NPF-51 is hereby amended to include a new license condition to read as follows:

APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using:

Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102- 07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-51 Date of Issuance: October 10, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-530 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 207 License No. NPF-74

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 19, 2017, as supplemented by letters dated May 9, July 13, and August 10, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 3

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and paragraph 2C(5) of Renewed Facility Operating License No. NPF-74 is hereby amended to read as follows:

(5) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

In addition, the license is amended by changes as indicated in the attachment to this license amendment, and Appendix D, "Additional Conditions," to Renewed Facility Operating License No. NPF-74 is hereby amended to include a new license condition to read as follows:

APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using:

Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-74 Date of Issuance: October 10, 2018

ATTACHMENT TO LICENSE AMENDMENT NOS. 207,207, AND 207 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530 Replace the following pages of the Renewed Facility Operating Licenses Nos. NPF-41, NPF-51, and NPF-74 and Appendix D - Additional Conditions with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Renewed Facility Operating License No. NPF-41 REMOVE INSERT 6 6 Renewed Facility Operating License No. NPF-51 REMOVE INSERT 7 7 Renewed Facility Operating License No. NPF-74 REMOVE INSERT 4 4 Appendix D - Additional Conditions REMOVE INSERT 5

(8) Emergency Preparedness Deleted (9) Results of Piping Vibration Test Program (Section 3.9.2, SER)

Deleted (10) Response to Salem ATWS Event (Section 7.2, SSER 7, and Section 1.11, SSER 8)

Deleted (11) Supplement No. 1 to NUREG-0737 Requirements Deleted

( 12) Radiochemistry Laboratory {Section 7 .3.1.5{3), Emergency Plan)

Deleted

( 13) RCP Shaft Vibration Monitoring Program (Section 5.4.1, SSER 12)

Deleted (14) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

(15) Mitigation Strategy License Condition APS shall develop and maintain strategies for addressing large fires and explosions and that includes the following key areas:

(a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance.

2. Assessment of mutual aid fire fighting assets.

3. Designated staging areas for equipment and materials.

4. Command and control.

5. Training of response personnel.

(b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets.

2. Communications.

Renewed Facility Operating License No. NPF-41 Amendment No. 207

(8) Supplement No. 1 to NUREG-0737 Requirements Deleted (9) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

(10) Mitigation Strategy License Condition APS shall develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance.

2. Assessment of mutual aid fire fighting assets.

3. Designated staging areas for equipment and materials.

4. Command and control.

5. Training of response personnel.

(b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets.

2. Communications.

3. Minimizing fire spread.

4. Procedures for implementing integrated fire response strategy.

5. Identification of readily-available pre-staged equipment.

6. Training on integrated fire response strategy.

7. Spent fuel pool mitigation measures.

(c) Actions to minimize release to include consideration of:

1. Water spray scrubbing.

2. Dose to onsite responders.

Renewed Facility Operating License No. NPF-51 Amendment No. 207

(4) Pursuant to the Act and 10 CFR Part 30, 40, and 70, APS to receive, possess, and use in amounts required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Pursuant to the Act and 10 CFR Parts 30, 40, and 70, APS to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This renewed operating license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

( 1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power), in accordance with the conditions specified herein.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 206, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3) Antitrust Conditions This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

(4) Initial Test Program (Section 14, SER and SSER 2)

Deleted (5) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 207, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

Renewed Facility Operating License No. NPF-74 Amendment No. 207

Amendment Number Additional Conditions Implementation Date 207 APS is approved to implement 10 CFR 50.69 The license using the processes for categorization of Risk- amendment shall be Informed Safety Class (RISC)-1, RISC-2, implemented within RISC-3, and RISC-4 structures, systems, and 90 days of the date components (SSCs) using: Probabilistic Risk of issuance.

Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Amendment No. 207

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 207,207, AND 207 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530

1.0 INTRODUCTION

By letter dated July 19, 2017 (Reference 1), as supplemented by letters dated May 9, July 13, and August 10, 2018 (References 2, 3 and 4, respectively), Arizona Public Service Company (APS, the licensee) submitted a license amendment request (LAR) for the Palo Verde Nuclear Generating Station (the licensee, Palo Verde), Units 1, 2, and 3, respectively. The licensee proposed to add a new license condition to the Renewed Facility Operating Licenses (RFOLs) to allow the implementation of Title 10 of the Code of Federal Regulations ( 10 CFR)

Section 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of structures, systems, and components (SSCs) subject to special treatment requirements (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation) based on a method of categorizing SSCs according to their safety significance.

By letter dated April 6, 2018 (Reference 5), the U.S. Nuclear Regulatory Commission (NRC or the Commission) staff requested additional information from the licensee. The licensee responded to the requests for additional information (RAls) in the letter dated May 9, 2018 (Reference 2). The supplemental letters dated May 9, July 13, and August 10, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register on September 26, 2017 (82 FR 44850).

2.0 REGULATORY EVALUATION

2.1 Risk-Informed Categorization and Treatment of Structures, Systems and Components The probabilistic approach to regulation enhances and extends the traditional deterministic regulation by considering risk in a comprehensive manner. Specifically, a probabilistic approach allows consideration of a broader set of potential challenges to safety, providing a logical means Enclosure 4

for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. Probabilistic risk assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures (CCFs).

To take advantage of the safety enhancements available through the use of PRA, the NRC promulgated a new regulation, 10 CFR 50.69, in the Federal Register on November 22, 2004 (69 FR 68008), which became effective on December 22, 2004. The provisions of 10 CFR 50.69 contain requirements regarding how a licensee categorizes SSCs, adjusts treatment requirements in accordance with the safety significance of the SSC, and manages this process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decisionmaking process, which uses both risk insights and traditional engineering insights. The safety functions include the design-basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable functional requirements.

Section 50.69 of 10 CFR does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, 10 CFR 50.69 enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significance (HSS), existing treatment requirements are maintained or potentially enhanced. On the other hand, for SSCs categorized as low safety significance (LSS) that do not significantly contribute to plant safety on an individual basis, the regulation allows an alternative risk-informed approach to treatment that provides a reasonable level of confidence that these SSCs will satisfy functional requirements. Implementation of 10 CFR 50.69 allows licensees to improve focus on equipment that has HSS, resulting in improved plant safety.

2.2 Licensee Proposed Changes The licensee proposed to amend the Palo Verde RFOLs by adding the following license condition that would allow for the implementation of 10 CFR 50.69:

APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

The NRC staff notes that in the last paragraph of the proposed license condition that was provided in the letter dated August 10, 2018, the licensee had misstated a date of May 8, 2018, for the first supplement. The correct date of the first supplement is May 9, 2018, and the license condition above reflects the corrected date.

2.3 Regulatory Review The NRC staff reviewed the licensee's application to determine whether (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) activities proposed will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or the health and safety of the public. The staff considered the following regulatory requirements and guidance during its review of the proposed changes.

Regulatory Requirements Section 50.69 of 10 CFR provides an alternative approach for establishing requirements for treatment of SSCs for nuclear power reactors using a risk-informed method of categorizing SSCs according to their safety significance. Specifically, for SSCs categorized as LSS, alternative treatment requirements may be implemented in accordance with the regulation. For SSCs determined to be of HSS, existing treatment requirements are maintained.

Paragraph 50.69(c) of 10 CFR requires licensees to use an integrated decisionmaking process to categorize safety-related and nonsafety-related SSCs according to the safety significance of the functions they perform into one of the following four RISC categories, which are defined in 10 CFR 50.69(a), as follows:

RISC-1: Safety-related SSCs that perform safety significant functions 1 RISC-2: Nonsafety-related SSCs that perform safety significant functions RISC-3: Safety-related SSCs that perform low safety significant functions 1 Nuclear Energy Institute (NEI) 00-04, Revision 0, "10 CFR 50.69 SSC Categorization Guideline" (Reference 5),

uses the term "high-safety-significant" to refer to SSCs that perform safety-significant functions. The NRC understands HSS to have the same meaning as "safety-significant" (i.e., SSCs that are categorized as RISC-1 or RISC-2), as used in 10 CFR 50.69.

RISC-4: Nonsafety-related SSCs that perform low safety significant functions The SSCs are classified as having either HSS functions (i.e., RISC-1 and RISC-2 categories) or LSS functions (i.e., RISC-3 and RISC-4 categories). For HSS SSCs, 10 CFR 50.69 maintains current regulatory requirements (i.e., it does not remove any requirements from these SSCs) for special treatment. For LSS SSCs, licensees can implement alternative treatment requirements in accordance with 10 CFR 50.69(b)(1) and 10 CFR 50.69(d). For RISC-3 SSCs, licensees can replace special treatment with an alternative treatment. For RISC-4 SSCs, 10 CFR 50.69 does not impose new treatment requirements, and RISC-4 SSCs are removed from the scope of any applicable special treatment requirements identified in 10 CFR 50.69(b )( 1).

Paragraph 50.69(c)(1) of 10 CFR states that SSCs must be categorized as RISC-1, RISC-2, RISC-3, or RISC-4 SSCs using a categorization process that determines if an SSC performs one or more safety-significant functions and identifies those functions. The process must:

(i) Consider results and insights from the plant-specific PRA. This PRA must at a minimum model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA must be of sufficient quality and level of detail to support the categorization process, and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

(ii) Determine SSC functional importance using an integrated, systematic process for addressing initiating events (internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design bases functions and functions credited for mitigation and prevention of severe accidents. All aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience.

(iii) Maintain defense-in-depth.

(iv) Include evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in core damage frequency (CDF) and large early release frequency {LERF) resulting from changes in treatment permitted by implementation of§§ 50.69{b)(1) and (d)(2) are small.

(v) Be performed for entire systems and structures, not for selected components within a system or structure.

Paragraph 50.69(c)(2) of 10 CFR states:

The SSCs must be categorized by an Integrated Decision-Making Panel (IDP) staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering, and system engineering.

Paragraph 50.69(b)(3) of 10 CFR states that the Commission will approve a licensee's implementation of this section by issuance of a license amendment if the Commission determines that the categorization process satisfies the requirements of 10 CFR 50.69(c). As stated in 10 CFR 50.69(b ), after the NRC approves an application for a license amendment, a licensee may voluntarily comply with 10 CFR 50.69 as an alternative to compliance with the following requirements for LSS SSCs: (i) 10 CFR Part 21, (ii) a portion of 10 CFR 50.46a(b),

(iii) 10 CFR 50.49, (iv) 10 CFR 50.55(e), (v) certain requirements of 10 CFR 50.55a, (vi) 10 CFR 50.65, except for paragraph (a)(4), (vii) 10 CFR 50.72, (viii) 10 CFR 50.73, (ix) Appendix B to 10 CFR Part 50, (x) certain containment leakage testing requirements, and (xi) certain requirements of Appendix A to 10 CFR Part 100.

Guidance Nuclear Energy Institute (NEI) 00-04, Revision 0, "10 CFR 50.69 SSC Categorization Guideline" (Reference 6), describes a process for determining the safety significance of SSCs and categorizing them into the four RISC categories defined in 10 CFR 50.69. This categorization process is an integrated decisionmaking process that incorporates risk and traditional engineering insights. Revision O of NEI 00-04 provides options for licensees implementing different approaches depending on the scope of their PRA models. It also allows the use of non-PRA approaches when PRAs have not been performed. The NEI 00-04 guidance identifies non-PRA approaches such as fire-induced vulnerability evaluation to address fire risk, seismic margin analysis (SMA) to address seismic risk, and guidance in Nuclear Management and Resource Council (NUMARC) 91-06, "Guidelines for Industry Actions to Assess Shutdown Management" (Reference 7), to address shutdown operations. As stated in Regulatory Guide (RG) 1.201, Revision 1, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance" (Reference 8), such non-PRA-type evaluations will result in more conservative categorization, in that special treatment requirements will not be allowed to be relaxed for SSCs that are relied upon in such evaluations.

The degree of relief that the NRC will accept under 10 CFR 50.69 (i.e., SSCs subject to relaxation of special treatment requirements) will be commensurate with the assurance provided by the evaluation.

Sections 2 through 10 of NEI 00-04, Revision 0, describe a method for meeting the requirements of 10 CFR 50.69, as follows:

• Sections 3.2 and 5.1 provide specific guidance corresponding to 10 CFR 50.69(c)(1 )(i).

• Sections 3, 4, 5, and 7 provide specific guidance corresponding to 10 CFR 50.69(c)(1 )(ii).

• Section 6 provides specific guidance corresponding to 10 CFR 50.69(c)(1 )(iii).

• Section 8 provides specific guidance corresponding to 10 CFR 50.69(c){1)(iv).

• Section 2 provides specific guidance corresponding to 10 CFR 50.69( c )( 1)(v).

• Sections 9 and 1O provide specific guidance corresponding to 10 CFR 50.69(c)(2).

Additionally, Section 11 of NEI 00-04, Revision 0, provides guidance on program documentation and change control related to the requirements of 10 CFR 50.69(e) and Section 12 of NEI 00-04

provides guidance on periodic review related to the requirements in 10 CFR 50.69(f).

Maintaining change control and periodic review provides confidence that all aspects of the program reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience, as required by 10 CFR 50.69(c)(1 )(ii).

Revision 1 of RG 1.201 endorses the categorization method described in NEI 00-04, Revision 0, with clarifications, limitations, and conditions. Revision 1 of RG 1.201 states that the applicant is expected to document, at a minimum, the technical adequacy of the internal initiating events PRA. Licensees may use either PRAs or alternative approaches for hazards other than internal initiating events. RG 1.201 clarifies that the NRC staff expects that licensees proposing to use non-PRA approaches in their categorization should provide a basis in the submittal for why the approach and the accompanying method employed to assign safety significance to SSCs is technically adequate. It further states that as part of the NRC's review and approval of a licensee's or applicant's application requesting to implement 10 CFR 50.69, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods used in the licensee's categorization approach. If a licensee or applicant wishes to change its categorization approach and the change is outside the bounds of the NRC's license condition (e.g., switch from a SMA to a seismic PRA (SPRA)), the licensee or applicant will need to seek NRC approval via a license amendment of the implementation of the new approach in its categorization process. The guidance in RG 1.201 also states that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by 10 CFR 50.69(c}(1 )(iv).

Revision 2 of RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" (Reference 9), describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light-water reactors. It endorses, with clarifications, the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard ASME/ANS RA-Sa-2009 (henceforth known as the "ASME/ANS 2009 Standard")

(Reference 10). This RG provides guidance for determining the technical adequacy of a PRA by comparing the PRA to the relevant parts of the ASME/ANS 2009 Standard using a peer review process. The guidance requires peer reviews for PRA upgrades. A PRA upgrade is defined in the ASME/ANS 2009 Standard as "the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences."

Revision 3 of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (Reference 11 ), provides guidance on the use of PRA findings and risk insights in support of changes to a plant's licensing basis.

This RG provides risk acceptance guidelines for evaluating the results of such evaluations.

3.0 TECHNICAL EVALUATION

3.1 Method of NRC Staff Review The NRC staff reviewed (1) the licensee's SSC categorization process against the categorization process described in NEI 00-04, Revision 0, and (2) the adequacy of the licensee's PRA quality for use in the application of 10 CFR 50.69. The NRC staff's review, as documented in this safety evaluation (SE), uses the framework provided in NEI 00-04, Revision 0.

3.2 Overview of the Categorization Process (NEI 00-04, Revision 0, Section 2)

Section 1.5 and Section 2 of NEI 00-04, Revision 0, provide an overview of the categorization process. RG 1.201, Revision 1, also states that the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12), is integral to providing reasonable confidence in the evaluations required by 10 CFR 50.69(c)(1)(iv) and that all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by 10 CFR 50.69(c)(1)(iv).

The licensee summarized the categorization process and described the steps performed at the component level and function level. The licensee further confirmed that each step of the categorization process is independent from each other; therefore, the preliminary categorization is not impacted by the sequence of these steps.

The licensee provided further discussion of specific elements within the SSC categorization process to assure the process, as delineated in the submittal, remains consistent with NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1, and therefore, is acceptable for meeting the categorization requirements set forth in 10 CFR 50.69. The licensee provided clarity on the following elements of the categorization process. A more detailed review of those specific elements in the categorization process is discussed in the applicable sections of this SE.

• Passive Characterization: Passive components are not modeled in the PRA.

Therefore, a different assessment method is used to assess the safety significance of these components, as described in Section 3.5.5 of this SE. This process addresses those components that have only a pressure-retaining function and the passive function of active components, such as the pressure/liquid-retention of the body of a motor-operated valve.

• Qualitative Characterization: System functions are qualitatively categorized as HSS or LSS based on the seven questions in Section 9.2 of NEI 00-04, Revision O (refer

• to Section 3.9 of this SE).

• Cumulative risk sensitivity study: For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of LSS components results in acceptably small increases to CDF and LERF and meets the acceptance guidelines of RG 1.174 (refer to Section 3.8 of this SE).

• Review by the IDP: The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components (refer to Section 3.9 of this SE).

The second proposed implementation item in the July 19, 2018, LAR (Reference 1), as required by the proposed license condition, states that APS will establish procedure(s) prior to the use of the categorization process on a plant system. The NRC staff evaluated the categorization elements and associated clarifications provided by the licensee. Therefore, the NRC staff finds that the licensee's process is consistent with all aspects of the process in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1, and upon incorporation of the categorization elements

and the associated clarifications into formal plant procedures, is acceptable for meeting the categorization requirements set forth in 10 CFR 50.69.

3.3 Assembly of Plant-Specific Inputs (NEI 00-04, Revision O, Section 3)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires licensees to determine SSC functional importance using an integrated, systematic process for addressing initiating events (i.e., internal and external), SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-basis functions and functions credited for mitigation and prevention of severe accidents. Section 4 of NEI 00-04, Revision 0, provides guidance for developing a systematic engineering assessment involving the identification and development of information necessary to perform the risk-informed categorization. The assessment includes the following elements: system selection and system boundary definition, identification of system functions, and a mapping of components to functions.

Section 4 of NEI 00-04, Revision 0, states that system selection and boundary definition include defining system boundaries where the system interfaces with other systems. The guidance in NEI 00-04 states that the next step is the identification of system functions, including design-basis and beyond-design-basis functions identified in the PRA, and that system functions should be consistent with the functions defined in design-basis documentation and maintenance rule functions. The guidance in NEI 00-04 states that the coarse mapping of components to functions involves the initial breakdown of system components into system functions they support. The licensee should then identify and document system components and equipment associated with each function.

Paragraph 50.69(c)(1 )(v) of 10 CFR requires that categorization be performed for entire systems and structures, not for selected components within a system or structure. In Section 3.1.1, "Overall Categorization Process," of the LAR (Reference 1), the licensee states, in part, that "APS will implement the risk categorization process in accordance with NEI 00-04, Revision 0 ... , as endorsed by Regulatory Guide (RG) 1.201, Revision 1.... " The second proposed implementation item in the July 19, 2018, LAR (Reference 1), as required by the license condition, states that APS will establish procedure( s) prior to the use of the categorization process on a plant system. The process described in the LAR is consistent with, and capable of, collecting and organizing information at the system level for defining boundaries, functions, and components. Therefore, the NRC staff finds that upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, 10 CFR 50.69(c)(1 )(v) will be satisfied for the 10 CFR 50.69 categorization process.

3.4 System Engineering Assessment (NEI 00-04, Revision 0, Section 4)

Paragraph 50.69(c)(1 )(ii) of 10 CFR requires, in part, that the functions to be identified and considered in the categorization process include design-basis functions and functions credited for mitigation and prevention of severe accidents. Revision O of NEI 00-04 includes guidance to identify all functions performed by each system and states that the IDP will categorize all system functions. All system functions include all functions involved in the prevention and mitigation of accidents and may include additional functions not credited as hazard mitigating functions, depending on the system. The guidance in NEI 00-04 also includes consideration of interfacing functions.

Section 2.2, "Reason for Proposed Change," of the LAR states that, "[t]he safety functions [in the categorization process] include the design basis functions, as well as functions credited for severe accidents (including external events)." Section 3.1.1 of the LAR summarizes the different hazards and plant states for which functional and risk significant information will be collected. In LAR Section 3.1.1, the licensee confirmed that the SSC categorization process documentation will include, among other items, system functions (identified and categorized with the associated bases) and mapping of components to support function(s). Therefore, the NRC staff finds that the process described in the LAR is consistent with NEI 00-04, Revision 0, as endorsed by the NRC in RG 1.201, Revision 1, and upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, is acceptable for meeting the categorization requirements set forth in 10 CFR 50.69( c )( 1)(ii).

3.5 Component Safety Significance Assessment (NEI 00-04, Revision 0, Section 5)

This step in the licensee's categorization process assesses the safety significance of components using quantitative or qualitative risk information from a modeled PRA hazard and/or other non-PRA method(s). In the NEI 00-04 guidance, component risk significance is assessed separately for five hazard groups:

• Internal events

• Fire events

• Seismic events

• Other external events (e.g., tornadoes, external floods)

• Shutdown events Paragraph 50.69(c)(1)(i) of 10 CFR requires, in part, the use of PRA to assess risk from internal events as a minimum. The paragraph further specifies that the PRA used in the categorization process must be of sufficient quality and level of detail and subject to an acceptable peer review process. For the hazards other than internal events, including fire, seismic, other external hazards (e.g., high winds, external floods), and shutdown, 10 CFR 50.69(b)(2) allows, and the NEI 00-04 guidance summarizes, the use of PRA if such PRA models exist, or, in the absence of quantifiable PRA, the use of other methods (e.g., fire-induced vulnerability evaluation, SMA, individual plant examination of external events (IPEEE) screening, and shutdown safety management plan).

In Sections 3.1.1 and 3.2.1 through 3.2.3 of the LAR, the licensee explains that the categorization process uses PRA-modeled hazards to assess risks for internal events (including internal flooding), fire, and seismic events. For the other two risk hazard groups, the licensee's process uses non-PRA methods for the risk characterization, as follows:

• IPEEE screening to assess the risk from other external hazards (e.g., tornados, external floods)

• Shutdown safety management plan, as described in NUMARC 91-06, to assess shutdown risk The methods used by the licensee to assess internal and external hazards are consistent with the methods included in the NEI 00-04 guidance, as endorsed by RG 1.201, Revision 1, and therefore, are acceptable to the NRC staff. The NEI 00-04 guidance considers the results and insights from the plant-specific PRA, as required by 10 CFR 50.69(c)(1)(i), and non-PRA risk

characterization, as required by 10 CFR 50.69(c)(1 )(ii). The PRAs must, at a minimum, model severe accident scenarios resulting from internal initiating events occurring at full power operation. The PRA must be of sufficient quality and level of detail to support the categorization process, and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

The NRC staff's review of the modeled PRA hazards and non-PRA methods for acceptability is provided in the following SE subsections: PRA-modeled hazards in Subsections 3.5.1 and 3.5.2, and the non-PRA methods in Subsections 3.5.3 and 3.5.4.

3.5.1 Evaluation of PRA Acceptability to Support the Categorization Process As discussed in Section 3.5 above, consistent with Section 5 of NEI 00-04, Revision 0, the component safety significance assessment must include the hazard groups: ( 1) internal events, (2) fire events, (3) seismic events, (4) other external events (e.g., tornados, external floods}, and (5) shutdown events.

3.5.1.1 Scope of PRA The licensee's PRA is comprised of an at-power, Level 1 CDF and LERF for (1) an internal events PRA (including internal flooding) (IEPRA), (2) a fire PRA (FPRA), and (3) an SPRA. For other external events (e.g., tornados, external floods), the licensee provided a summary of the screening results, and a summary of the progressive screening approach to be used for addressing external hazards in future SSC categorizations.

The licensee stated that its PRA models have been assessed against RG 1.200, Revision 2, and are consistent with NRC Regulatory Issue Summary (RIS) 2007-06, "Regulatory Guide 1.200 Implementation" (Reference 12). For the external hazards., the licensee also stated that a full scope external hazards screening peer review was performed in accordance with RG 1.200, Revision 2.

3.5.1.2 IEPRA In the LAR, the licensee stated that the IEPRA model was peer reviewed in July 1999 by the Combustion Engineering Owners Group (CEOG) prior to issuance of RG 1.200. The licensee further stated that a full-scope peer review of the internal flooding PRA (IFPRA) model was conducted in November 2010 in accordance with RG 1.200, Revision 2. In addition, the licensee stated in the LAR that a self-assessment of the IEPRA was performed in accordance with Appendix B of RG 1.200, Revision 2.

RG 1.200, Revision 2, states, in part, that, "[i]f different criteria are used than those in the established standard, then it needs to be demonstrated that these different criteria are consistent with the established standards, as endorsed by the NRC." In RAI 01.b, the NRC staff requested that the licensee clarify how the 1999 peer review was assessed against the current version of the ASME/ANS 2009 Standard, as qualified by RG 1.200, Revision 2, the licensee stated, in part, the following:

A self-assessment of the IEPRA model was completed by APS in March 2011 to assess the gaps between the CEOG peer review results and the current version of the ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. The self-assessment reviewed all IEPRA [supporting requirements] in the

ASME/ANS RA-Sa-2009 and RG 1.200, Revision 2, guidance to Capability Category 11.

Section 3.3, "PRA Review Process Results [10 CFR 50.69(b)(2)(iii)]," of the LAR states, in part, that "[a]II PRA upgrades (as defined by the ASME PRA Standard RA-Sa-2009 ... ) implemented since conduct of the CEOG peer review in 1999 have been peer reviewed." The NRC staff recognized there were a number of PRA changes since the last full-scope peer review of the IEPRA in 1999, including changes to resolve fact and observation (F&Os) findings.

Accordingly, in RAI 09.a through d, the NRC staff requested: (1) description of the modeling changes since the 1999 peer review; (2) indication for each modeling change of whether the change was determined to be PRA maintenance or a PRA upgrade, along with justification for the determination based on guidance in the ASME/ANS 2009 Standard; and (3) discussion of the focused-scope peer reviews performed for PRA upgrades and confirmation that any finding-level F&Os resulting from these focused-scope peer reviews were included in the June 2017 F&O closure review.

In response to RAI 09.a, the licensee stated that all changes made to the IEPRA since 1999 have been documented in a plant-specific engineering evaluation. In Attachment 2, Table 2-1, of the May 9, 2018, response, the licensee provided a listing of the significant changes made to the IEPRA model along with the basis for determining whether the change was PRA maintenance or a PRA upgrade. The licensee identified four IEPRA changes determined to be upgrades and confirmed that one of the upgrades was the subject of a focused-scope peer review performed during the June 2017 F&O closure review in which no additional F&Os were identified. The license also identified one IFPRA change that was determined to be aPRA upgrade and had not yet received a focused-scope peer review. A more detailed review of the Appendix X, Independent Assessment of NEI 05-04/07-12/12-[13], "Final Revision of Appendix X to NEI 05-04/07-12/12- [13], Close-Out of Facts and Observations" (Reference 13) for F&O closure is provided in Section 3.5.1.6 of this SE.

In response to RAI 06, the licensee proposed a license condition, which includes Implementation Item No. 2 to conduct a focused-scope peer review on the three IEPRA model changes that were identified as PRA upgrades and provided in Table 2-4 of the response dated May 9, 2018. Refer to Section 4.0 of this SE for a discussion on the change to the licensee's RFOLs for the proposed license condition. These IEPRA upgrades encompass PRA methodology changes from (1) multiple Greek letter to the alpha factor for CCF modeling, (2) systematic human action reliability procedure to the Electric Power Research Institute (EPRI) calculator for human reliability analysis modeling, and (3) incorporation of new pressure-induced steam generator tube rupture for accident sequences development. A more detailed review of the Appendix X, Independent Assessment for F&O closure is provided in Section 3.5.1.6 of this SE.

Also, for Implementation Item No. 2, the licensee committed to conducting a focused-scope peer review on the IFPRA model for the PRA changes that were confirmed to be a PRA upgrade and provided in Table 2-5 in the supplement dated May 9, 2018. These IFPRA upgrades consist of ( 1) updating the pipe rupture frequency value( s ), (2) incorporation of realistic flow rates to determine time dependent flood levels, (3) incorporation of flood isolation actions, and (4) incorporation of a plant modification that increased pipe length.

The NRC staff reviewed the remaining open F&Os from the peer reviews performed on the IEPRA and IFPRA provided in Section 3.2.1 of the LAR that were determined by the F&O

closure review team in June 2017 not to be met at Capability Category (CC) II against the ASME/ANS 2009 Standard. In Attachment 3 of the LAR, the licensee dispositioned each open IEPRA and IFPRA F&O. In the dispositions for IEPRA and IFPRA F&Os, the licensee stated that, for each F&O, the closure review team recommendations will be addressed or implemented and that "[t]hese [PRA] changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to categorization." As discussed above, and in Section 4.0 of this SE, the licensee proposed a license condition that includes Implementation Item No. 2 to address the changes that have been subsequently determined to be PRA upgrades consistent with the ASME/ANS 2009 Standard and have not received a peer review. Further, the license condition includes Implementation Item No. 3, which has APS revise the PRA models and incorporate resolutions to all open F&O findings prior to implementation of the SSC categorization process.

The NRC staff reviewed the proposed license condition and Implementation Items Nos. 2 and 3 (Reference 2) and finds that the identified errors and weaknesses in the IEPRA will be resolved prior to implementation of the 10 CFR 50.69 categorization process with the completion of Implementation Items Nos. 2 and 3 (discussed in Section 3.5.6 of this SE). Therefore, the NRC staff concludes that the IEPRA, with the completion of the proposed Implementation Items Nos. 2 and 3 (Reference 2), meets the requirement in 10 CFR. 50.69(c)(1)(i).

3.5.1.3 FPRA The licensee's FPRA was subject to a full-scope industry peer review in December 2012, consistent with RG 1.200, Revision 2. In December 2014, a focused-scope peer review was performed to address ASME/ANS 2009 Standard supporting requirements (SRs) that were not met at CC II during the 2012 peer review. In Section 3.3 of the LAR, the licensee stated that the focused-scope peer review generated new F&Os that replaced the finding-level F&Os from the 2012 peer review in their entirety.

The finding-level F&Os from the 2014 focused-scope peer review were considered fully resolved by the F&O closure review team in June 2017. Therefore, in accordance with RG 1.200, Revision 2, no F&Os associated with the FPRA were provided in Attachment 3 of the LAR.

Accordingly, in RAI 09.d concerning FPRA modeling changes, the NRC staff requested: (1) a description of the modeling changes since the last full-scope peer review; (2) discussion on whether the changes were determined to be PRA maintenance or a PRA upgrade, and justification for the determination using guidance in the ASME/ANS 2009 Standard; and (3) discussion of focused-scope peer reviews performed for PRA upgrades and confirmation that any finding-level F&Os resulting from these focused-scope peer reviews were included in the June 2017 F&O closure review. In response to RAI 09.d, the licensee provided a list of six changes made to the FPRA along with the bases for determining whether the change was considered PRA maintenance or a PRA upgrade. The licensee determined that the changes were upgrades and were subject to a focused-scope peer review conducted between December 2014 and January 2015.

For the upgrades reviewed during the 2014 focused-scope peer review of the FPRA, three F&Os (i.e., QLS-A1-01, PRM-A3-01, and FSS-D2-01) were generated. As discussed above, the licensee confirmed that the upgrades were reviewed during the 2014 focused-scope peer review and the resolution of the F&Os was included in the 2017 F&O closure review.

To address the remaining open F&Os and SRs identified from the focused-scope peer review that were not considered in the scope of the 2017 F&O closure review as a part of Implementation Item 1, the licensee stated that the F&Os will be verified closed and SRs CS-C4 and ES-83 will be reviewed as part of the augmented F&O closure review. In Section 4.0 of this SE, the licensee proposed a license condition that includes Implementation Item No. 1.

Section 3.2.2, "Fire Hazards," of the LAR states, in part, "the Internal Fire PRA model was developed consistent with NUREG/CR-6850 [(Reference 14)] and only utilizes NRC approved methods." Since the last full-scope peer review of the licensee's FPRA, there have been a number of changes to NRG-accepted fire methods and studies, as described below, whose integration into the licensee's FPRA could potentially impact the 10 CFR 50.69 risk categorization results and/or risk acceptance guidelines for total CDF and total LERF.

• NRC letter, "Recent Fire PRA Methods Review Panel Decisions and EPRI 1022993, Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires," dated June 21, 2012 (Reference 15), provides NRC staff positions on (1) frequencies for cable fires initiated by welding and cutting, (2) clarifications for transient fires, (3) alignment factor for pump oil fires, ( 4) electrical cabinet fire treatment refinement details, and (5) EPRI 1022993 report.

• NUREG/CR-7150, "Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE)," Volume 2, "Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure" (Reference 16), which is supported by a letter from the NRC to NEI, titled "Supplemental Interim Technical Guidance on Fire-Induced Circuit Failure Mode Likelihood Analysis" (Reference 17).

• NUREG-2169, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database: United States Fire Event Experience Through 2009" (Reference 18).

Section 2.5.5 of RG 1.174 provides guidance that indicates additional analysis is necessary to ensure that contributions from the above influences would not change the conclusions of the LAR. Accordingly, the NRC staff requested explanation for how the cited guidance would be incorporated into the FPRA prior to implementation of the 10 CFR 50.69 program, or justification for not incorporating the above fire methodologies. In response to RAI 21, the licensee described how its FPRA is consistent with Section 2.5.5 of RG 1.174. The licensee referred to the letter dated June 21, 2012, that provided the NRC staff positions on four methods used to analyze fire risk contribution reviewed by the FPRA Methods Review Panel and EPRI Report 1022993.

The licensee confirmed that the methodology for an electrical cabinet fire treatment refinement submitted by NEI in a letter dated June 5, 2012 (Reference 19), was not adopted into the FPRA model. The licensee also confirmed that EPRI Report 1022993 was not adopted in the FPRA model. The licensee clarified that for the transient heat release rates provided in NUREG/CR-6850, Appendix G, Table G-1 2 , both methodologies were incorporated into the FPRA prior to the full-scope peer review in December 2012 or the focused-scope peer review in December 2014. For the remaining FPRA methods involving NUREG-2169 and alignment 2 Clarified in NEI letter, "Recent Fire PRA Methods Review Panel Decisions: Clarification for Transient Fires and Alignment Factor for Pump Oil Fires" (Reference 20), and endorsed by the NRC in the letter dated June 21, 2012, and NUREG/CR-7150.

factor for pump oil fires, also discussed in the letter dated June 21, 2012, the licensee stated that further refinements and updates will be incorporated into the FPRA model to address NRC staff positions prior to implementation of the 10 CFR 50.69 program. Section 4.0 of this SE discusses the proposed license condition that includes Implementation Item No. 3 that incorporates resolutions to all open F&O findings and FPRA guidance more recently endorsed by the NRC.

In addition to addressing the NRC staff positions above on FPRA methods, the licensee provided further assessment of several frequently asked questions and stated that APS plans to complete the following actions prior to implementation of the 10 CFR 50.69 program. To address the planned updates to the FPRA model in Implementation Item No. 3, APS committed to revising the PRA models to incorporate resolutions to all open F&Os findings and PRA guidance more recently endorsed by the NRC. Implementation Item No. 3 also ensures that after the PRA changes are incorporated, the total CDF and total LERF are below the limits established in RG 1.174. The NRC staff performed a more detailed review of the PRA maintenance and update process used to facilitate such changes to the PRA in Section 3.10 of this SE.

The NRC staff has reviewed the peer review results and the licensee's resolution of the results and finds that the quality and level of detail of the FPRA is sufficient to support the categorization of SSCs as required by 10 CFR 50.69(b)(2)(ii) and that the FPRA uses the process endorsed by the NRC staff in RG 1.201. Additionally, the NRC staff finds that the identified errors and weaknesses in the IEPRA will be resolved prior to implementation of the 10 CFR 50.69 categorization process with the completion of Implementation Items Nos. 2 and 3 (discussed in Section 3.5.6 of this SE). Therefore, the NRC staff concludes that the IEPRA, with the completion of the proposed Implementation Items Nos. 2 and 3 (Reference 2), as required by the proposed license condition, meets the requirement in 10 CFR 50.69(c)(1)(i).

3.5.1.4 SPRA The NRC staff reviewed the results of the peer review of the SPRA model and associated F&O closure review described in Section 3.2.3, Section 3.3, and Attachment 3 of the LAR. The licensee's SPRA was subject to a full-scope industry peer review in February 2013 against RG 1.200, Revision 2. The licensee stated that the SPRA peer review process was performed in accordance with NEI 12-13, "External Hazards PRA Peer Review Process Guidelines" (Reference 21 ). In RAI 02, the NRC staff requested that the licensee provide additional information to justify the use of NEI 12-13, which was not endorsed in RG 1.200, Revision 2, or accepted by the NRC staff at that time, 3 by addressing the NRC's comments issued in 2012 (Reference 23).

In response to RAI 02.a, the licensee provided a description of the approach used to ensure that the qualifications of the SPRA peer-review team met the corresponding requirements in the ASME/ANS 2009 Standard as endorsed in RG 1.200, Revision 2. The licensee stated that the peer review team met the experience expectations of the ASME/ANS 2009 Standard, Part 5, Section 5-3, "Peer Review for Seismic Events At-Power," and was fully compliant with 3 By letter dated March 7, 2018 (Reference 22), the NRC staff accepted the use of NEI 12-13, Revision 0, as modified by the NRC staffs comments, while the review of this LAR was ongoing. The letter states that the NRC staffs comments in the letter supersede the NRC staffs comments provided in a letter dated November 16, 2012 (Reference 23). The NRC staffs review of the licensee's responses to the requests for additional information, addresses the comments in the letter dated March 7, 2018. Therefore, the letter dated March 7, 2018, does not change the NRC staffs conclusions in this SE.

ASME/ANS 2009 Standard, Section 1-6.2, "Peer Review Team Composition and Personnel Qualifications." Because the licensee confirmed that the peer-review team met the

• requirements in the ASME/ANS 2009 Standard, the NRC staff finds that the SPRA peer-review team had the appropriate qualifications to review the SPRA used to support this application.

Unreviewed analysis methods (UAMs) are a specific type of F&Os assigned by peer reviewers and are defined in Section 3.2 of NEI 12-13. One of the NRC staff's comments on NEI 12-13, provided in the letter dated November 16, 2012, stated that "licensees that use UAMs for external hazards need to identify the UAMs in risk-informed applications to the NRC so that the NRC staff can evaluate the acceptability of these new methods in the context of their applications." In response to RAI 02.b, the licensee stated that the SPRA peer-review team did not identify any UAMs in the licensee's SPRA. Therefore, further details regarding any UAM and a corresponding NRC staff review for this application are unnecessary. The NRC staff finds that the licensee appropriately addresses the issue of UAMs in the SPRA for this application.

In response to RAI 02.c, the licensee stated that there was no need to use expert judgement outside of the PRA analysis team to meet any SR. Therefore, the NRC staff finds that the licensee addressed the use of expert judgement in its SPRA for this application.

In RAI 02.d, the NRC staff requested identification and justification of any SPRA SRs that were determined to only meet PRA Standard CC-I. In response to RAI 02.d, the licensee stated that a finding was written for any SR receiving a CC-I. The licensee further explained that finding-level F&Os SHA-E1-01 and SHA-E2-01 were written against SRs SHA-E1 and SHA-E2 because the SPRA was determined to only meet these SRs at CC-I. Dispositions of F&Os SHA-E1-01 and SHA-E2-01 for this application are discussed in more detail in Section 3.5.1.4.1 below. Because the licensee had a peer-review for all SRs against CC-II of the ASME/ANS 2009 Standard, the NRC staff finds that the licensee's SPRA was reviewed to the appropriate CC level (i.e., CC-II) for this application.

The NRC staffs comments on NEI 12-13 in the letter dated November 16, 2012, included specific expectations related to an in-process peer-review. In response to RAI 02.e, the licensee stated that an "in-process" peer review of the SPRA was not performed and a final full scope peer review was performed to judge the technical acceptability of the SPRA model.

Because an "in-process" review approach was not followed, the NRC staff does not need to review the details and process followed for the "in-process" reviews for the licensee's SPRA used to support this application.

Based on the NRC staff findings that the peer review guidance in NEI 12-13 was used and that the licensee addressed the NRC staff's comments on NEI 12-13, the NRC staff concludes that the licensee appropriately implemented the peer review process in the context of the SPRA used to support this application.

3.5.1.4.1 Evaluation of SPRA Peer-Review Findings The NRC staff's review and evaluation of the licensee's disposition of SPRA finding-level F&Os closure items that were not fully closed, and other considerations related to the three technical elements of the SPRA (i.e., seismic hazard, seismic fragility, and seismic plant response), are provided below.

Seismic Hazard In Section 3.2.6, "PRA Maintenance and Updates," of the LAR, the licensee stated that its risk management process ensures that the SPRA model continues to reflect the as-built and as-operated plant. The NRC staff requested in RAI 04 that the licensee clarify the process or approach that will be used to identify and determine the need to incorporate new information into the seismic hazard evaluation and to propagate the updated site-specific hazard information throughout the SPRA model that could affect the application. In its response to RAI 04, the licensee stated that procedures document the configuration control process and delineate how the licensee will update and maintain its PRA model. Specifically, the licensee stated it will conduct monthly reviews of new or revised plant documents to identify impacts that would require a change to the PRA model. In addition, changes in PRA methods, as documented in various industry reports, will be reviewed to identify impacts at least once every two refueling outages. The licensee further stated that updates to the seismic hazard evaluation will rely on industry guidance and common practices to determine the need to incorporate new information into hazard results. Once a need is identified, the update will follow the configuration control process of identifying the impacted model, providing a change description, assigning a priority, modifying the model, and updating the applications and necessary documents. Lastly, the licensee stated it will participate in industry groups related to external hazards information, which can be used by the design civil and PRA groups at the site to inform evaluations and decisions affecting plant design, operation, and maintenance.

The NRC staff finds that the licensee's processes ensure the Palo Verde SPRA models used for this application will continue to reflect the as-built and as-operated plant and will incorporate any new information into the seismic hazard evaluation that could impact the categorization results.

The NRC staff performed a more detailed review of APS PRA maintenance and update process used to facilitate such changes to the PRA, consistent with 10 CFR 50.69(e) and 10 CFR 50.69(f), as discussed in Section 3.10 of this SE.

The licensee stated that the current version of the SPRA relies on seismic hazard curves developed using a Senior Seismic Hazard Analysis Committee Level 1 study performed prior to the most recent seismic study of the Palo Verde site. Peer review finding SHA-E2-01 notes that seismic hazard curves from the previous study may not be appropriate for the seismic risk quantification at Palo Verde in light of the most recently evaluated site hazard. In RAI 08, the NRC staff requested a comparison of the two sets of seismic hazard curves. In addition, the NRC staff requested that the licensee provide a description of how fragility analyses will be updated to reflect the updated seismic hazard results. In response to RAI 08, the licensee provided a comparison of the 2013 and 2015 uniform hazard response spectra and a comparison of the peak ground acceleration mean seismic hazard curves. At the low frequency range (i.e., lower than 2 hertz), the updated response spectra is lower than currently used in determining fragilities. In addition, the licensee stated that the updated seismic hazard curves are being incorporated into the SPRA through the licensee's update process. Because the licensee will incorporate its 2015 seismic hazard curves into its SPRA using its update process and will use the F&O closure process to close out the finding prior to implementation of the program (consistent with Implementation Item No. 3 (Reference 2) that is required by the proposed license condition), the NRC staff concludes that the implementation of the license condition will address F&O SHA-E2-01 for this application. A more detailed discussion of the proposed license condition is provided in Section 4.0 of this SE.

In RAI 09 concerning PRA modeling changes for the SPRA, the NRC staff requested:

(1) description of the modeling changes since the last full peer review; (2) indication for each

modeling change of whether the change was determined to be PRA maintenance or a PRA upgrade, and justification for the determination using guidance in the ASME/ANS 2009 Standard; and (3) discussion of focused-scope peer reviews performed for PRA upgrades and confirmation that any finding-level F&Os from these focused-scope peer reviews were included in the June 2017 F&O closure review. In response to RAI 09, the licensee listed one change made to the SPRA (related to SHA-E1-01 ), along with the basis for determining the change to be a PRA upgrade. The licensee further stated that a concurrent focused-scope peer review was performed, in part, for F&O SHA-E1-01, and the F&O was closed by the June 2017 F&O closure review. The NRC staff finds that the licensee evaluated changes in SPRA to determine whether those changes constituted PRA upgrades and addressed those changes using processes accepted by the NRC.

Seismic Fragility In Attachment 3 of the LAR, finding-level F&O SFR-F3-01, related to fragility evaluation of relays, included several resolution recommendations by the closure review team, which are, in part: (1) justify the use of the Best Estimate (BE) in-structure response spectra (ISRS) as the median, opining that the soil-structure interaction (SSI) analysis using BE soil properties, BE structure stiffness, and a conservative estimate of BE structure damping results in an 84th percentile response; (2) explain the rationale that uncertainty associated with SSI (obtained using BE, upper bound and lower bound envelope as the 84th percentile and the BE alone as the median, results in a wide range of combined uncertainty from 0.09 to 0.22 for the same building (Control Building); and (3) explain why uncertainties associated with structure stiffness, damping, time history simulation, and earthquake component combination are ignored in the separation of variables (SOV) calculation. These recommendations appeared to suggest that the seismic demand (ISRS) input used in the relay fragility evaluation may not be an appropriate median-centered response, and all important uncertainties may not have been included in the SOV calculations such that the fragilities are reasonably realistic, which may affect the SPRA results used in the categorization process. Therefore, the NRC staff requested in RAI 07 that the licensee provide technical rationale and justification for addressing the closure review team recommendations.

In response to RAI 07, the licensee stated that F&O SFR-F3-01 has been addressed per the recommendation provided by the F&O closure panel. The licensee further stated that the completed resolutions will be evaluated prior to implementation of 10 CFR 50.69 categorization in accordance with Implementation Item No. 3 in Table 1-1 of the LAR, and the proposed license condition using the F&O closure and PRA update processes. The licensee also described its technical rationale in response to the three recommendations by the closure team.

The licensee stated that Palo Verde is built on deep soil columns and the use of BE ISRS is an appropriate median input to the fragility analysis because (a) the building response is dominated by low-frequency soil-structure modes for which seismic demand is not sensitive to structural damping; and (b) soil stiffness variability (which was accounted in the SSI analyses) dominates overall variability in response over variability in structure stiffness and structure damping, and the SSI analyses were determined to be stable. The licensee further noted that the variation in SSI uncertainty parameters for components in the same building is justified since the components are located at different elevations in the building and uncertainty was directly computed by the location-specific component response. Finally, the licensee stated that the SOV calculations were updated to account for important uncertainties associated with structure stiffness and damping, as well as time history simulation based on sensitivity studies.

The NRC staff finds the licensee's rationale for addressing aspects of the closure team's recommendations to be acceptable for this application because the seismic response is dominated by variability in soil properties over structure stiffness and damping at the Palo Verde site, and the SOV calculations were updated to account for important uncertainties based on sensitivity studies. Because the licensee will use the F&O closure process to close out F&O SFR-F3-01 prior to implementation of the program (consistent with Implementation Item No. 3 (Reference 2) that is required by the proposed license condition), the NRC staff concludes that the implementation of the license condition will address F&O SHA-F3-01 for this application. A more detailed discussion of the license condition is provided in Section 4.0 of this SE.

Seismic Plant Response In RAI 03, the NRC staff requested information about (1) the version of the IEPRA that was used as the foundation of the SPRA, (2) finding-level internal event F&Os that could impact the SPRA, and (3) IEPRA upgrades that had not been peer reviewed prior to development of the SPRA. In response to RAI 03, the licensee stated that the version of the IEPRA used as the foundation for the SPRA, reflected the current as-built and as-operated plant and met the technical acceptability requirements as discussed in detail in prior sections of this SE. The licensee further stated that the four findings identified in the March 2011 self-assessment of the IEPRA associated with SRs not met at CC-II, were included in the June 2017 F&O closure review. In response to RAI 03.c, the licensee explained that three internal events modeling changes that were identified as upgrades after the IEPRA was used as the basis to construct the internal flooding, fire, and SPRA models. The licensee committed in Implementation Item No. 2 to conduct a focused-scope peer review on the three IEPRA model changes that were identified as PRA upgrades. Because the licensee demonstrated that the internal events findings and their resolutions will be dispositioned in the IEPRA, which is the backbone of the integrated One-Top Multi-Hazard model, the NRC staff finds that the licensee has established the technical acceptability of its IEPRA model for use as the foundation for its SPRA in the context of this application.

3.5.1.5 Assessment of Assumptions and Approximation RG 1.200, Revision 2, Section 3.3.2, "Assessment of Assumptions and Approximations" (Reference 9), provides guidance that states, in part, For each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Furthermore, NEI 00-04, Revision 0, Section 3.3, "Characterization of the Adequacy of Risk Information" (Reference 6), states in part, Peer review findings are a significant part of justifying the adequacy of the PRA results. All significant peer review findings will be reviewed and dispositioned by either:

• Incorporating appropriate changes into the PRA model prior to use,

• Identifying appropriate sensitivity studies to address the issue identified, or

• Providing adequate justification for the original model, including the applicability of key assumptions to the categorization process.

In Section 3.2.7, "PRA Uncertainty Evaluations," of the LAR (Reference 1), the licensee stated, in part, Key [Palo Verde] PRA model specific assumptions and sources of uncertainty for this application were evaluated and documented. These key assumptions and sources of uncertainty reviewed were previously submitted to the NRC in the application dated July 31, 2015 [Reference 24] for risk-informed completion times.

Regarding these key assumptions and sources of uncertainty in relation to this LAR, the licensee further stated, in part, The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of [risk categorization of SSCs]. If the [Palo Verde] PRA model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on [risk categorization]. Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application.

In Attachment 5, Table 5-1, of the supplement dated May 9, 2018 (Reference 2), the licensee identified the key assumptions and sources of uncertainty for the IEPRA (including internal flooding) and FPRA, and provided a disposition for each with respect to the SSC categorization process. The licensee stated that the evaluations concluded that no additional sensitivity analyses are required, with one exception. The one exception is that a sensitivity study is needed to address the risk increase associated with start-up transformer maintenance for the 13.8 kilovolt (kV) non-Class 1E power system and 4.16 kV non-Class 1E power system by increasing the unavailability of the fast bus transfer failure probability by a factor of 3. A more detailed review of the sensitivity analysis to address the identified key assumptions and sources of uncertainty is documented in Section 3.8 of this SE.

For the SPRA, in RAI 10.a-b, the NRC staff requested the licensee describe the approach used to identify the key assumptions and sources of uncertainty, specify if all aspects of the models (e.g., hazard, fragility, and plant response analysis for the SPRA) were evaluated, the criteria used (e.g., guidance, consensus approach) and to identify all key assumptions and sources of uncertainty identified from the evaluation performed. In response to RAI 10.a.i-ii, the licensee described the key assumptions and sources of SPRA uncertainty and stated that no deviations were made from industry consensus methods. The license described the approach used to identify the key assumptions consistent with the guidance in RG 1.174, Revision 2; RG 1.200; and NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking" (Reference 25). In addition, the licensee described the key assumptions and key sources of uncertainty and delineated how each was dispositioned for this application.

RG 1.200, Revision 2, Table A-1, "Staff Position on ASME/ANS RA-Sa-2009 Part 1, General Requirements for an At-Power Level 1 and LERF PRA," provides the NRC staff clarification of Section 1-6.1 of the ASME/ANS 2009 Standard and states, in part, "[t]herefore, the peer review shall also assess the appropriateness of the assumptions." In addition, NUREG-1855,

Revision 1, states in part, "Regulatory Guide (RG) 1.200 [NRC, 2009] and the PRA consensus standard published by ASME and the American Nuclear Society (ANS) [ASME/ANS, 2009] each recognize the importance of identifying and understanding uncertainties as part of the process of achieving acceptability in a PRA, and these references provide guidance on this subject."

The ASME/ANS 2009 Standard has SRs (e.g., QU-ES, QU-E2, QU-E3, QU-E4) to assess the identification of the assumptions and sources of uncertainty, provide basis for the identified assumptions and sources of uncertainty, and address the impact to the PRA model. The NRC staff reviewed the F&Os and did not identify any remaining open F&Os associated with these SRs.

Based on its review, the NRC staff finds the key assumptions and sources of uncertainty provided by the licensee for the SPRA, IEPRA (including internal floods), and FPRA in , Table 3-1, and Attachment 5, Table 5-1 of the supplement dated May 9, 2018, are consistent with RG 1.200, Revision 2, and appropriate when addressed for performing SSC categorization consistent with NEI 00-04, Revision O as endorsed in RG 1.201, Revision 1.

Therefore, the NRC staff concludes that the licensee meets the requirements in 10 CFR 50.69(d)(1 ).

3.5.1.6 Appendix X, Independent Assessment Process for F&O Closure Appendix X to NEI 05-04/07-12/12-[13] states, in part, "[o]nce an F&O is closed out, the utility is not required to present and explain them in peer reviews, NRC submittals or other requests excluding NRC audits." In a letter dated May 3, 2017, the NRC staff accepted, with conditions, Appendix X to NEI 05-04/07-12/12-13 governing the process for close-outs of F&Os (Reference 26). In the letter the NRC staff states in part, "[t]he NRC also intends to periodically conduct audits of a licensee's implementation of the Appendix X F&O closure process, as well as review a sampling of the final independent assessment team reports."

In the supplement dated May 9, 2018, the licensee stated, in part, the following:

The self-assessment of the internal events PRA (IEPRA) ... was performed in March 2011 against the requirements in ASME/ANS RA-Sa-2009 and NRC clarifications in RG 1.200, Revision 2, Appendix A. The self-assessment identified four supporting requirements (SRs) as not met to Capability Category (CC) II: IE-A8, SY-A4, SY-C1, and SY-C2. The F&O closure review in June 2017 included a review of the issues associated with the four not met SRs from the self-assessment.. ..

To further assess the scope of F&Os that were addressed by the independent assessment team in June 2017, the NRC staff requested the licensee confirm whether the scope of the F&O closure review included all finding-level F&O resolutions, including those finding-level F&Os associated with meeting the SRs at CC-II. In response to RAI 05.d, the licensee stated that the F&O closure review scope included all finding-level F&Os associated with not meeting CC-II for the IEPRA, IFPRA, FPRA, and SPRA models. The findings associated with meeting CC-II were not included in the scope of the F&O closure review. In Attachment 1 of the supplement dated May 9, 2018, Implementation Item No. 1 states that APS will conduct an augmented F&O closure review to include a review of F&O findings from prior peer reviews associated with SRs meeting CC-II of the ASME/ANS 2009 Standard, as endorsed by RG 1.200, Revision 2. The NRC staff performed a detailed review of the remaining open F&Os in Sections 3.5.1.2 through 3.5.1.4 of this SE for IEPRA (including internal flooding), FPRA, and SPRA models.

Paragraph 50.69(b)(4)(c)(i) of 10 CFR states, in part, "[t]he PRA must be of sufficient quality and level of detail to support the categorization process, and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC."

Regarding how the closure of the F&Os was assessed, to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements associated with the closed F&Os, now meet ASME/ANS 2009 Standard at CC-II, the licensee stated that the June 2017 F&O closure technical review team assessed the closure of each F&O against CC-II. In addition, the licensee discussed the criteria used by the closure review team for review of the F&Os generated from the 1999 peer review against the current and endorsed PRA standard. The NRC staff finds that the F&O closure review team appropriately assessed the 1999 F&Os against the ASME/ANS 2009 Standard and CC-II. A more detailed review of the PRA acceptability for the IEPRA, FPRA, and SPRA is provided above in Sections 3.5.1.2 through 3.5.1.4 of this SE.

In Attachment 3 of the LAR, the licensee provided the disposition and resolution of the remaining open peer review findings and self-assessment open items from the F&O closure review process performed in June 2017. In RAI 05.a.i, the NRC staff requested the licensee clarify whether a focused-scope peer review was performed concurrently with the F&O closure process and to discuss the scope of F&Os reviewed for the focused-scope peer review performed. In response to RAI 05.a(i), the licensee stated that a focused-scope peer review included review for the resolution of two existing F&Os (i.e., IEPRA F&O HR-03 and SPRA F&O SHA-E1-01) determined to be upgrades and that the focused-scope peer review did not generate any new F&Os against any of the PRA models.

In response to RAI 05.b, the licensee stated the F&O closure review team was not provided with

• a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constituted a PRA upgrade or PRA maintenance, as defined by the ASME/ANS 2009 Standard. In Tables 2-1 and 2-2 of Attachment 2 of the supplement dated May 9, 2018, the licensee provided a list of the significant changes to the IEPRA, IFPRA, FPRA, and SPRA models (along with their classification of PRA maintenance or PRA upgrade and the associated basis), and confirmed which F&Os associated with PRA maintenance were included in the 2017 F&O closure performed. In Attachment 1 of the supplement dated May 9, 2018, for Implementation Item No. 1, the licensee committed to conducting an augmented F&O closure review of the June 2017 F&O closure review that will include documentation for the basis of the PRA upgrade versus PRA maintenance determination for each reviewed F&O resolution. As discussed in Section 4.0 of this SE, the licensee also proposed a license condition that includes Implementation Item No. 2, which addresses the changes to the PRA determined to be upgrades that have not received a peer review, and Implementation Item No. 3 that ensures the PRA models incorporate the resolutions to all open F&O findings prior to implementation of the SSC categorization process.

The NRC staff finds that the identified errors and weaknesses associated with the closure review performed in June 2017 will be resolved prior to implementation of the 10 CFR 50.69 categorization process with the completion of Implementation Items Nos. 1, 2, and 3 (discussed in Section 3.5.6 of this SE) (Reference 2). Therefore, the NRC staff concludes that the IEPRA, FPRA, and SPRA, with the completion of the proposed Implementation Items Nos. 1, 2, and 3 (Reference 2), as required by the proposed license condition, meet the requirement in 10 CFR 50.69(c)(1 )(i).

3.5.1. 7 Composite PRA Model for Palo Verde In RAI 20, the NRC staff observed that the reported baseline risk values appeared to be generated from single unit PRA models rather than from individual unit-specific PRA models.

The NRC staff requested justification for why a single unit PRA model provides adequate representation of all three reactor units and to discuss how the assumption of single unit representation will be managed in future risk analysis for SSC categorization if plant modifications vary between units. In response to RAI 20.a, the licensee stated that the three reactor units for Palo Verde are physically separate and independent units that are nearly identical in design, construction, maintenance, and operation. The licensee further stated that assessments were performed (i.e., "delta assessments") to identify and document the differences between the units, which serve as the basis for constructing the composite PRA models. The licensee stated that the composite models were confirmed to be representative and not an overly conservative representation of the individual reactor units. The NRC staff finds the licensee's use of a single PRA model to adequately represent all three units is acceptable because the licensee performed assessments that identified and documented the differences in the units that were used as the basis for constructing the composite PRA models.

For the composite IEPRA (including internal flooding) model, the licensee stated that the IEPRA was built based on Palo Verde, Unit 1, which in comparison to Palo Verde, Units 2 and 3, is bounding (i.e., has additional failures). The licensee provided additional discussion of electronical differences between Palo Verde, Unit 1, and the other units, demonstrating the additional failure modes for the Palo Verde, Unit 1, SSCs. For the FPRA, the licensee explained that the "delta assessment" performed identified differences between the units that could impact the fire modeling (e.g., relocated ignition sources, raceways, cable routing through alternate raceways or fire compartments, distances from the ignition source to first target, and protected raceways). The licensee also stated that a composite model was developed starting with Palo Verde, Unit 1 for the FPRA model. Based on the differences identified in the "delta assessment," if the Palo Verde, Unit 2 or 3, fire modeling parameters were not equivalent or bounded by the Palo Verde, Unit 1, fire modeling parameters, then the resulting modeling differences were added to the composite model (i.e., added to the Palo Verde, Unit 1, model).

The licensee stated that an evaluation was performed of the composite model to determine the impact of this approach on the estimation of risk across the reactor units. The licensee also stated that the difference in fire risk between the Palo Verde, Unit 1, baseline model (solely based on Palo Verde, Unit 1) and the composite model (based on fire impacts from all units combined) was less than 0.5 percent CDF and 0.1 percent LERF. The licensee confirmed that the dominant sequences and their relative contribution to the total fire risk was not significantly different between the Palo, Verde, Unit 1, baseline model and the composite model. The NRC staff finds that the licensee appropriately identified the differences for each unit and incorporated the modeling differences into the composite model.

In response to RAI 20.a.i, the licensee assessed the applicability of the SPRA model developed for Palo Verde, Units 1 to Palo Verde, Units 2 and 3. Sensitivity analyses were conducted for the seismic hazard and equipment fragilities as well as plant-specific seismic walkdowns for Palo Verde, Units 1, 2, and 3. The licensee stated that specific differences were observed following the seismic equipment walkdowns, and dedicated plant and system fragility parameters were developed for those units. Overall, the resulting delta risk calculated by the licensee between the baseline SPRA Palo Verde, Unit 1, model and the SPRA Palo Verde, Units 2 and 3, models was less than 0.01 percent for CDF and LERF. Therefore, the NRC staff

finds the Palo Verde, Unit 1 SPRA model utilized by the licensee was determined to be an adequate representation of all three units for use in the categorization process.

In response to RAI 20.a.ii to address the shared SSCs between units and how they were implicitly or explicitly modeled in the PRAs, the licensee identified six shared systems (i.e.,

start-up transformers, station blackout generators, initiation control of station blackout generators, fire water supply, auxiliary steam system, and the tower makeup and blowdown systems). The licensee confirmed that two of the six shared systems (i.e., the auxiliary steam system, and the tower makeup and blowdown systems) are not credited in the PRAs. In addition, the licensee confirmed that the other systems are adequately represented in the composite IEPRA, FPRA, and SPRA models.

For the IEPRA (including internal flooding), FPRA, and SPRA, the licensee stated that as plant modifications are made and model refinements are incorporated into the composite model, the relative impact of using a composite model will continue to be assessed. The NRC staff performed a more detailed review of the APS PRA configuration and control process consistent with 10 CFR 50.69( e) and 10 CFR 50.69(f) in Section 3.1 O of this SE.

The NRC finds that, (1) the licensee has performed evaluations and sensitivity studies to understand the difference between the reactor units that can impact the IEPRA, FPRA, and SPRA models, (2) the composite model used by the licensee to represent all three units is either representative or slightly conservative in comparison to the three reactors units, and (3) the licensee will continue to assess the differences between units and validate that the composite model remains a valid representation of the three reactor units. Therefore, the NRC staff concludes that the licensee's approach of using a composite IEPRA (including internal flooding),

FPRA, and SPRA models to represent each of the three reactors units is acceptable.

3.5.1.8 Summary of IEPRA, FRPA, and SPRA Acceptability In Section 3.3 of the LAR, as supplemented in the letter dated May 9, 2018, APS provided:

(1) the history of peer reviews performed for the IEPRA (including internal flooding), FPRA, and SPRA, (2) results of the June 2017 F&O closure review, and (3) the remaining open F&Os along with proposed resolutions prior to implementation of the SSC categorization program.

The NRC staff finds the results of the peer review and June 2017 F&O closure review submitted in the LAR, along with the information provided in the supplement dated May 9, 2018, appropriately identified the technical elements of the PRA standard that were not met, provided closure of finding-level F&Os, and identified remaining open findings.

As discussed above and in Section 4.0 of this SE, the licensee committed to Implementation Items Nos. 1, 2, and 3 (Reference 2) within the proposed license condition. Therefore, the NRC staff finds the errors and weaknesses in the IEPRA (including internal flooding), FPRA, and SPRA will be resolved prior to implementation of the 10 CFR 50.69 categorization process with the completion of Implementation Item Nos. 1, 2, and 3 (Reference 2). The NRC staff concludes that upon the completion of these implementation items, the PRAs (i.e., IEPRA (including internal flooding), FPRA, and SPRA) are acceptable and meet the requirements in 10 CFR 50.69(b)(2)(iii) and 10 CFR 50.69(c)(1)(i).

3.5.2 Importance Measures and Integrated Importance Measures Paragraph 50.69( c )( 1)(i) of 10 CFR requires the results and insights from the PRA be used during categorization. These requirements are met, in part, by using importance measures and

sensitivity studies consistent with the ASME/ANS 2009 Standard, as endorsed by RG 1.200, Revision 2. Section 1.2.10, "Interpretation of Results Technical Elements," of RG 1200, Revision 2, states, in part:

Methods such as importance measure calculations (e.g., Fussell-Vesely Importance, risk achievement worth, risk reduction worth, and Birnbaum Importance) are used to identify the contributions of various events to the estimation of CDF for both individual sequences and the total CDF [i.e., both contributors to the total CDF, including the contribution from the different hazard groups and different operating modes (i.e., full- and low-power and shutdown) and contributors to each contributing sequence are identified].

The results of the Level 2 PRA are examined to identify the contributors (e.g.,

containment failure mode, physical phenomena) to the model estimation of LERF or LRF [Large Release Frequency] for both individual sequences and the model as a whole ....

Revision O of NEI 00-04 provides guidance where the Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) importance measures are obtained for each component and each PRA modeled hazard (i.e., separately for the IEPRA (including internal flooding), FPRA, and SPRA) and the values are compared to specified criteria as follows:

• Components which have importance measures values that exceed the risk criteria (i.e.,

F-V greater than 0.005, RAW greater than 2, CCF RAW greater than 20) are assigned candidate 4 safety significant.

Section 5.1, "Internal Events Assessment," of NEI 00-04, Revision 0, recommends that a truncation level of five orders of magnitude below the baseline CDF (or LERF) value should be used for calculating the F-V risk importance measures. The guidance also recommends that the truncation level used should be sufficient to identify all functions with a RAW value greater than 2.

3.5.2.1 Importance Measures In RAI 14.a, the NRC staff requested the licensee to demonstrate the impact of the selected truncation level for the "higher bins" on the importance measure criteria (i.e., RAW value greater than 2 or F-V value greater than 0.005) and the overall SSC categorization for the SPRA model.

In response to RAI 14.a, the licensee stated that the truncation level for the highest three acceleration intervals in the SPRA is close to three orders of magnitude lower than the base risk and, therefore, did not meet the guidance on the truncation level of 5 orders of magnitude lower than the base risk in NEI 00-04, Revision 0. However, the licensee described that the higher bins quantification is dominated by the higher ground motion accelerations and the integration of the hazard curves and fragility curves at those higher levels will mostly reflect the hazard curve.

The licensee further stated that the plant level conditional core damage probability and conditional large early release probability are stable at 1.0, which indicates that additional cutsets will not impact the results. Therefore, the licensee stated that the truncation levels of 4 The term preliminary is used synonymous with the term candidate in NEI 00-04, Revision 0, guidance.

The candidate safety significance is not the assigned RISC categorization for the SSC until the IDP has completed its review and approval, consistent with NEI 00-04, Revision 0, guidance, as endorsed by RG 1.201.

three orders of magnitude at higher g-levels did not make an appreciable difference for seismic CDF and LERF. The NRC staff finds the licensee's use of the truncation levels at lower ground motion acceleration consistent with the guidance in NEI 00-04, Revision 0, and the use of the truncation levels for the higher ground motion acceleration for the categorization process is adequate because the truncation level does not affect the application.

In RAI 14.b, the NRC staff requested that the licensee describe how the selected screening level in the SPRA model maintains consistency with the importance measure criteria specified (i.e., RAW value greater than 2 or FV value great than 0.005) in NEI 00-04, Revision 0, and demonstrate the impact of the selected screening level in the SPRA model on the importance measure criteria and the overall SSC categorization. In response to RAI 14.b, the licensee stated that no specific screening was used in the Palo Verde SPRA model and, therefore, there was no quantitative threshold for dismissing a seismically induced failure. All of the seismic failures for which seismic fragilities were calculated, were included in the model regardless of the calculated or estimated fragility value. The licensee stated that components that were screened out from an explicit fragility calculation were grouped into surrogate fragility events.

An estimate for the surrogate fragilities was provided and was explicitly entered into the SPRA model. The licensee further stated that if a surrogate fragility was present among the important risk contributors, the surrogate would then be refined and further evaluated. The NRC staff finds the calculation of importance measures generated from the SPRA model will not be adversely affected by the potential use of screening levels because the licensee does not use any screening levels in SPRA model.

3.5.2.2 Integrated Importance Measures Section 5.6, "Integral Assessment," of NEI 00-04, Revision 0, discusses the need for an integrated computation using the available importance measures. It further states, in part, that the "integrated importance measure essentially weights the importance from each risk contributor (e.g., internal events, fire, and [SPRAs]) by the fraction of the total [CDF or LERF]

contributed by that contributor." The guidance provides formulas to compute the integrated F-V, and integrated RAW.

The NRC staff recognizes the variations of PRA modeling practices associated with accident sequences and computer software applications (e.g., FRANC, CAFTA, Phoenix) used to support the quantification of both CDF and LERF across the multiple PRA hazards and the potential to inadvertently introduce a deviation from the computations for F-V and RAW provided in the guidance in NEI 00-04, Revision 0. Therefore, in RAls 13 and 22, the NRC staff requested APS confirm the importance measures generated for use in the SSC categorization process are consistent with the NEI guidance and do not introduce a deviation from Section 5.6 of the NEI 00-04, Revision 0, guidance. The NRC staff specifically requested the licensee discuss if the PRA model that will be used in the SSC categorization process is (1) an integrated one-top model across multiple PRA hazards and (2) if the integrated one-top model includes accident sequence modeling to support quantification of both CDF and LERF. The NRC further requested the licensee describe the process used to validate and confirm the integration of the PRA hazards into a one-top model.

In response to RAls 13 and 22, the licensee stated that a one-top model that includes internal events, internal flooding, fire, and seismic events will be used for the SSC categorization process. The one-top model supports quantification of both CDF and LERF.

In response to RAI 22.i, the licensee confirmed the consistency of the importance measures generated from the one-top model with the methodology described in NEI 00-04, Section 5.6.

The licensee stated that the individual hazard models are individually verified to meet their respective portions of the ASME/ANS 2009 Standard in accordance with the normal process for peer review and technical verification. The licensee also stated that these individual hazard models will be considered the Palo Verde models of records (MOR), from which application-specific models will be developed. The licensee further stated that the integrity of the one-top model will be verified by comparing its results (i.e., cutsets) against those generated by the RG 1.200, Revision 2, peer-reviewed individual hazard MOR The NRC staff performed a more detailed review of the PRA acceptability of these PRA models (i.e., IEPRA (including internal flooding), FPRA, and SPRA) in Sections 3.5.1.2 through 3.5.1.4 of this SE.

In response to RAI 22.b, the licensee stated that the importance measures, such as F-V and RAW, will be generated consistently with the guidance and methodologies prescribed in NEI 00-04, Revision 0, and consider both the individual hazard importance measures as well as the integrated importance measures generated using the one-top PRA model. The NRC staff finds that the licensee's approach to verifying the integrity of the one-top model against the results generated by the MOR are acceptable and, therefore, the importance measures generated for use in the categorization process are consistent with the guidance and methodologies prescribed in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1.

3.5.2.3 Summary of Importance Measures and Integrated Importance Measures Paragraph 50.69(c)(1)(i) of 10 CFR requires the results and insights from the PRA be used during categorization. These requirements are met, in part, by using importance measures and sensitivity studies consistent with the ASME/ANS 2009 Standard, as endorsed by RG 1.200, Revision 2. The NRC staff performed review of the Palo Verde composite model and determined that the licensee's use of integrated importance values across the PRA hazards is consistent with the guidance in NEI 00-04, Revision 0, as endorsed in RG 1.201, Revision 1.

The second proposed implementation item in the July 19, 2018, LAR (Reference 1), as required by the proposed license condition, states that APS will establish procedure(s) prior to the use of the categorization process on a plant system. Therefore, upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the NRC staff finds the licensee's approach to consider both the individual hazard importance measures and the integrated importance measures generated from the one-top model for SSC categorization to be acceptable.

3.5.3 Non-PRA Methods According to 10 CFR 50.69(c)(1)(ii}, SSC functional importance must use an integrated, systematic process for addressing initiating events, SSCs, and plant operating modes, including those not modeled in the plant-specific PRA. The functions to be identified and considered include design-bases functions and functions credited for mitigation and prevention of severe accidents.

The licensee's categorization process uses the following non-PRA methods:

• Screening during the IPEEE to assess risk from other external hazards (high winds, external floods);

• Shutdown Safety Plan to assess shutdown risk.

3.5.3.1 Other External Risks External hazards were initially evaluated by the licensee during the IPEEE. This hazard category includes all non-seismic external hazards such as high winds, external floods, transportation and nearby facility accidents, and other hazards. The IPEEE external hazard analysis used a progressive screening approach and concluded that all these other hazards are negligible contributors to overall plant risk. Furthermore, the licensee stated that it had reevaluated these other external hazards using the criteria in the ASME/ANS 2009 Standard and screened all external hazards beyond seismic events.

Section 3.3 of the LAR states that a full-scope external hazards screening peer review was performed in December 2011 in accordance with RG 1.200, Revision 2. The LAR does not discuss the results from this external hazards screening peer review and did not state whether the F&O closure review in June 2017 addressed any findings from the external hazards screening peer review. In RAI 17, the NRC staff requested the licensee confirm if any finding-level F&Os resulted from the external hazards screening peer review and if they were included in the scope of the June 2017 F&O closure review. In response to RAI 17, the licensee provided three findings (EXT-D1-01, EXT-D1-02, and EXT-E2-01) that were identified during the December 2011 external hazards screening peer review that were inadvertently excluded from the scope of the June 2017 F&O closure review. In Table 6-1 of Attachment 6 to the supplement dated May 9, 2018, the licensee provided the dispositions for each of the F&Os.

The licensee stated, in part, that "[t]hese three findings will be included and verified closed in an augmented F&O closure review ... " Furthermore, the proposed license condition includes completion of Implementation Item No. 3. A more detailed discussion of the proposed license condition is provided in Section 4.0 of this SE.

The guidance in NEI 00-04, Revision 0, states, in part, If it can be shown that the component either did not participate in any screened scenarios or, even if credit for the component was removed, the screened scenario would not become unscreened, then it is considered a candidate for the low safety-significant category.

In RAI 18.a-e, the NRC staff requested the licensee ( 1) identify the external hazards that will be evaluated according to the flow chart in NEI 00-04, Revision 0, Section 5.4, Figure 5-6; (2) identify the external hazards for which all credited SSCs will be considered HSS; (3) provide justification for any additional methods that will be used to evaluate individual SSCs against external hazards, along with the specific hazard that will be evaluated for the method; and

( 4) confirm that all external hazards not included in the categorization process will be considered insignificant for every SSC and, therefore, not considered during the categorization process.

In response to RAI 18.a, the licensee stated that the other external hazards that will be evaluated according to the flow chart in Figure 5-6 of NEI 00-04 are any hazards listed in of the LAR, External Hazards Screening, that have not been screened following the process in the ASME/ANS 2009 Standard.

In Attachment 5 of the LAR, for the progressive screening approach to address external hazards, the screening criteria uses a bounding mean CDF value of less than 1E-6 per reactor-year, consistent with NUREG-1407, "Procedural and Submittal Guidance for the

Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities,"

(Reference 27) and the ASME/ANS 2009 Standard. The licensee further states in Attachment 5 of the LAR that, for screening extreme wind or tornado, the spray pond nozzles (not protected against missiles) have a bounding median risk less than 1E-07 per reactor-year. In RAI 18.f, the NRC staff requested the licensee describe how the guidance in Figure 5-6 of NEI 00-04, Revision 0, will be applied for the hazard, and confirm if its application to screen the hazard will be impacted by the current effort to assess tornado missile protection hazard in response to NRC Regulatory Issue Summary 2015-06, "Tornado Missile Protection" (Reference 28). In response to RAI 18.f, the licensee stated that spray pond nozzles and other features associated with the screened tornado missile hazard would be categorized HSS under 10 CFR 50.69. The licensee further stated that that it has no plans to implement alternatives to the existing licensing basis treatment of tornado missile hazards for the spray ponds.

Based on the licensee's confirmation that the other external hazard risk evaluation is consistent with Section 5 of NEI 00-04, Revision 0, as endorsed in RG 1.201, Revision 1, the NRC staff concludes that the licensee's treatment of other external hazards is acceptable, and upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the requirement of 10 CFR 50.69(c)(1 )(ii) is met.

3.5.4 Shutdown Risk Consistent with the guidance in NEI 00-04, Revision 0, the licensee proposes to use the shutdown safety assessment process based on NUMARC 91-06. NUMARC 91-06 provides considerations for maintaining defense-in-depth (DID) for the five key safety functions during shutdown, namely, decay heat removal capability, inventory control, power availability, reactivity control, and containment - primary/secondary. NUMARC 91-06 specifies that a DID approach should be used with respect to each defined shutdown key safety function, which is accomplished by designating a running and an alternative system/train to accomplish the given key safety function.

The use of NUMARC 91-06 described by the licensee in the submittal is consistent with the guidance in NEI 00-04, Revision 0, as endorsed by the NRC in RG 1.201, Revision 1. The approach uses an integrated and systematic process to identify HSS components, consistent with the shutdown evaluation process. Additionally, the second proposed implementation item in the July 19, 2018, LAR (Reference 1), as required by the proposed license condition, states that APS will establish procedure(s) prior to the use of the categorization process on a plant system. Therefore, the NRC staff concludes that the licensee's use of NUMARC 91-06 is acceptable, and upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the requirement of 10 CFR 50.69(c)(1 )(ii) is met.

3.5.5 Component Safety Significance Assessment for Passive Components Passive components are not modeled in the PRA, and therefore, a different assessment method is necessary to assess the safety significance of these components. Passive components are those components having only a pressure-retaining function. This process also addresses the passive function of active components, such as the pressure/liquid retention of the body of a motor-operated valve.

In Section 3.1.2 of the LAR, the licensee proposed. using a categorization method for passive components not cited in NEI 00-04, Revision 0, for passive component categorization, but approved by the NRC for AN0-2 (Reference 29). The AN0-2 methodology is a risk-informed

safety classification and treatment program for repair/replacement activities for Class 2 and 3 pressure retaining items and their associated supports (exclusive of Class CC and MC items).

The AN0-2 methodology uses a modification of the ASME Code Case N-660, "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities,Section XI Division 1" (Reference 30). The AN0-2 methodology relies on the conditional CDF and LERF associated with pipe ruptures. Safety significance is generally measured by the frequency and the consequence of, in this case, pipe ruptures. Treatment requirements (including repair/replacement) only affect the frequency of passive component failure. Categorizing solely based on consequences, which measures the safety significance of the pipe given that it ruptures, is conservative compared to including the rupture frequency in the categorization. The categorization will not be affected by changes in frequency arising from changes to the treatment. Therefore, the NRC staff finds that the use of the repair/replacement methodology is acceptable and appropriate for passive component categorization of Class 2 and Class 3 SSCs.

The licensee stated that the categorization process would only be applied to passive categorization of Class 2 and 3 components. The licensee further stated that all Class 1 SSCs and supports will be considered HSS and only Class 2 and 3 SSCs will be categorized using the NRG-approved AN0-2 passive categorization methodology. The NRC staff finds that, upon incorporation of the categorization elements and the associated clarifications provided by the licensee into formal plant procedures, the licensee's proposed approach for passive categorization acceptable for the 10 CFR 50.69 categorization.

3.5.6 Summary of the SSC Categorization Process The NRC staff reviewed the PRA and non-PRA methods used by the licensee in the 10 CFR 50.69 categorization process to assess the safety significance of active and passive components. The NRC staff finds these methods to be acceptable and consistent with RG 1.201, Revision 1, and the NRG-endorsed guidance in NEI 00-04, Revision 0. The NRC staff approves the use of the following methods in the licensee's 10 CFR 50. 69 categorization process:

• IEPRA to assess internal events (including internal flooding) risk

• FPRA to assess fire risk

• SPRA to assess seismic risk

• Screening using IPEEE to assess risk from other external hazards (high winds, external floods)

• Shutdown Safety Plan to assess shutdown risk

• AN0-2 passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports In RAI 06, the NRC staff requested the licensee ensure that the PRA changes to address the open F&Os across all PRA modeled hazards will be completed, and that the resolution of the F&Os is appropriately reviewed prior to implementation of the 10 CFR 50.69 process. The NRC staff also requested that any additional finding-level F&Os that are subsequently identified as a result of responses to RAls (RAI 01, RAI 03, RAI 05, RAI 09, RAI 17, and RAI 21) be resolved prior to implementation of the 10 CFR 50.69 categorization process.

In response to RAI 06, the licensee proposed the addition of a license condition for the implementation of 10 CFR 50.69 to the RFOLs. The proposed license condition, states, in part, that "APS will complete the implementation items listed in the Enclosure of APS letter

102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69.

The enclosure to the letter dated July 19, 2017 (Reference 1), identifies two implementation items:

• Resolve the eight not closed finding-level F&Os and validate them closed through an F&O closure review conducted in accordance with NRC letter dated May 3, 2017.

• Establish procedure(s) prior to the use of the categorization process on a plant system. , Table 1-1 of the letter dated May 9, 2018, identifies three implementation items, as summarized below:

1. Conduct an augmented F&O closure review of the June 2017 F&O closure review findings;

2. Conduct a focused-scope peer review for four specific PRA model upgrades; and

3. Revise the PRA models to incorporate resolutions to all open F&O findings and FPRA guidance more recently endorsed by the NRC. Ensure these changes are incorporated and that the PRA model total CDF and total LERF are below the limits established in RG 1.174.

The first proposed implementation item in the July 19, 2018, letter is superseded by Implementation Item No. 3 of the letter dated May 9, 2018 (Reference 2). Implementation Item No. 3 addresses incorporation of all open F&O findings; therefore, the NRC staff finds that the eight open findings discussed in the first proposed implementation item of the letter dated July 19, 2018, will be addressed in Implementation Item No. 3. All issues identified in the enclosure will be address and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the ASME/ANS 2009 Standard, as endorsed by RG 1.200, Revision 2, and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

3.6 Defense-in-Depth (NEI 00-04, Revision 0, Section 6)

Section 6 of NEI 00-04, Revision O provides guidance on assessment of DID. Figure 6-1 in NEI 00-04 provides guidance to assess design-basis DID based on the likelihood of the design-basis internal initiating event and the number of redundant and diverse trains nominally available to mitigate the initiating event. The likelihood of the initiating events is binned and, for different likelihood bins, HSS designation is assigned if fewer than the required number of mitigating trains are nominally available. Section 6 also provides guidance to assess containment DID based on preserving containment isolation and long-term containment integrity and on preventing containment bypass and early hydrogen burns. The DID for beyond-design-basis initiating events is addressed by the PRA categorization process.

Revision 1 of RG 1.201 endorses the guidance in Section 6 of NEI 00-04, Revision 0, but notes that the containment isolation criteria in Section 6 are separate and distinct from those set forth in 10 CFR 50.69(b)(1)(x). The criteria in 10 CFR 50.69(b)(1)(x) are to be used in determining which containment penetrations and valves may be exempted from the Type Band Type C leakage testing requirements in both Options A and B of Appendix J to 10 CFR Part 50, but the

10 CFR 50.69(b )(1 )(x) criteria are not used to determine the proper RISC category for containment isolation valves or penetrations.

In Section 3.1.1 of the LAR, the licensee states that it will require an SSC to be categorized as HSS based on the DID assessment performed in accordance with NEI 00-04, Revision 0, Section 6. The NRC staff concludes the licensee's process is consistent with the NRG-endorsed guidance in NEI 00-04, Revision 0, and upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, fulfills the 10 CFR 50.69(c)(1)(iii) criteria that requires DID to be maintained.

3.7 Preliminary Engineering Categorization of Functions (NEI 00-04, Revision 0, Section 7)

All the information collected and evaluated in the licensee's engineering evaluations is provided to the IDP as described in NEI 00-04, Revision 0, Section 7, "Preliminary Engineering Categorization of Functions." The IDP will make the final decision about the safety significance of SSCs based on guidelines in NEI 00-04, Revision 0, the information they receive, and their expertise.

In Section 3.1.1 of the LAR, the licensee stated that if any component is identified as HSS from either the integrated PRA component safety significance assessment or the DID assessment, the associated system function(s) would be identified as HSS. Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The safety significance of functions will be preliminary HSS only if it is supported by a component determined to be HSS from a PRA based assessment. Components that are identified as HSS from using the non-PRA approaches (i.e., shutdown risk and other external hazards) will not drive the system function(s) they support to be assigned HSS. The licensee also stated that non-PRA-based assessments result in the default categorization of any components associated with the safe shutdown success paths defined in those deterministic assessments to be HSS regardless of its risk significance.

The second proposed implementation item in the July 19, 2018, LAR (Reference 1) states that APS will establish procedure(s) prior to the use of the categorization process on a plant system.

Therefore, the NRC staff concludes that the preliminary categorization of functions is consistent with the guidance in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1, and upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, is acceptable.

3.8 Risk Sensitivity Study (NEI 00-04, Revision 0, Section 8)

Paragraph 50.69( c )( 1)(iv) of 10 CFR requires, in part, that any potential increases in CDF and LERF resulting from changes to treatment are small. The categorization process described in NEI 00-04, Revision 0, includes an overall risk sensitivity study for all the LSS components to assure that if the unreliability of the components was increased, the increase in risk would be small (i.e., meet the acceptance guidelines of RG 1.174, Revision 3).

Section 3.2. 7 of the LAR states, in part, Sources of model uncertainty and related assumptions have been identified for the [Palo Verde] PRA models using the guidance of NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision

Making" ... and EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments" [Reference 31].

A more detailed NRC staff review of the licensee's identified assumptions and sources of model uncertainty is provided above in Section 3.5.1.5 of this SE.

The guidance in NEI 00-04, Revision 0, specifies sensitivity studies to be conducted for each PRA model. For the SPRA, IEPRA (including internal floods), and FPRA, the licensee performed an assessment to evaluate if additional sensitivities should be performed.

For the IEPRA (including internal flooding) and FPRA models, the licensee identified one additional sensitivity to be performed where the unavailability of fast transfer busses for the 13.8 kV non-Class 1E power system and 4.16 kV non-Class 1E power system will be increased by a factor of 3, to assess the risk during startup transformer maintenance.

For the SPRA model, the licensee stated that a sensitivity study will be performed as part of the 10 CFR 50.69 categorization process by increasing the human error probability (HEP) of all human failure events in the SPRA by a factor of 3. This sensitivity analysis addresses the uncertainty associated with main control room actions that may take longer in a seismic event compared to an internal initiating event. The licensee also stated that inclusion of sensitivity studies is proceduralized and included a discussion on the steps delineated in the procedure for performing sensitivity studies. The NRC staff finds that the licensee identified appropriate sensitivity studies for SPRA and increasing the HEP in the SPRA by a factor of 3 is consistent with NEI 00-04, Revision 0, and therefore, acceptable for use in the categorization of SSCs.

The licensee identified and evaluated sources of uncertainty in its IEPRA (including internal flooding), FPRA, and SPRA models using the guidance provided in NUREG-1855, and EPRI TR-1016737. The NRC staff finds the sensitivities provided in Tables 5-2, 5-3, and 5-4 of NEI 00-04, Revision 0, along with the two additional sensitivities described above, are acceptable for the categorization of SSCs and consistent with the guidance in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1.

Section 3. 1. 1 of the LAR states that an unreliability factor of 3 will be used for the sensitivity studies described in Section 8, "Risk Sensitivity Study," of NEI 00-04, Revision 0. Additionally, Section 3.2.7 of the LAR states that a cumulative sensitivity study will be performed where the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. The NRC staff finds the application of a factor of 3 for the sensitivities is consistent with the guidance in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1.

There is no explicit guidance on how to perform these sensitivity studies for seismic risk in NEI 00-04, Revision 0. The example provided in NEI 00-04, Revision 0, to increase the unreliability of all LSS SSCs modeled in the PRAs by a factor of 3 to 5 is applied to random failures. Therefore, in RAI 12, the NRC staff requested the licensee discuss how these sensitivity studies will be performed for seismic risk, considering that the seismic fragility of an SSC contributes to its failure. In response to RAI 12, the licensee stated that its seismic risk sensitivity study is performed by increasing the random failure rates in the SPRA model and is considered to account for potential degradation from 10 CFR 50.69 reclassification. The licensee stated that the reclassification does not affect the seismic demand on the component or the seismic capacity of the component, because it does not change the location of equipment nor change the structures in which the components are housed. Furthermore, changes in

spatial separation, anchorage, and seismic functionally, which can affect the capacity of a component, are not affected by reclassification because reclassification does not reconfigure equipment or structures. The NRC staff finds that while degradation of equipment or structures with regards to spatial separation or anchorage is possible, the impact is small because of the passive nature of these failure mechanisms, and that reclassification has no impact on the seismic demand on a component.

The NRC staff finds that applying a factor of 3 increase to only random failures in the SPRA sensitivity study is acceptable because: ( 1) the impacts of reclassification on fragility are likely to be small, (2) the approach of applying a factor of 3 increase to random failures in the SPRA model is consistent with the guidance in NEI 00-04, Revision 0, and (3) Section 8.0 of NEI 00-04, Revision 0, requires performance monitoring to detect the impact of degradation, and therefore, address any potential impact on PRA assumptions (e.g., fragilities).

This sensitivity study, together with the periodic review process discussed in Section 3.10.1 of this SE, assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study. The NRC staff finds that the licensee will perform the risk sensitivity study consistent with the guidance in Section 8.0 of NEI 00-04, Revision 0, assuring that the potential cumulative risk increase from the categorization is maintained acceptably low. Therefore, upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the NRC staff concludes that the licensee will meet the requirements of 10 CFR 50.69(c)(1 )(iv).

3.9 Integrated Decisionmaking Panel Review and Approval (NEI 00-04, Revision 0, Section 9 and Section 10)

Paragraph 50.69(c)(2) of 10 CFR requires that the SSCs must be categorized by an IDP staffed with expert, .plant knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operations, design engineering, and system engineering. Section 3.1.1 of the LAR states that the IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and PRA. Therefore, the IDP will comprise the required expertise.

The guidance in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1, provides confidence that the IDP expertise is sufficient to perform the categorization and that the results of the different evaluations (PRA and non-PRA) are used in an integrated, systematic process as required by 10 CFR 50.69(c)(1 )(ii). Section 3.1.1 of the LAR discusses that at least three members of the IDP will have a minimum of 5 years of experience at the plant, and there will be at least one member of the IDP who has a minimum of 3 years of experience in modeling and updating of the plant-specific PRA. The licensee further states that the IDP will be trained in the specific technical aspects and requirements related to the categorization process.

The second proposed implementation item in the July 19, 2018, LAR (Reference 1) states that APS will establish procedure(s) prior to the use of the categorization process on a plant system.

The licensee also confirmed that the procedure(s) will specifically include an element for the IDP member qualification requirements. The NRC staff finds that the licensee's IDP areas of expertise meet the requirements in 10 CFR 50.69(c)(2), and the additional descriptions of the IDP characteristics, training, processes, and decision guidelines are consistent with the guidance in NEI 00-04, Revision 0, as endorsed by RG 1.201, Revision 1. Therefore, all

aspects of the integrated, systematic process used to characterize SSCs will reasonably reflect current plant configuration, operating practices, and applicable plant and industry operational experience, as required by 10 CFR 50.69(c)(1)(ii).

Section 9.2.2, "Review of Safety Related Low Safety-Significant Functions/SSCs," of NEI 00-04, Revision 0, states, in part, In making their assessment, the IDP should consider the impact of loss of the function/SSC against the remaining capability to perform the basic safety functions ....

Section 9.2.2 of NEI 00-04 also provides seven specific questions that should be considered by the IDP for making the final determination of the safety significance for each function/SSC. In RAI 11.e, the NRC staff requested the licensee describe how the collective assessment of the seven specific questions will be considered for the categorization process and how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS.

The IDP's authority to change component categorization from preliminary HSS to LSS is limited.

Consistent with the guidance in NEI 00-04, Revision 0, components found to be HSS from the aspects of the process cannot be re-categorized by the IDP. Components not meeting the criteria for categorization, as described in the guidance in NEI 00-04, but identified as HSS through an SPRA, FPRA, or through the sensitivity studies in the guidance in Section 5 of NEI 00-04, may be presented to the IDP for categorization as LSS, if this determination is supported by the integrated assessment process and other elements of the categorization process.

In response to RAI 11.e, the licensee states that in some cases (e.g., system functions that are not found to be HSS due to any other step in the categorization process), a 10 CFR 50.69 categorization team addresses the preliminary assessments of the seven questions for the IDP's consideration; however, the final assessment of the seven questions are the direct responsibility of the IDP. Each of the seven questions requires a supporting justification for confirming (true) or not confirming (false). If the 10 CFR 50.69 categorization team determines that one or more of the seven questions cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 10 CFR 50.69 team (i.e., all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. The qualitative criteria are the direct responsibility of the IDP, as such changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. The licensee clarified that, if the IDP determines that any one of the seven considerations cannot be confirmed for a function, then the final categorization of that function is HSS. The licensee further confirmed that the final assessment of the seven qualitative questions is the IDP's responsibility and that the final categorization of the function will be HSS when any one of the seven questions cannot be confirmed (false response) for that function. The NRC staff finds this acceptable and consistent with the guidance in NEI 00-04, Revision 0, as endorsed by the NRC in RG 1.201, Revision 1.

The IDP may change the categorization of a component from LSS to HSS based on its assessment and decisionmaking. As outlined in Section 10.2, "Detailed SSC Categorization of

NEI 00-04, Revision 0, and stated by the licensee, the IDP may re-categorize components supporting an HSS function from HSS to LSS only if a credible failure of the component would not preclude the fulfillment of the HSS function and the component was not categorized as HSS based on the six criteria (i.e., IEPRA, integrated PRA component risk, shutdown, passive categorization, and DID).

Paragraph 50.69(c){1 )(iv) of 10 CFR requires, in part, that reasonable confidence that sufficient safety margins are maintained for SSCs categorized as RISC-3. Safety margins are addressed through an integrated engineering evaluation that would be assessed by the IDP. As discussed in NEI 00-04, Revision 0, the only LSS SSC requirements that are relaxed for RISC-3 (LSS)

SSCs are those related to treatment, not design or capability, and 10 CFR 50.69( d)(2)(i) requires that the licensee ensures, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design-basis conditions. The NRC staff finds that the proposed APS categorization process, with the proposed license condition, are consistent with the endorsed guidance in NEI 00-04, Revision 0. Therefore, upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the NRC staff concludes that it meets the requirements in 10 CFR 50.69(c)(1)(iv).

3.10 Configuration Control Management {NEI 00-04, Revision 0, Section 11 and Section 12) 3.10.1 Periodic Review (NEI 00-04, Revision 0, Section 12)

Paragraph 50.69(c)(1)(ii) of 10 CFR requires, in part, that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices and applicable plant and industry operating experience. Section 12 of NEI 00-04, Revision 0, includes a discussion on Periodic Review, and a more detailed NRC staff review is provided below. Maintaining change control and performing periodic reviews will maintain confidence that all aspects of the program continually reflect the Palo Verde as-built, as-operated plant.

Section 50.69(e), "Feedback and process adjustment," of 10 CFR requires periodic updates to the licensee's PRA and SSC categorization. Changes over time to the PRA and to the SSC reliabilities are inevitable, and such changes are recognized by the 10 CFR 50.69(e) requirement for periodic updates.

Section 11.2, "Following Initial Implementation," of NEI 00-04, Revision 0, states, in part, that

"[t]he periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes." In RAI 23, the NRC staff requested the licensee describe how this periodic review will be administered. In response to RAI 23, the licensee stated that the periodicity of the periodic review coincides with the periodicity of PRA model updates and that review would be performed by system and PRA engineers. The licensee stated that the review would cover plant modifications; plant specific operating experience; updated PRA modeling and analysis; importance measures used for categorization (if importance values indicate an SSC should be reclassified, then this should be considered by the IDP); updated sensitivity studies; applicable plant and industry operational experience; and changes in regulation and operation that may change the bases for the categorization results.

The licensee stated that it has administrative controls in place to ensure that the PRA models used to support the categorization reflect the as-built, as-operated plant over time. The

licensee's administrative procedures include regularly scheduled and interim (as needed) PRA model updates consistent with the guidance in NEI 00-04, Revision 0. The guidance in NEI 00-04, Revision 0, includes provisions for: monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience); assessing the risk impact of unincorporated changes; and controlling the model and associated computer files. The process in NEI 00-04, Revision 0, also includes reevaluating previously categorized systems to ensure the continued validity of the categorization. Routine PRA updates are performed every two refueling cycles at a minimum.

The NRC staff finds that the administrative controls described by the licensee are consistent with the guidance in Section 11 of NEI 00-04, Revision 0, as endorsed in RG 1.201, Revision 1.

Additionally, the second proposed implementation item in the July 19, 2018, LAR (Reference 1),

as required by the proposed license condition, states that APS will establish procedure(s) prior to the use of the categorization process on a plant system. Therefore, upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the NRC staff concludes that the administrative controls described by the licensee are acceptable for meeting the requirements of 10 CFR 50.69(e).

3.10.2 Program Documentation and Change Control (NEI 00-04, Revision 0, Section 11)

Section 50.69(f) of 10 CFR requires program documentation, change control, and records. In Section 3.2.6, "PRA Maintenance and Updates," of the LAR, the licensee stated that it will implement a process that addresses the guidance in Section 11 of NEI 00-04, Revision 0, pertaining to program documentation and change control records. Section 3.1.1 of the LAR states that the RISC categorization process documentation will include the following ten elements:

• Program procedures used in the categorization

• System functions, identified and categorized with the associated bases

• Mapping of components to support function(s)

• PRA model results, including sensitivity studies

• Hazards analyses, as applicable

• Passive categorization results and bases

• Categorization results including all associated bases and RISC classifications

• Component critical attributes for HSS SSCs

• Results of periodic reviews and SSC performance evaluations

• IDP meeting minutes and qualification/training records for the IDP members , "List of Categorization Prerequisites," of the LAR states that the licensee will establish procedures prior to the use of the categorization process, which will contain the following elements: (1) IDP member qualification requirements, (2) qualitative assessment of system functions, (3) component safety significance assessment, (4) assessment of DID and safety margin, (5) review by the IDP and final determination of safety significance for system functions and components, (6) risk sensitivity studies to confirm that the risk acceptance guidelines of RG 1.174 are met, (7) periodic review to ensure continued categorization validity and acceptable performance for SSCs that have been categorized, and (8) documentation requirements identified in LAR Section 3.1.1. The NRC staff also recognizes for facilities licensed under 10 CFR Part 50, Appendix B, Criterion VI, "Document Control," procedures are considered formal plant documents that require measures be established to control the issuance of documents that prescribe all activities affecting quality. The NRC staff finds that the elements of the APS 10 CFR 50.69 categorization process to be documented in formal licensee

procedures as per the second proposed implementation item in the July 19, 2018, LAR (Reference 1) (required by the proposed license condition), are consistent with the guidance in Section 11 of NEI 00-04, Revision 0, as endorsed by the NRC in RG 1.201, Revision 1.

Therefore, the NRC staff concludes that upon incorporation of the categorization elements and the associated clarifications into formal plant procedures, the elements of the APS 10 CFR 50.69 categorization process meet the requirements in 10 CFR 50.69(f) for program documentation, change control, and records.

3.11 Technical Conclusion The NRC staff reviewed the licensee's 10 CFR 50.69 categorization process and concludes that the licensee adequately implements 10 CFR 50.69 using models, methods, and approaches consistent with NEI 00-04, Revision 0, and RG 1.201, Revision 1, and therefore, satisfies the requirements of 10 CFR 50.69(c). Based on its review, the NRC staff finds the licensee's proposed categorization process acceptable for categorizing the safety significance of SSCs.

Specifically, the NRC staff concludes that the licensee's categorization process:

( 1) considers results and insights from plant-specific internal events, FPRAs, and SPRA that are of sufficient quality and level of detail to support the categorization process and that have been subjected to a peer review process against RG 1.200, Revision 2, as reviewed in Section 3.5.1 of this SE, and therefore, meets the requirements in 10 CFR 50.69(c)(1)(i);

(2) determines SSC functional importance using an integrated systematic process that reasonably reflects the current plant configuration, operating practices, and applicable plant and industry operational experience, as reviewed in Sections 3.3, 3.4, 3.5, 3.7, and 3.10 of this SE, and therefore, meets the requirements in 10 CFR 50.69(c)(1 )(ii);

(3) maintains DID, as reviewed in Section 3.6 of this SE, and therefore, meets the requirements in 10 CFR 50.69(c)(1 )(iii);

(4) includes evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, sufficient safety margins are maintained and that any potential increases in CDF and LERF resulting from changes in treatment are small, as reviewed in Sections 3.8 and 3.9 of this SE, and therefore, meets the requirements in 10 CFR 50.69(c)(1 )(iv);

(5) is performed for entire systems and structures, rather than for selected components within a system or structure, as reviewed in Section 3.3 of this SE, and therefore, the requirements in 10 CFR 50.69(c)(1)(v) will be met upon implementation; and (6) includes categorization by IDP, staffed with expert, plant-knowledgeable members whose expertise includes, at a minimum, PRA, safety analysis, plant operation, design engineering and system engineering, as reviewed in Section 3.9 of this SE, and therefore, meets the requirements in 10 CFR 50.69(c)(2).

4.0 PROPOSED LICENSE CONDITION Section 50.69(b)(2) of 10 CFR requires the licensee to submit an application that describes the categorization process. Section 50.69(b)(3) of 10 CFR states that the Commission will approve the license application if it determines that the categorization process satisfies the requirements of 10 CFR 50.69(c). As described in this SE, the NRC staff has concluded that the 10 CFR 50.69 categorization process described in the licensee's application satisfies the requirements of 10 CFR 50.69(c). However, based on its review of the LAR and the licensee's responses to the NRC staff's RAls, the NRC staff identified certain specific actions, as described below, that are necessary to support the NRC staffs conclusion that the proposed program meets the requirements in 10 CFR 50.69 and the guidance in RG 1.201 and NEI 00-04.

The NRC staff's finding on the acceptability of the PRA evaluation in the licensee's proposed 10 CFR 50.69 process is conditioned upon the completion of implementation items to address changes to the PRA or PRA documentation. These changes are identified in the enclosure of the LAR dated July 19, 2017, and Attachment 1 of the letter dated May 9, 2018, as "Palo Verde 10 CFR 50.69 PRA Implementation Items." For the clarifications to the NEI 00-04, Revision 0, guidance and other changes to the PRA models that were described by the licensee, the NRC staff finds them to be routine and systematically addressed through the configuration management and control and periodic update processes as described in Section 3.10 of this SE.

The licensee proposed the following condition to its license:

APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

The NRC staff finds that the proposed license condition is consistent with the RG 1.200, Revision 2, requiring peer reviews for PRA upgrades, and the guidance in RG 1.201, Revision 1, regarding the scope of the PRA and non-PRA methods used for the categorization The NRC staff finds that the proposed license condition and referenced implementation items are acceptable because they adequately implement 10 CFR 50.69 using models, methods, and approaches consistent with the applicable guidance that has previously been endorsed by the NRC. For each implementation item, the licensee and the NRC staff have reached a satisfactory resolution involving the level of detail and main attributes for each item's incorporation into the program upon its completion.

The NRC staff, through an onsite audit or during future inspections, may choose to examine the closure of the implementation items with the expectation that any variations discovered during this review, or concerns with regard to adequate completion of the implementation item, will be tracked and dispositioned appropriately in accordance with the requirements of 10 CFR 50.69(f) and 10 CFR Part 50, Appendix B Criterion VI, and could be subject to NRC enforcement action(s).

5.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendments on September 10, 2018. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, which was published in the Federal Register on September 26, 2017 (82 FR 44850), and there has been no public comment on such finding.

Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

8.0 REFERENCES

1. Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station, Units 1, 2 and 3, Docket Nos. STN 50-528, 50-529, and 50-530, Renewed Facility Operating License Nos. NPF-41, NPF-51, and NFP-74, License Amendment Request to Adopt 10 CFR 50.69, 'Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors,"' dated July 19, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML172000162).

2. Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station, Units 1, 2 and 3, Docket Nos. STN 50-528, 50-529, and 50-530, APS Response to Request for Additional Information for License Amendment Request to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components," dated May 9, 2018 (ADAMS Accession No. ML18129A448).

3. Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station, Units 1, 2 and 3, Docket Nos. STN 50-528, 50-529, and 50-530, APS Supplemental Response to Request for Additional Information 3.a for License Amendment Request to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components,"

dated July 13, 2018 (ADAMS Accession No. ML18194A914).

4. Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station, Units 1, 2 and 3, Docket Nos. STN 50-528, 50-529, and 50-530, "Updated Proposed License Condition Regarding License Amendment Request to Adopt 10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components," dated August 10, 2018 (ADAMS Accession No. ML18223A005).

5. Lingam, Siva, U.S. Nuclear Regulatory Commission, e-mail to Cox, Matthew, Arizona Public Service, "RE: Palo Verde 1, 2, and 3 - Offical RAls for 10 CFR 50.69 LAR (CAC Nos. MF9971, MF9972, and MF9973; EPID L-2017-LLA-0276)," dated April 6, 2018 (ADAMS Accession No. ML18099A007).

6. Nuclear Energy Institute, "10 CFR 50.69 SSC Categorization Guidline," NEI 00-04, Revision 0, dated July 2005 (ADAMS Accession No. ML052900163).

7. Nuclear Management and Resources Council, Inc., "Guidelines for Industry Actions to Assess Shutdown Management," NUMARC 91-06, dated December 1991 (ADAMS Accession No. ML14365A203).

8. U.S. Nuclear Regulatory Commission, "Guidelines for Categorizing Structures, Systems, and Components In Nuclear Power Plants According to their Safety Significance,"

Regulatory Guide 1.201 (For Trial Use), Revision 1, dated May 2006 (ADAMS Accession No. ML061090627).

9. U.S. Nuclear Regulatory Commission, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Regulatory Guide 1.200, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014).

10. American Society of Mechanical Engineers/American Nuclear Society, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME/ANS RA-Sa-2009, dated February 2009.

11. U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Regulatory Guide 1. 174, Revision 3, dated January 2018 (ADAMS Accession No. ML17317A256).

12. U.S. Nuclear Regulatory Commission, "Regulatory Guide 1.200 Implementation,"

Regulatory Issue Summary 2007-06, dated March 22, 2007 (ADAMS Accession No. ML070650428).

13. Anderson, V. K., Nuclear Energy Institute, letter to Stacey Rosenberg, U.S. Nuclear Regulatory Commission, "Final Revision of Appendix X to NEI 05-04/07-12/12-16,

'Close-Out of Facts and Observations,"' dated February 21, 2017 (ADAMS Package Accession No. ML17086A431 ).

14. Electric Power Research Institute and U.S. Nuclear Regulatory Commission, "Fire PRA Methodology for Nuclear Power Facilities," NUREG/CR-6850, Volume 1: "Summary &

Overview," and Volume 2: "Detailed Methodology," dated September 2005, and Supplement 1 to NUREG/CR-6850, "Fire Probatilistic Risk Assessment Methods Enhancements," dated September 201 O (ADAMS Accession Nos. ML052580075, ML052580118, and ML103090242, respectively).

15. Giitter, J., U.S. Nuclear Regulatory Commission, letter to Mr. Biff Bradley, Nuclear Energy Institute, "Recent Fire PRA Methods Review Panel Decisions and EPRI 1022993, 'Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires,"'

dated June 21, 2012 (ADAMS Package Accession No. ML12172A406).

16. U.S. Nuclear Regulatory Commission and Electric Power Research Institute, "Joint

~ssessment of Cable Damage and Quantification of gffects from Eire (JACQUE-FIRE),"

NUREG/CR-7150, Volume 2: "Expert Elicitation Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure," dated May 2014 (ADAMS Accession No. ML14141A129).

17. Giitter, J. G., U.S. Nuclear Regulatory Commission, letter to Mr. Michael Tschiltz, Nuclear Energy Institute, "Supplemental Interim Technical Guidance on Fire-Induced Circuit Failure Mode Likelihood Analysis," dated April 23, 2014 (ADAMS Package Accession No. ML14111A366).

18. U.S. Nuclear Regulatory Commission, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Esimation Using the Updated Fire Events Database:

United States Fire Event Expereince Through 2009," NUREG-2169, dated January 2015 (ADAMS Accession No. ML15016A069).

19. Bradley, B., Nuclear Energy Institute, letter to Mr. Donald G. Harrison, U.S. Nuclear Regulatory Commission, "Recent Fire PRA Methods Review Panel Decision: Treatment of Electrical Cabinets," dated June 5, 2012 (not-publicly available).

20. Bradley, B., Nuclear Energy Institute, letter to Mr. Donald G. Harrison, U.S. Nuclear Regulatory Commission, "Recent Fire PRA Methods Review Panel Decisions:

Clarification for Transient Fires and Alignment Factor for Pump Oil Fires," dated September 27, 2011 (not-publicly available).

21. Bradley, B., Nuclear Energy Institute, letter to Ms. Mary T. Drouin, U.S. Nuclear Regulatory Commission, "NEI 12-13, External Hazards PRA Peer Review Process Guidelines," dated August 21, 2012 (ADAMS Package Accession No. ML122400044).

22. Franovich, M., U.S. Nuclear Regulatory Commission, letter to Mr. Greg Krueger, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Acceptance of Nuclear Energy Institute (NEI) Guidance NEI 12-13, 'External Hazards PRA Peer Review Process Guidelines' (August 2012)," dated March 7, 2018 (ADAMS Accession No. ML18025C025).

23. Harrison, D. G., U.S. Nuclear Regulatory Commission, letter to Mr. Biff Bradley, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, 'External Hazards PRA Peer Review Process Guidelines' Dated August 2012," dated November 16, 2012 (ADAMS Accession No. ML12321A280).

24. Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3 Docket Nos. STN 50-528, [50]-529, 50-530, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times,"

dated July 31, 2015 (ADAMS Accession No. ML15218A300).

25. U.S. Nuclear Regulatory Commission, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking," NUREG-1855, Revision 1, dated March 2017 (ADAMS Accession No. ML17062A466).

26. Giitter, J., and Ross-Lee, M. J., U.S. Nuclear Regulatory Commission, letter to Mr. Greg Krueger, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os)," dated May 3, 2017 (ADAMS Accession No. ML17079A427).

27. U.S. Nuclear Regulatory Commission, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," NUREG-1407, Final Report, dated June 1991 (ADAMS Accession No. ML063550238).

28. U.S. Nuclear Regulatory Commission, "Tornado Missile Protection," Regulatory Issue Summary 2015-06, dated June 10, 2015 (ADAMS Accession No. ML15020A419).

29. Markley, M. T., U.S. Nuclear Regulatory Commission, letter to Vice President, Operations, Entergy Operations, Inc., "Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed

Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems," dated April 22, 2009 (ADAMS Accession No. ML090930246).

30. American Society of Mechanical Engineers, "Risk-Informed Safety Classification for Use in Risk-Informed Repair/Replacement Activities," ASME Code Case, N-660, dated July 2002.

31. Electric Power Research Institute, "Treatment of Parameter and Modeling Uncertainty for Probabilistic Risk Assessments," EPRI TR-1016737, dated December 2008.

Principal Contributor: A. Brown Date: October 10, 2018

R. Bement

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3-ISSUANCE OF AMENDMENT NOS. 207, 207, AND 207 TO ADOPT 10 CFR 50.69, "RISK-INFORMED CATEGORIZATION AND TREATMENT OF STRUCTURES, SYSTEMS AND COMPONENTS FOR NUCLEAR POWER REACTORS" (CAC NOS. MF9971, MF9972, AND MF9973; EPID L-2017-LLA-0276) DATED OCTOBER 10, 2018 DISTRIBUTION:

PUBLIC RidsACRS_MailCTR Resource RidsNrrDorlLpl4 Resource RidsNrrLAPBlechman Resource RidsRgn4MailCenter Resource RidsNrrDraApla Resource RidsNrrDraAplb Resource RidsNrrPMPaloVerde Resource RidsNrrDeEseb Resource ABrown, NRR THilsmeier, NRR AZoulis, NRR MReisi-Fard, NRR GThomas, NRR DHeeszel, NRO ADAMS Access1on No.: ML18243A280 *b1y memoran d um **b1y e-ma1*1 OFFICE NRR/DORL/LPL4/PM N RR/DORL/LPL4/LA NRR/DRA/APLA/BC* NRR/DRA/APLB/TL

• PBlechman; NAME MOrenak LRonewicz SRosenberg MReisi-Fard DATE 9/10/18 9/7/18; 10/10/18 8/9/18 8/9/18 OFFICE OGC-NLO** NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME AGhosh RPascarelli MOrenak DATE 10/4/18 10/10/18 10/10/18 OFFICIAL RECORD COPY