RA-18-0175, Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

ML18291A606
Person / Time
Site:	Harris
Issue date:	10/18/2018
From:	Donahue J Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RA-18-0175
Download: ML18291A606 (52)

Text

Joseph Donahue Vice President Nuclear Engineering 526 South Church Street, EC-07H Charlotte, NC 28202 980-373-1758 Joseph.Donahue@duke-energy.com 10 CFR 50.90 October 18, 2018 Serial: RA-18-0175 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63

Subject:

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors

References:

1. Duke Energy letter, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors, dated February 1, 2018 (ADAMS Accession No. ML18033B768).

2. NRC letter, Request for Additional Information by the Office of Nuclear Reactor Regulation to Support the Review of License Amendment Request for Shearon Harris Nuclear Power Plant, Unit 1 to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, dated October 9, 2018 (ADAMS Accession No. ML18264A028).

Ladies and Gentlemen:

By letter dated February 1, 2018 (Reference 1), Duke Energy Progress, LLC (Duke Energy) submitted a license amendment request (LAR) for Shearon Harris Nuclear Power Plant (HNP),

Unit No. 1. The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors.

By letter dated October 9, 2018 (Reference 2), the Nuclear Regulatory Commission (NRC) staff requested additional information from Duke Energy that is needed in order to complete the LAR review.

The enclosure to this letter provides Duke Energys response to the NRC RAI. Attachment 1 is a list of PRA implementation items which must be completed prior to implementation of 10 CFR 50.69 at HNP. Attachment 2 contains proposed markups of the HNP Renewed Facility Operating License.

U.S. Nuclear Regulatory Commission Serial RA-18-0175 Page 2 The conclusions of the original No Significant Hazards Consideration and Environmental Consideration in the original LAR are unaffected by this RAI response.

There are no regulatory commitments contained in this letter.

In accordance with 10 CFR 50.91, Duke Energy is notifying the State of North Carolina of this LAR by transmitting a copy of this letter and enclosure to the designated State Official.

Should you have any questions concerning this letter and its enclosure, or require additional information, please contact Art Zaremba at (980) 373-2062.

I declare under penalty of perjury that the foregoing is true and correct. Executed on October 18, 2018.

Sincerely,

~~~

Joseph Donahue Vice President - Nuclear Engineering JLV

Enclosure:

Response to NRC Request for Additional Information cc:

Ms. C. Haney, NRC Regional Administrator, Region II Ms. M. Barillas, NRC Project Manager, HNP (Electronic Copy Only)

Mr. J. Zeiler, NRC Sr. Resident Inspector, HNP Mr. W. L. Cox, Ill, Section Chief, N.C. DHSR (Electronic Copy Only)

Serial: RA-18-0175 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Enclosure Response to NRC Request for Additional Information

U.S. Nuclear Regulatory Commission Page 2 of 44 Serial RA-18-0175 Enclosure NRC Request for Additional Information By letter dated February 1, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18033B768), Duke Energy Progress, LLC, (Duke Energy, the licensee), submitted a license amendment request (LAR) for Shearon Harris Nuclear Power Plant (HNP), Unit 1. The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR),

Section 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power plants, and provide the ability to use probabilistic risk assessment (PRA) models, the internal events PRA, internal flooding PRA, and internal fire PRA (FPRA) for the proposed 10 CFR 50.69 categorization process.

Regulatory Guide (RG) 1.201, Revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, May 2006 (ADAMS Accession No. ML061090627), endorses, with regulatory positions and clarifications, the Nuclear Energy Institute (NEI) guidance document NEI 00-04, Revision 0, 10 CFR 50.69 SSC [Structure, System, and Component] Categorization Guideline, July 2005 (ADAMS accession No. ML052910035), as one acceptable method for use in complying with the requirements in 10 CFR 50.69. Both RG 1.201 and NEI 00-04 cite RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, February 2004 (ADAMS Accession No. ML040630078), which endorses industry consensus PRA standards, as the basis against which peer reviews evaluate the technical acceptability of a PRA. Revision 2 of RG 1.200 issued March 2009 is available at ADAMS Accession No. ML090410014.

Section 3.1.1 of the LAR dated February 1, 2018, states that Duke Energy will implement the risk categorization process of 10 CFR 50.69 in accordance with NEI 00-04, Revision 0, as endorsed by RG 1.201. However, the licensees LAR does not contain enough information for the U.S. Nuclear Regulatory Commission (NRC) staff to determine if the licensee has implemented the guidance appropriately in NEI 00-04, as endorsed by RG 1.201, as a means to demonstrate compliance with all of the requirements in 10 CFR 50.69, including technical adequacy of the PRA models. The NRC staff requests additional information (RAI) for the following areas in order to complete its review.

PRA RAI 01 - PRA Technical Adequacy Determined by Capability Category (CC) II:

Section 3 of the LAR, dated February 1, 2018, requested the NRC staff to utilize the review of the PRA technical adequacy of previous LAR submittals. The information can be found in Issuance of Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, dated November 29, 2016 (ADAMS Accession No. ML16200A285), and Request for License Amendment to Adopt National Fire Protection Association (NFPA) Standard 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (2001 Edition), dated May 29, 2008 (ADAMS Accession No. ML081560641). of the LAR provides a list of open and partially resolved Facts and Observations (F&Os) and their associated supporting requirements (SRs).

U.S. Nuclear Regulatory Commission Page 3 of 44 Serial RA-18-0175 Enclosure Section 3.1.4.1 of Shearon Harris Nuclear Power Plant, Unit 1 - Issuance of Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-controlled dated November 29, 2016, states that SRs were identified to be assessed to meet CC-I with no associated F&Os (e.g., FSS-D7, FSS-D9). For any SRs not addressed by the references above in Attachment 3 of the LAR, provide the following:

a.

Justification that each of the SRs that were assessed to be CC-I or Not Met, in accordance with Section 2.1 of RG 1.200, Revision 2, does not impact the application.

b.

Alternatively, propose a mechanism that ensures those SRs not met at CC-II will be resolved prior to implementation of the 10 CFR 50.69 categorization process.

Duke Energy Response to PRA RAI 01:

A review of Harris fire PRA peer review reports (NRC and industry) and the 2017 F&O closure effort was conducted to identify all SRs at Not Met or CC I. There are six CC-I or Not Met SRs not addressed by the references above in Attachment 3 of the LAR. They are addressed individually below:

SR FSS-D7 at Capability Category II requires that, when crediting fire detection and suppression systems, generic estimates of total system unavailability should be used when these systems have not experienced outlier behavior with regards to unavailability. While a review of plant experience has not been explicitly compared to generic data, reliability and unavailability of fire detection and suppression systems is monitored. The monitoring program ensures that any adverse trends in reliability or unavailability are recognized and corrected.

Considering that HNP fire protection and detection systems are installed and maintained in accordance with applicable NFPA codes and standards via code compliance calculations (e.g.

HNP-M/BMRK-0001, Code Compliance Evaluation NFPA 72E, Automatic Fire Detectors and HNP-M/BMRK-0009, Code Compliance Evaluation NFPA 13, Sprinkler Systems), the aforementioned program ensures that the credited fire detection and suppression systems do not experience outlier behavior, such that use of generic data is acceptable. Therefore, there is no impact to the application.

SR FSS-D9 at Capability Category II/III requires a qualitative evaluation of the potential for smoke damage to the fire PRA equipment, and incorporation of the evaluation into the definition of fire scenario target sets. Smoke damage does not impact this application because the effects of smoke damage are adequately captured in the model. Appendix T of NUREG/CR-6850 states that of the four modes of smoke damage identified, only circuit bridging has the potential to introduce new risk-significant fire scenarios and that this mode of failure only impacts two classes of equipment; namely, printed circuit based components (including digital control and instrumentation circuits), and high-voltage power distribution devices (such as switchgear, MCCs, transformers, and breakers). Appendix T goes on to state that substantial smoke exposure densities are required to induce circuit bridging, such that a moderate fire in a large room may not approach damaging exposure levels. However, a small fire within a single confined space, such as an electrical panel or bank of connected panels, might cause damage.

The practical implications of the guidance contained in Appendix T of NUREG/CR-6850 is that short-term smoke damage (smoke damage during a fire event or shortly after suppression) is limited to electrical enclosures with high smoke concentration. In most cases, these high

U.S. Nuclear Regulatory Commission Page 4 of 44 Serial RA-18-0175 Enclosure concentrations of smoke will occur within the electrical panels physically connected to the fire origin, such as breaker cubicles within the same MCC where the fire started. Essentially, smoke damage is not postulated outside the interconnected panels adjacent to the cabinet of fire origin.

Appendix T of NUREG/CR-6850 further limits the vulnerable equipment to medium and high voltage switching or transmission equipment, and lower voltage instrumentation and control devices. The HNP fire PRA currently fails the entire electrical panel or bank of connected panels where a fire is postulated. This method encompasses the guidance for evaluating smoke damage provided in Appendix T for electrical panels. Appendix T further states guidance to assume that substantial quantities of smoke (e.g. from a large forest fire or large oil fire) will cause very high-voltage transmission equipment to trip off-line. The risk associated with a large forest fire is already captured in the internal events PRA by the loss of offsite power initiator, and would not need to be included in the fire PRA. Regarding large oil fires, based on the siting generally allowing smoke to disperse to atmosphere rather than collect to damaging concentrations, outside oil sources were screened. The only remaining oil source which was judged capable of producing smoke comparable to a large forest fire is the turbine oil system, which has a capacity of approximately 10,000 gallons. The large oil fire scenario associated with the turbine oil system fails all equipment within the turbine generator building, and any smoke damage effects on nearby high voltage transmission equipment of consequence are captured within that damage set. Therefore, there is no impact on the application because the Harris fire PRA currently encompasses the effects of smoke damage.

SR FSS-F2 at Capability Category II/III requires that if, per SR FSS-F1, one or more scenarios are selected that could damage exposed structural steel, ESTABLISH and JUSTIFY criteria for structural collapse due to fire exposure. Attachment 08 of Duke Energy calculation HNP-F/PSA-0079 documents discussion of the criteria used to evaluate the risk of fires which threaten structural steel damage. Therefore, this SR is considered to be MET at Capability Category II and there is no impact on the application.

SR FSS-H5 at Capability Category II requires documenting fire modeling output results for each analyzed fire scenario, including the results of parameter uncertainty evaluations. This SR addresses documentation only and has no quantitative impact on risk. Therefore, there is no impact on the application.

SR FSS-H6 at Capability Category I/II/II requires documenting a technical basis for any statistical models applied in the model, a technical basis for any plant-specific updates applied to generic statistical models, and any plant specific data applied. This SR addresses documentation only and has no quantitative impact on risk. Therefore, there is no impact on the application.

SR IGN-A4 at Capability Category II requires a review of plant-specific experience for fire event outlier experience, and an update of fire frequencies if outliers are found. Section 4.2.1 of Duke Energy calculation HNP-F/PSA-0071 documents that a review of plant specific fire event experience was performed and no outliers were identified. Therefore, this SR is considered MET at Capability Category II and there is no impact on the application.

U.S. Nuclear Regulatory Commission Page 5 of 44 Serial RA-18-0175 Enclosure PRA RAI 02 - Open/Partially Open Findings in the Process of Being Resolved:

Section 4.2 of RG 1.200 states, in part, that the LAR should include a discussion of the resolution of the peer review F&Os that are applicable to the parts of the PRA required for the application. This discussion should take the following forms:

x A discussion of how the PRA model has been changed and x

A justification in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application decision were not adversely impacted (remained the same) by the particular issue of the LAR, dated February 1, 2018, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items, provides finding-level F&Os that are still open or only partially resolved after the F&O closure review. Also, F&O descriptions and their dispositions were previously provided to the NRC in the past LAR to adopt Technical Specification Task Force (TSTF)-425, Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, (Relocate Surveillance Frequencies to Licensee Control-Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b),

dated August 18, 2015 (ADAMS Accession No. ML15236A254) and in the May 29, 2008 LAR to adopt NFPA Standard 805 (ADAMS Accession No. ML081560641). For the following F&O dispositions, provide additional information for NRC staff to conclude that the F&O is sufficiently resolved for this application.

a.

F&O 1-9 regarding internal flooding drain analysis The F&O closure team determined that drain analysis for the other buildings besides the reactor auxiliary building (RAB) was not performed and no qualitative evaluation was documented. The closure team provided an example of draining from the turbine building upper elevations to the basement that required assessment. The licensees disposition stated water will not accumulate from backflow through floor drains in these buildings and the assessment of these buildings, is not expected to impact the results.

The implication of this disposition is that the requested drain analysis for buildings other than the RAB have not been completed.

1.

Clarify if the drain analysis recommended by the closure team has been performed. If performed, summarize the analysis including how it impacts the flood analysis and the 10 CFR 50.69 categorization process.

2.

Provide justification, such as a sensitivity study, that the exclusion of the completed drain analysis has no impact on the 10 CFR 50.69 categorization results, or 3.

Alternatively, propose a mechanism that ensures F&O 1-9 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

U.S. Nuclear Regulatory Commission Page 6 of 44 Serial RA-18-0175 Enclosure Duke Energy Response to PRA RAI 02.a.:

The drain analysis was completed RAB, which contains the majority of the IF-PRA risk. Other buildings (such as the Turbine Building or Diesel Generator Building) were not assessed at the time, as inclusion of the drain propagation analysis would not provide any meaningful risk insights. The peer review team correctly noted that a drain analysis for the Turbine Building would not be needed with the exception of the Turbine Building basement.

The HNP Turbine Building is an open air structure at the non-basement elevations that lacks walls or other barriers that would allow for water to accumulate to generate a significant hydrostatic driving force to allow for a large amount of water to propagate via drain backflow.

Any depths of water in the Turbine Building would be limited by the lack of barriers that would allow for water to accumulate and the large open floor space in the Turbine Building.

Propagation to the Turbine Building basement would originate from the open stairways and floor penetrations not from floor drains. Propagation to the basement from floor drains would be a secondary pathway that would not be as significant as propagation from stairwells, floor penetrations, wall penetrations or door failures. The Turbine Building basement, like the other elevations in the Turbine Building, is a large open area with a substantial amount of floor area available for water to accumulate. Walkdowns performed found that the lowest PRA component on this elevation was at 41 inches above the Turbine Building basement floor though 36 inches will be used to be conservative. From the Turbine Building general arrangement drawing it was found to reach a depth of three feet approximately 250,000 gallons of water would need to accumulate. This calculation is further conservative as it did not consider the volume of condenser sump or condenser pit. These volumes are substantial (as identified via a walkdown) and found to be able to hold an additional volume of water (though this volume is not credited).

As this volume is substantial and the ability of the Turbine Building drains to provide a large flowrate via backflow is limited there will be no impact on the component importance measures.

The peer review team also noted that backflow from tanks was not evaluated. The only tank in the RAB area that would receive water from the drains in the RAB is the floor drain tank (FDT).

The FDT is located in a water tight room. This room is 19.5 by 20 with a watertight rating of 10 high. This results in a total volume of approximately 29,000 gallons. Once this is exceeded it will then need to fill up elevation 190 to its critical height. As the FDT room can store a substantial amount of water this scenario would either not be included in the IFPRA or would be bounded by another more substantial scenario. Therefore inclusion of this specific scenario would not change the overall risk results or insights and therefore would not have an impact on the quantified importance measures. Propagation from overfilling sumps is not an issue as the sumps are located on the 190 elevation of the RAB and are fed from the floor drains on the 190 elevation. Therefore, for these sumps to overfill into the 190 elevation significant flooding would already be occurring on elevation 190.

The floor drains in the EDG building were not evaluated to determine whether inter drain propagation could occur. These drains were subsequently re-evaluated and found to connect the EDG A and EDG B compartments. The worst case scenario would be the dual loss of the EDGs. This loss would be limited to only the EDGs as the EDG Building is a separate structure that does not communicate directly with any other structures. In addition, since this scenario would not require an automatic or expedient manual shutdown, it is screened from further analysis.

U.S. Nuclear Regulatory Commission Page 7 of 44 Serial RA-18-0175 Enclosure b.

F&O 1-18 regarding assessment of door failure modes The F&O closure team stated the updated analysis did not include all critical failure modes and that the door failure criteria may not be appropriate for all door types. The disposition states that [re]examination is not expected to significantly change the timing or impacts of any flooding sequence (because of the very large rooms at HNP), and is not expected to affect categorization. The NRC staff notes that changes in door failures can affect propagation path effects and timing, which can affect flood operator actions and impact scenario risk values. Therefore:

1.

Provide justification, such as a sensitivity study, that not performing the cited door failure calculations and subsequent flood scenario analysis has no impact on the 10 CFR 50.69 categorization results, or 2.

Alternatively, propose a mechanism that ensures F&O 1-18 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 02.b.:

The calculated water height for door failure relies on a HNP civil engineering calculation. This calculation examined the potential load from water on a tornado rated door. While this door is representative of doors found in HNP it is not the only door type found in HNP. While this is the case the calculated door height is not unreasonable for the other subset of doors found and is generally considered a modeling assumption that is consistent with the state of practice in the industry. The EPRI guidelines for performing an IFPRA do not specifically give a door height failure (one is recommended though site specific values are normally preferred). The HNP calculated value is near the value calculated in the supporting appendix of the EPRI IFPRA guidelines Appendix D for a standard plant hollow metal door. Bending or warping of the door is not a catastrophic failure of the door and is normally akin to water flow underneath the door.

Catastrophic failure is preferred such that a conservative propagation pathway can be assessed in a timeline that would normally preclude operator isolation actions (again to increase the amount of components impacted). Therefore the current treatment is appropriate for the HNP IFPRA.

As discussed in the response to PRA RAI 05.b, uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria) are being addressed by the sensitivity study required by section 8.1 of NEI 00-04 and performance monitoring of low safety significant (LSS) components as required by 10 CFR 50.69(e)(3). As discussed in PRA RAI 05.b, the sensitivity and monitoring program are sufficient to address model uncertainties and assumptions not related to components which were excluded from the model. Since the door height failure assumption potentially affects propagation paths and timing, which can affect flood operator actions and impact scenario risk values, it did not result in any components being excluded from the model. Therefore, this assumption is appropriately addressed by the sensitivity study and performance monitoring program.

U.S. Nuclear Regulatory Commission Page 8 of 44 Serial RA-18-0175 Enclosure c.

F&O 1-19 regarding operator action cues used to isolate internal flooding The F&O closure team found the 5-minute cue timing related to the operators isolating flooding based on specific alarms that indicate floods in each flood area is not sufficient.

The licensees disposition states that Duke Energy performed a sensitivity where the cue times were increased by a factor of 3, and there was minimal impact on the flooding results. Therefore:

1.

Provide justification that a 15-minute delay is a reasonable upper bound for cues indicating floods, or 2.

Alternatively, propose a mechanism that ensures F&Os 1-7 and 1-19 will be resolved prior to implementation of the 10 CFR 50.69 categorization process.

This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 02.c.:

A 15-minute delay was judged to be a reasonable upper bound for cues indicating floods, as this timing is 3 times the realistic estimate (5 minute cue). Contrary to the F&O closure teams notes, the 5 minute cognitive time is deemed appropriate. Each flood isolation action is on a per system basis. Therefore the 5 minutes is used to diagnose the break from indications observed from the control room (for example, low header pressure for ESW/NSW, fire header pressure decrease, fire pump activation). Given that the operators would likely get two cues that would strongly indicate an internal flood was occurring the 5 minutes was deemed to be reasonable.

The first cue operators would get in the control room would be a system specific indication that a rupture has occurred in a system. The second indication that they would receive would likely be a sump alarm or increase in the floor drain tank level. Given these two indications 5 minutes is an appropriate and realistic value for the cognitive time portion of the human failure event.

Increasing this value would drive the human error probability higher but would no longer be realistic.

Had the human failures been created to cover multiple systems the cognition time would need to be increased to allow for operators to diagnose which system had the rupture.

Additionally, during 50.69 categorization a sensitivity is performed to set all human error events to their 5th and 95th percentile values. Completing this sensitivity will show the impact of operators success or failure to address flood impacts regardless of cue timing. This sensitivity will provide risk insights for equipment importance measures for internal flood scenarios with and without operator action. Finally, the sensitivity required by section 8.1 of NEI 00-04 which increases the failure probability of all low safety significant (LSS) components by a factor of 3 ensures that the impact on component importance measures of any under-or over-reliance on operator actions to address flood impacts will not result in exceeding the RG 1.174 acceptance guidance for delta CDF and LERF.

d.

F&O 2-4 regarding induced failure mechanisms from high energy line break (HELB) events The initial Harris HELB analysis was performed using a zone of influence (ZOI) of 20 feet or ten times the inner pipe diameter, whichever is greater, to determine which SSCs may be impacted. The F&O closure team noted that analysis beyond the

U.S. Nuclear Regulatory Commission Page 9 of 44 Serial RA-18-0175 Enclosure currently defined ZOI is needed to properly assess these failure mechanisms. The licensees disposition states that [t]he ZOI calculation is based on Sandia National Laboratory (SNL) analyses and has been accepted by the NRC in previous industry submittals. The additional analysis is beyond the requirements of the Standard.

Therefore:

1.

Provide references to the SNL analyses and NRC acceptance of previous NRC submittals. Provide the specific guidance from the SNL document related to determining HELB impacts, the applicability of the ZOI determination for the different potential HELB impacts (e.g., jet impingement, pipe whip, high temperature, high humidity, etc.), and describe how the HNP analysis was conducted in accordance with this reference.

2.

If the methodology cannot be shown to have been previously accepted by the NRC, provide justification for the use of this methodology and discuss the impact of its use on the results of the 10 CFR 50.69 categorization process, or 3.

Alternatively, propose a mechanism that ensures F&O 2-4 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 02.d.:

The HNP IFPRA HELB analysis was performed using the basis of NUREG/CR-2913 Two-phase Jet Loads developed by Sandia National Laboratory in 1983. This is a generally accepted industry methodology for assessment of HELB scenarios. Specifically, the use of jet impingement evaluations has been previously reviewed and approved by the NRC, and a 10D value has been assumed for the limit of jet damage Consistent with the methodology. As an example, the acceptability of this approach is documented in Supplement 6 of the Watts Bar Safety Evaluation Report (SER) (ML072060464). From the Watts Bar SER:

The applicant has given the staff information requiring the analysis of jet impingement loads for postulated breaks. In FSAR section 3.6A.1.1.2, test data and analysis developed in NUREG/CR-2913, Two Phase Jet Loads, dated January 1983, are used to establish the criterion that unprotected components located more than 10 diameters from a pipe break are without further analysis assumed undamaged by a jet of steam or subcooled liquid that flashes at the break. The staff has previously reviewed the methodology used in NUREG/CR-2913 for determining the effects of such a jet on components at a distance greater than 10 diameters and has found it acceptable.

Additionally, detailed GOTHIC analysis performed for a main steamline break in the steam tunnel with the tunnel door to the RAB open shows that the temperature and the humidity for much of the elevation staying below typical failure setpoints of equipment. Temperatures never approach 200 F and humidity, while elevated, does not reach severely abnormal values that would challenge equipment performance. This analysis supports the conclusion of using the 10 diameter ZOI is appropriate at determining HELB impacts.

U.S. Nuclear Regulatory Commission Page 10 of 44 Serial RA-18-0175 Enclosure e.

F&O HRA-C1-3 regarding detailed analyses for significant human failure events (HFEs)

CC-II for SR HR-G1 (previously HRA-C1) of the ASME/ANS PRA standard requires a detailed analysis to estimate human error probabilities (HEPs) for significant HFEs and conservative estimates for non-significant HFEs. In Attachment 3 of the LAR, dated February 1, 2018, the disposition to F&O HRA-C1-3 states that some significant HFEs were not selected for detailed analysis and were instead conservatively assumed to be failed or left at a screening value. However, the significant operator actions that were selected for detailed analysis are sufficient to provide risk insights for the 50.69 application. Therefore:

1.

Provide justification, such as a sensitivity study, that the significant HFEs which are assumed failed or left at screening value have no impact on the 10 CFR 50.69 categorization results compared to completion of a detailed analysis.

2.

Alternatively, perform a detailed analysis and provide the results for the HFEs that were conservatively assumed to be failed or left at screening value, and demonstrate these significant HFEs have no impact on the 10 CFR 50.69 categorization results.

Duke Energy Response to PRA RAI 02.e.:

In the HNP Fire PRA, there are four HFEs which fall into the risk significant definition of Fussell-Vesely greater than 0.005 or Risk Achievement Worth greater than 2.0, and which do not have detailed analyses performed. Rather than complete items 1 or 2 above, Duke Energy will resolve F&O HRA-C1-3 by performing detailed analyses for these four HFEs and incorporating the results into the FPRA model prior to implementation of 10 CFR 50.69. Incorporating the detailed analyses into the model resolves the finding to CC-II, therefore, this finding will have no impact on categorization results.

f.

F&O FSS-F3-01 regarding exposed structural steel fire scenarios The disposition provided in the Shearon Harris Nuclear Power Plant, Unit 1 - Issuance of Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-controlled Program, provides a qualitative description of viable fire scenarios related to exposed structural steel near a large fire source in the turbine building. It states that a dedicated water spray (deluge) suppression system is provided near the large oil relate fire hazards and provides assurance the fire affects remain localized. It was assessed not to have any measureable impact on core damage frequency/large early release frequency (CDF/LERF). The NRC staff notes that minimal impacts to CDF and LERF could increase certain SSCs above the NEI 00-04 risk. of the LAR, dated February 1, 2018, lists this F&O having been assessed at CC-I, since a qualitative assessment was performed and retained in a licensee document. The disposition continues by stating a quantitative assessment has been performed in another licensee calculation and is sufficient to meet CC-II. Neither the TSTF-425 nor the NFPA-805 documents referenced in PRA RAI 01 provide details of

U.S. Nuclear Regulatory Commission Page 11 of 44 Serial RA-18-0175 Enclosure the calculation and if the scenarios have been implemented in the fire PRA model. The NRC staff seeks clarification on the current status for this F&O. Therefore:

1.

If currently assessed as CC-I, provide justification that this capability category has no impact on the 10 CFR 50.69 categorization process. Include in this discussion how the Harris 10 CFR 50.69 process will categorize the SSCs related to these excluded fire scenarios, or 2.

If currently assessed as CC-II, confirm that the related fire scenarios have been included in the FPRA model used for the 10 CFR 50.69 categorization process, or 3.

Alternatively, propose a mechanism that ensures F&O FSS-F3-01 will be resolved prior to implementation of the 10 CFR 50.69 categorization process.

This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 02.f.:

In response to HNP Fire model F&O FSS-F3-01, Duke Energy developed a qualitative and quantitative response. The finding was originally assessed by the peer review as not met.

However, when the F&O closure team reviewed the qualitative assessment, they found it acceptable to meet the requirements of CC-I. The current status of this SR as assessed by an independent team is CC-I.

The quantitative analysis developed in response to this item includes scenarios to address fire induced failure of structural steel in the Turbine Building. The Turbine Building was previously determined to be the only structure vulnerable to the fire induced structural steel failure as documented in the HNP fire PRA. The F&O closure team reviewed the screening and found it acceptable. Additionally, the F&O closure team performed a cursory review of the quantitative evaluation and found the approach applied was appropriate. The F&O closure team noted that the scenarios need to be incorporated into the overall model in order to close the finding.

Duke Energy will incorporate the scenarios into the PRA model and PRA documentation prior to implementation of 10 CFR 50.69. The scenario development, documentation, and incorporation into the PRA model meet FSS-F3 at capability category II/III, which is acceptable for this application.

U.S. Nuclear Regulatory Commission Page 12 of 44 Serial RA-18-0175 Enclosure PRA RAI 03 - Qualitative Function Categorization:

The LAR dated February 1, 2018, Table 3-1 indicates that the evaluation of the seven qualitative criteria defined in Section 9.2 of NEI 00-04 is performed at the function level and prior to the Integrated Decision-making Panel (IDP). The LAR states that NEI 00-04 only requires the seven qualitative criteria in Section 9.2 of NEI 00-04. to be completed for components/functions categorized as [low safety significant] LSS. LAR Table 3-1 contains the entry Allowable at the intersection of the IDP change HSS [high safety significant] to LSS column and Qualitative Criteria row, which appears to contradict the premise that the seven criteria are only applied to LSS functions. The guidance in NEI 00-04 states that the IDP should consider the impact of loss of the function/structure, system, and component (SSC) against the remaining capability to perform the basic safety functions. Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS including a clarification of the Allowed entry in LAR Table 3-1.

Duke Energy Response to PRA RAI 03:

The assessments of the qualitative considerations are agreed upon by the Integrated Decision-making Panel (IDP) in accordance with NEI 00-04 Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration, however the final assessments of the seven considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step.

Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e. all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

PRA RAI 04 - Passive Categorization Process:

The LAR, dated February 1, 2018, Section 3.1.2, Passive Categorization Process, states that passive components and the passive function of active components will be evaluated using the method for risk-informed repair/replacement activities consistent with the safety evaluation issued by the Office of Nuclear Reactor Regulation, Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and

U.S. Nuclear Regulatory Commission Page 13 of 44 Serial RA-18-0175 Enclosure Fourth 10-Year In-service Inspection Intervals, for Arkansas Nuclear One, Unit 2 (ANO-2),

dated April 22, 2009 (ADAMS Accession No. ML090930246). The LAR further states that this methodology will be applied to determine the safety significance of Class 1 SSCs.

The NRC staff notes that this methodology has been approved for Class 2 and Class 3 SSCs.

Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequence of pressure boundary failure for Class 1 SSCs may be different than that for Class 2 and Class 3 SSCs. Therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

The LAR does not justify how the ANO-2 methodology can be applied to HNP Class 1 SSCs and how sufficient defense-in-depth and safety margins are maintained.

Provide the requested technical justification or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 SSCs.

Duke Energy Response to PRA RAI 04:

The passive categorization process is intended to apply the same risk-informed process accepted by the NRC in the ANO2-R&R-004 for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N-660 and N-662 as published in Regulatory Guide 1.147, Revision 15. Both code cases employ a similar risk-informed safety classification of SSCs in order to change the repair/ replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned high safety-significant, HSS, for passive categorization which will result in HSS for its risk-informed safety classification. This classification cannot be changed by the IDP.

PRA RAI 05 - Identifying Key Assumptions and Uncertainties that could Impact the Application:

Section 4.2 of RG 1.200 states for licensee submittal documentation, [i]dentification of the key assumptions and approximations relevant to the results used in the decision-making process, is to be provided. Section 1.3 of RG 1.200 describes the level of detail of a PRA required and states that [i]n general, the level of detail for the base PRA needs to be consistent with current good practice. Current good practices are those practices that are generally accepted throughout the industry and have shown to be technically acceptable in documented analyses or engineering assessments.

Section 3.2.7 of the LAR, dated February 1, 2018, states that, [t]he detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 (Revision 0) and Section 3.1.1 of [Electric Power Research Institute (EPRI) Technical Report (TR)]-1016737. The NRC staff notes that one of these sources has been superseded by a revision (Revision 1 of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, March 2017; ADAMS Accession No. ML17062A466), which references the updated EPRI guidance (TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (2012)).

U.S. Nuclear Regulatory Commission Page 14 of 44 Serial RA-18-0175 Enclosure of the LAR contains 13 key assumptions/uncertainties from three PRA models, whereas industry guidance documents such as NUREG-1855, Revision 1, and EPRI TR-1026511 address a larger number of potential assumptions and uncertainties.

The LAR continues, [t]he list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

The NRC staff notes that Stage E of NUREG-1855 (Revision 1) provides guidance on how to identify key sources of uncertainty relevant to the application.

To address the observations above, provide the following:

a.

Provide a detailed summary of the process used to determine the sources of uncertainty and assumptions presented in Attachment 6 of the LAR. Include in this discussion an explanation of how the process is in accordance with NUREG-1855, Revision 1, or other NRC-accepted method. Also include in the discussion a detailed description of how the final set of uncertainties and assumptions were developed from the initial comprehensive list of PRA model(s) uncertainties and assumptions.

Duke Energy Response to PRA RAI 05.a.:

Step E-1 (section 7.2) of NUREG 1855, Revision 1 provides guidance for identifying and characterizing those sources of model uncertainty and related assumptions in the PRA required for the application.

Substep E-1.1 of the NUREG recommends using the detailed guidance and a generic list of sources of model uncertainty and related assumptions in EPRI 1016737 for the internal event hazard group (including LERF), and using the examples of sources of model uncertainty for the internal fires, seismic, Low Power Shutdown and Level 2 hazard groups in EPRI 1026511. For HNP, this process was performed by reviewing PRA documentation for generic issues identified in Table A.1 of EPRI 1016737, as well as identifying plant-specific assumptions and uncertainties, and is therefore consistent with step E-1.1 of the NUREG. EPRI 1026511 was not explicitly used to identify generic uncertainties in models other than the internal events model. However, of the models addressed by EPRI 1026511, only the HNP fire PRA is being used to support the current application. For the fire PRA, Appendix V of NUREG/CR-6850 identifies sources of uncertainty at a general level. These sources of uncertainty were used in lieu of those in EPRI 1026511, as well as identifying plant-specific assumptions and uncertainties.

Substep E-1.2 of NUREG 1855, Revision 1 involves identifying those sources of model uncertainty and related assumptions in the base PRA that are relevant to an application. Those that are irrelevant can be screened from further discussion. However, since this application uses the internal events, internal flood, and fire PRA models for both CDF and LERF, all model uncertainties and related assumptions identified for these models are considered relevant. The original process screened some based on other factors, which is not consistent with the latest version of the NUREG.

U.S. Nuclear Regulatory Commission Page 15 of 44 Serial RA-18-0175 Enclosure Substep E-1.3 of NUREG 1855, Revision 1 involves characterizing the identified sources of model uncertainty and related assumptions. This characterization involves understanding how the identified sources of model uncertainty and related assumptions can affect the PRA. For the HNP uncertainty analysis, this was performed for all identified uncertainties/assumptions.

Substep E-1.4 is a qualitative screening process that involves identifying and validating whether consensus models have been used in the PRA to evaluate identified model uncertainties. As stated in NUREG 1855, Rev. 1, the use of a consensus model eliminates the need to explore an alternative hypothesis. For the HNP uncertainty analysis, some uncertainties/assumptions were screened based on their use of a consensus method, however, others were screened based on additional criteria, which again is not entirely consistent with the NUREG.

Once all relevant uncertainties/assumptions are identified in Step E-1, Step E-2 (section 7.2) of NUREG 1855, Rev. 1 provides guidance for identifying those sources of model uncertainty and related assumptions that are key to the application. The input to this step is the list of the relevant sources of model uncertainty identified in Step E-1. These sources of model uncertainty and related assumptions are then quantitatively assessed to identify those with the potential to impact the results of the PRA such that the applications acceptance guidelines are challenged. This assessment is made by performing sensitivity analyses to determine the importance of the source of model uncertainty or related assumption to the acceptance criteria or guidelines. In the HNP uncertainty analysis, this step was performed qualitatively, not quantitatively, and therefore is not entirely consistent with the NUREG.

For those uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria), Stage F (section 8) of NUREG 1855, Rev. 1, provides guidance on justifying the strategy used to address the key uncertainties that contribute to risk metric calculations that challenge application-specific acceptance guidelines. This portion of the NUREG was not addressed in the original HNP uncertainty analysis.

b.

If the process of identifying key sources of uncertainty or assumptions for these PRA models cannot be justified, provide the results of an updated assessment of key sources of uncertainty or assumptions.

Duke Energy Response to PRA RAI 05.b.:

The process for identifying sources of uncertainty and assumptions is described, and compared to the process outlined in NUREG-1855 rev. 1, in the response to item a. This comparison shows that the initial HNP identification of sources of model uncertainties and related assumptions was consistent with Substep E-1.1 of the NUREG, with the exception that generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were not explicitly reviewed.

However, the process to assess the identified uncertainties/assumptions was not entirely consistent with all portions the latest revision of the NUREG. As such, an updated assessment was performed, as described below.

Since the ultimate goal in assessing model uncertainty is to determine whether (and the degree to which) the risk metric results challenge or exceed the quantitative acceptance guidelines for the application, due to sources of model uncertainty and related assumptions, the first step in the updated evaluation was to identify the risk metrics used as acceptance guidelines for the 10

U.S. Nuclear Regulatory Commission Page 16 of 44 Serial RA-18-0175 Enclosure CFR 50.69 categorization process. For 10 CFR 50.69 categorization, the acceptance guidelines are actually threshold values for Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) for each SSC being categorized, above which the SSC is categorized as high safety significant (HSS), and below which the SSC is categorized as low safety significant (LSS). As described in Step E-2 of the NUREG, each relevant uncertainty/assumption requires some sort of sensitivity analysis, and each sensitivity performed to evaluate an uncertainty/assumption involves some change to the PRA results. Since any change to the PRA results has the potential to change the F-V and RAW importance measures for all components (SSC), every relevant uncertainty/assumption has the potential to challenge the acceptance guidelines. That is, since RAW and F-V are relative importance measures, any change to any part of the model will generate a new set of cutsets and potentially impact the RAW and F-V for every SSC.

Thus, the only way to evaluate the impact of a sensitivity is to quantify the sensitivity case and compare the F-V and RAW values for all SSCs against the base case F-V and RAW values to determine if any exceed the HSS threshold in the sensitivity case that did not previously do so.

However, as stated in Stage F of NUREG-1855 rev. 1 (section 8.1), an appropriate method for dealing with uncertainties and related assumptions that challenge or exceed the acceptance guidelines is to use compensatory measures or performance monitoring requirements. Section 8.5 of the NUREG states that performance monitoring can be used to demonstrate that, following a change to the design of the plant or operational practices, there has been no degradation in specified aspects of plant performance that are expected to be affected by the change. This monitoring is an effective strategy when no predictive model has been developed for plant performance in response to a change. Since no predictive model of the increase in unreliability following alternative treatment of LSS SSCs exists, this option is appropriate for 10CFR 50.69. In fact, the example of a performance monitoring approach to address key uncertainties/assumptions given in section 8.5 is the factor of increase sensitivity combined with the performance monitoring process described for 10CFR 50.69 in NEI 00-04. The NUREG states:

One example of such an instance is the impact of the relaxation of special treatment requirements (in accordance with 10 CFR 50.69) on equipment unreliability. No consensus approach to model this cause-effect relationship has been developed.

Therefore, the approach adopted in NEI 00-04 as endorsed in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, [NRC, 2006a] is to:

• Assume a multiplicative factor on the SSC unreliability that represents the effect of the relaxation of special treatment requirements.

• Demonstrate that this degradation in unreliability would have a small impact on risk.

Following acceptance of an application which calls for implementation of a performance monitoring program, such a program would have to be established to demonstrate that the assumed factor of degradation is not exceeded.

The use of the sensitivity study required by section 8.1 of NEI 00-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. The impact of any key uncertainty or assumption sensitivity would be to potentially cause an SSC to be categorized as HSS when the base PRA analysis

U.S. Nuclear Regulatory Commission Page 17 of 44 Serial RA-18-0175 Enclosure showed it to be LSS. The potential impact of categorizing an SSC as LSS rather than HSS is that the SSC could have alternative treatments applied to it and as such, the possibility exists that the reliability of SSC could be reduced (i.e., the specified aspect of plant performance that is expected to be affected by the change is the reliability of the SSC). Per section 8.1 of NEI 00-04, a sensitivity is performed which assumes the unreliability of all LSS components is increased by a factor of 3 to 5. Since, as discussed in NEI 00-04, no significant decrease in reliability is expected, this is very conservative. Additionally, since the failure probability of all LSS SSCs are increased at the same time in the sensitivity, this approach addresses all uncertainties/assumptions which could potentially impact the LSS/HSS categorization. The LSS sensitivity then must be shown to demonstrate that even assuming this factor increase, the quantitative guidelines of Reg. Guide 1.174 are not exceeded. Thus, the LSS sensitivity demonstrates that the potential impact of all uncertainties/assumptions is acceptable.

Additionally, a performance monitoring program must be established as part of the 10 CFR 50.69 process (per NEI 00-04 section 12) which will monitor the reliability of all LSS SSCs to ensure that the factor of increase assumed in the sensitivity is not exceeded. This ensures the validity of the sensitivity study following implementation.

It is noted that uncertainties/assumptions which are related to SSCs being excluded from the PRA model, may not be adequately addressed by the above sensitivity and performance monitoring program. These SSCs may have been excluded because they are not believed to be required for accident mitigation, because they perform a backup function to other equipment but were conservatively not credited in the model, because their failure probability is negligible, etc. If an SSC is not in the PRA model, but actually performs (or could perform) an accident mitigation function, and that SSC is categorized as LSS (based on non-PRA criteria) the factor increase sensitivity would not appropriately address the uncertainty associated with this assumption/uncertainty. This is because if there are no failure events in the PRA model for the SSC, the LSS sensitivity study has no events to which to apply the factor of increase.

Based on the above discussion, an updated assessment of sources of uncertainty and assumptions was performed. All uncertainties and assumptions identified in the original HNP process consistent with Substep E-1.1 of NUREG-1855 rev. 1 (i.e., all identified internal events, internal flood, and fire uncertainties/assumptions), and the generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were reviewed to identify any that are not adequately addressed by the factor increase sensitivity study required by Section 8.1 of NEI 00-04 and the performance monitoring program required by Section 12 of NEI 00-04. The table below provides details of these uncertainties and their disposition for the 10 CFR 50.69 categorization process. Due to the large number of uncertainties/assumptions that are adequately addressed by the factor increase sensitivity study and performance monitoring program (in excess of 1000), these are not listed.

U.S. Nuclear Regulatory Commission Page 18 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 1

Backflow through an idle RHR pump requires at least two check valve failures and a pump failure, and is therefore probabilistically insignificant and is not considered in the model.

HNP-F/PSA-080,,

Item 34.

In the HNP PRA model, failure probability of an RHR pump to start and run for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is approximately 1.0E-03. The failure probability of a single check valve to close is approximately 2.4E-04 per demand. Assuming a very conservative common cause factor for the second check valve of 0.2, the probability of the common cause failure of two check valves is 4.8E-05. Therefore, the likelihood of this failure mode is approximately 5E-08. This failure is equivalent to the failure of an RHR pump. Since the probability of this failure mode of the RHR pump is more than 2 orders of magnitude lower than the failure probability of the RHR pump (1.0E-03), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 19 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 2

Diverting flowpaths from the low head safety injection header to the high head headers is not considered credible since it would require failures of at least three check valves, start and subsequent failure of all charging pumps (CSIPs),

and failures of two additional motor-operated isolation valves to establish a flowpath to the non-safety portions of the CVCS HNP-F/PSA-080,,

Item 39.

In the HNP PRA model, the failure probability of a single check valve to close is approximately 2.4E-04 per demand. Assuming a very conservative common cause factor for the second check valve of 0.2, the probability of the common cause failure of two check valves is 4.8E-05. The common cause failure of two CSIPs to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is approximately 2.7E-06.

Thus, even ignoring the two additional MOV failures, the likelihood of this failure mode is 1.3E-10. This failure is conservatively assumed to be equivalent to the failure of both RHR pumps. Since the probability of this failure mode of both RHR pumps is more than 2 orders of magnitude lower than the common cause failure probability of the RHR pumps (8.9E-05), it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 20 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 3

A spurious signal to the containment sump isolation valves causing a flowpath from the RWST to containment is not considered credible since three separate ESFAS relays would have to spuriously operate to open two in series valves.

However, even if this were to occur, there would be no limiting impact on the RHR system, since the suction source would continue to be available throughout the event, as the RHR pump is at the low point in the system.

HNP-F/PSA-080,,

Item 40.

These spurious actuations would only be an issue prior to swapover to sump recirculation which typically occurs within the first few hours of an event. Even assuming a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> exposure time, and using the HNP PRA model failure probability for spurious operation of an ESFAS relay of 8.1E-7/hr, the probability of this spurious actuation is 9.72E-06.

A CCF of 3 would be expected to be at least 2 orders of magnitude lower, since the common failure mode of a spurious operation would have to manifest itself over the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> mission time. It is therefore estimated that the likelihood of this event is approximately 1E-07. This failure is conservatively assumed to be equivalent to a common cause failure of the RHR pumps. Since the probability of this failure mode is more than 2 orders of magnitude lower than the common cause failure probability of the RHR pumps (8.9E-05), it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 21 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 4

ESFAS actuations are considered only for those components of significance for prevention of core damage or containment failure. Components having limited impact on the safe shutdown of the plant and mitigation of accidents are not addressed in this analysis. Thus, the list of ESFAS actuations identified in this document represents a subset of all actuations performed by the ESFAS.

HNP-F/PSA-080,,

Item 48.

Adding ESFAS components which provide additional signals that accomplish the same functions will decrease the importance of the components which are modeled as performing those functions.

However, the importance of the ESFAS components that are not modeled would obviously be understated. As such, if the ESFAS system is categorized, appropriate surrogate components will be used to develop importance measures for those components that are not modeled but which have the capability of performing a PRA function.

5 Relays which are part of the control circuit for a valve or pump are not modeled.

They are considered part of the failure probability for that component.

HNP-F/PSA-080,,

Item 60.

Although no importance measures will be generated for the relays in the PRA model, if the system containing the relays is categorized, an appropriate surrogate PRA event will be used for the relay since it supports the function of the pump or valve. Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

U.S. Nuclear Regulatory Commission Page 22 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 6

Steam generator sample lines and blowdown lines automatically isolate on the same signals which actuate the AFW system. Failure of the lines to isolate would divert AFW flow from the affected steam generator without a liquid to steam phase change and so would reduce the heat removal capability of the condensate storage tank inventory.

Isolation of these lines is accomplished by two in series isolation valves which fail close on loss of air or power. Due to the low probability of failure to isolate a line based on the configuration (fail-closed air operated valves), and the fact that this failure alone would divert flow from only one steam generator, and so additional failures of pumps or flowpaths to other steam generators would be required for a loss of the AFW function, this failure is not considered in the model.

HNP-F/PSA-080,,

Item 69.

Since failure of the isolation signal to blowdown and sample line isolation valves also fails the AFW pump start, only the failure of the isolation valves would need to be addressed. In the HNP PRA model, the probability for an air operated valve failing to close is 3.9E-03 per demand. Assuming a common cause factor of 0.1, the common cause failure probability of both AOVs for a single SG is 3.9E-04.

Additionally, for the SG blowdown lines, emergency operating procedures have operators check that SG blowdown isolation has occurred. If both AOVs failed to close, operators can use a third flow control valve to isolate blowdown. Since this valve is of a different design and in a different location, it would not have a common cause failure mode with the other two. Conservatively assuming an operator failure rate of 1.0E-02 for the action (based on the long time available to address the flow diversion and availability of indication of valve position and SG level), and a valve failure rate of 3.9E-03, the probability of operators failing to isolate blowdown is 1.4E-

02. Thus, the likelihood of this event is estimated to be approximately 5.5E-06. This failure is equivalent to a failure of one AFW pump. Since the probability of this failure mode is more than 2 orders of magnitude lower than the AFW pump failure probability (1.0E-03), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 23 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 7

Back-flow through an idle

[motor driven AFW] pump requires at least two check valve failures and a pump failure, and is therefore not considered in the model.

HNP-F/PSA-080,,

Item 101.

In the HNP PRA model, failure probability of a motor driven AFW pump to start and run for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is approximately 1.0E-03. The failure probability of a single check valve to close is approximately 2.4E-04 per demand.

Assuming a very conservative common cause factor for the second check valve of 0.1, the probability of the common cause failure of two check valves is 4.8E-

05. Therefore, the likelihood of this failure mode is approximately 5E-

08. This failure is conservatively assumed to be equivalent to a failure of one AFW pump, the probability of this failure mode is more than 2 orders of magnitude lower than the pump failure probability (1.0E-03), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 24 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 8

Modeling of the condenser steam dump system is very simplified.

HNP-F/PSA-080,,

Item 129.

Although no importance measures will be generated for the steam dump components in the PRA model, if the steam dump system is categorized, an appropriate surrogate PRA event will be used for these components, or the system will be added to the model.

Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

9 The solenoids, nitrogen supply, hydraulic actuator, hydraulic oil pump and accumulator are considered part of the hydraulic valve

[Steam Generator PORV].

HNP-F/PSA-080,,

Item 136.

Although no importance measures will be generated for the listed subcomponents of the SG PORVs in the PRA model, if the system containing these components is categorized, an appropriate surrogate PRA event will be used for these components since they support the function of the PORVs.

Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

U.S. Nuclear Regulatory Commission Page 25 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 10 During steam generator tube rupture (SGTR) or loss of coolant accident (LOCA) scenarios, the PORVs may be required to reduce RCS pressure. The PSA model assumes that the spray valves and/or the reactor coolant pumps are unavailable, and the RCS PORVs are always required to function.

HNP-F/PSA-080,,

Item 141.

The inclusion of pressurizer spray to mitigate SGTR events potentially decreases the CDF by approximately 0.3%. This will have a negligible impact on component importance measures, with the exception of pressurizer spray valves. No sensitivity analysis is required for 10 CFR 50.69 categorization. However, if the pressurizer spray system is categorized, appropriate surrogate events will be used to provide the necessary importance measures, or the PRA model will be updated to include the use of pressurizer spray for RCS depressurization.

U.S. Nuclear Regulatory Commission Page 26 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 11 A failure of Essential Service Water (ESW) due to Normal Service Water (NSW) failing to isolate is not postulated since a motor-operated valve and a check valve would both need to fail to close if the NSW pump is unavailable.

HNP-F/PSA-080,,

Item 158.

Further evaluation of the interconnection between the ESW and NSW systems shows that additional failures would be required to get backflow through the NSW system. When an NSW pump trips or is stopped, its discharge MOV automatically closes.

Additionally, when and ESW pump starts, the ESW cross-tie MOV (1SW-39 or 1SW-40) between the NSW supply and the ESW supply automatically closes. Thus, to get backflow through the NSW system on ESW start would require the running NSW pump to fail to run, failure of its discharge MOV to close, failure of the common NSW supply check valve (1SW-50) to close, and failure of an ESW cross-tie valve (1SW-39 or 1SW-40) to close. In the HNP PRA model the failure rate for an MOV to close on demand is 3.5E-03. Since there is no common cause between the NSW pump discharge MOV and the ESW cross-tie MOV, the probability of failure of both is 1.2E-05. The probability of the running NSW pump failing over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 1.4E-04. Therefore, even ignoring the check valve, the likelihood of this event is approximately 1.7E-09. This failure is conservatively assumed to be equivalent to a common cause failure of the ESW pumps. Since the probability of this failure mode is more than 2 orders of magnitude lower than the common cause failure probability of the ESW pumps (1.2E-05), it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 27 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 12

[CCW flow diversion through Spent Fuel Pool heat exchangers due to] the failure open of two in series manual isolation valves

[1CC-383 and 1CC-411] is a very low probability event, which would be annunciated in the control room due to high CCW flows. Therefore, this failure mode has not been included in the model.

HNP-F/PSA-080,,

Item 185.

In the HNP PRA model, the probability of a manual valve transferring position is 6.4E-09 per hour (type code XV FN). Assuming the first valve could transfer open any time during the year, the probability of the first valve transferring open is 5.6E-05.

Assuming the second valve could transfer open up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> before initiator (due to the difficulty in finding the CCW diversion), and any time during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time, the probability of the second valve transferring open is 2.3E-07.

Since common cause failures are typically only applied to active failure modes, the likelihood of this failure mode is 1.3E-11. This failure is conservatively assumed to be is equivalent to a common cause failure of all three CCW pumps.

Since the probability of this failure mode is more than 2 orders of magnitude lower than the common cause failure probability of the CCW pumps (2.7E-06), it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 28 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 13 While these sensors are required for the ESCW system to operate, they are considered internal to the chiller package and so are not separately considered.

HNP-F/PSA-080,,

Item 243.

Although no importance measures will be generated for the sensors in the PRA model, if the system containing the sensors is categorized, an appropriate surrogate PRA event will be used for the sensors since they support the function of the ESCW system.

Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

U.S. Nuclear Regulatory Commission Page 29 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 14 Makeup lines to the ESCW expansion tanks are not considered diversion paths since they have check valves and isolate on an SI signal." This is based on the assumption that a back leakage failure of the check valve and a failure of the isolation valve to close is a probabilistically insignificant event HNP-F/PSA-080,,

Item 257.

Each fill line (one per train) has two in-series solenoid valves which receive SI signals to close, as well as three check valves in series. In the HNP PRA model, the probability of a solenoid valve failing to close on demand is 1.3E-03. Assuming a common cause factor of 0.1, the failure of both solenoid valves to close has a probability of 1.3E-04.

(Note that the failure of the SI signal is orders of magnitude lower so it is ignored). Failure of a check valve to close on demand has a probability of 2.4E-04.

Conservatively assuming a common cause factor of 0.1 between all three valves, the failure of all three check valves to close has a probability of 2.4E-05. The total failure probability of this failure mode is then 3E-09, for a single train of ESCW. This failure is equivalent to a failure of an ESCW pump. Since the probability of this failure mode is more than 2 orders of magnitude lower than the failure probability of an ESCW pump (7.6E-04), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 30 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 15

[Essential Services Chilled Water] lines to the chemical addition tanks are not considered flow diversion paths since they are normally isolated HNP-F/PSA-080,,

Item 258.

In the HNP PRA model, the probability of a manual valve transferring position is 6.4E-09 per hour. Therefore, the probability of the valve transferring open during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 1.5E-07.

This failure is equivalent to a failure of an ESW pump. Since the probability of this failure mode is more than 2 orders of magnitude lower than the failure probability of an ESW pump (7.6E-04), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

16 Failures of these instruments [spray additive tank level transmitters] are modeled as a failure of the pumps.

HNP-F/PSA-080,,

Item 285.

Although no importance measures will be generated for the transmitters in the PRA model, if the system containing the transmitters is categorized, an appropriate surrogate PRA event will be used for the transmitters since they support the function of the system. Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

17 Current limiting reactors are considered to be an integral part of their associated buses.

HNP-F/PSA-080,,

Item 311.

Although no importance measures will be generated for the current limiting reactors in the PRA model, if the system containing the current limiting reactors is categorized, an appropriate surrogate PRA event will be used for the current limiting reactors since they support the function of the system. Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

U.S. Nuclear Regulatory Commission Page 31 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 18 There are also the breakers connecting to the non safety-related 6.9 kV bus supply to the emergency buses, but since there are two in series breakers, both of which would have to fail to trip, failure of these breakers is not included.

HNP-F/PSA-080,,

Item 315.

Exclusion of a common cause failure of the breakers to open (124-SB and 125-SB or 104-SA and 105-SA) as a failure of the EDG supply to the bus may impact the acceptance criteria for 10 CFR 50.69 categorization for these breakers. If these breakers are categorized, appropriately conservative surrogate events (e.g.,

failure of the EDG) will be used to generate importance measures for the breakers.

Any impact of the exclusion of these breakers on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

19 Spurious closure of any motor-operated valve in the flowpath through the feedwater heaters is not addressed due to expected relatively low contribution to the overall unreliability of the system.

HNP-F/PSA-080,,

Item 325.

In the HNP PRA model, the probability of a motor operated valve transferring closed is 2.9E-08 per hour (type code MV FN).

Therefore, the probability of the valve transferring open during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 6.7E-07.

This failure is equivalent to a failure of a main feedwater (MFW) pump.

Since the probability of this failure mode is more than 2 orders of magnitude lower than the failure probability of a MFW pump (1.3E-03), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 32 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 20 The 1B-SN reactor coolant filter is assumed to be in service. No credit is taken for the alternate filter in the event of clogging or valve failure.

HNP-F/PSA-080,,

Item 349.

Any impact from failing to model use of the alternate filter is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring. However, if the CVCS system is categorized, the importance measures for the 1B-SN reactor coolant filter need to be applied to the 1A-SN filter.

21 Due to the controlled quality of the cooling tower water supply, any [Normal Service Water (NSW)] clogging events are expected to be slow-developing, long-term events for which the operator has time to take compensatory measures, including manually operating the strainer, or bypassing the strainer.

Therefore, a failure of the backwash is not modeled and a failure of the switch is also not modeled.

HNP-F/PSA-080,,

Item 354.

In NUREG/CR-6928, the probability of a strainer plugging is 7E-06 per hour based on data from emergency service water systems.

Since many plant ESW systems use raw water, as opposed to HNP which uses high quality water from the cooling tower basin for NSW, it is expected that the NSW strainer plugging probability is an order magnitude lower, or 7E-07/hr.

Therefore, the probability of the strainer plugging during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 1.7E-06. This failure is equivalent to a failure of a NSW pump. Since the probability of this failure mode is more than 2 orders of magnitude lower than the failure probability of an NSW pump (2.4E-02), it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 33 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 22 Each NSW pump requires seal cooling from the associated NSW booster pump. The cyclone separators are assumed not to fail this function and are not modeled.

HNP-F/PSA-080,,

Item 359.

Although no importance measures will be generated for the cyclone separators in the PRA model, if the system containing the cyclone separators is categorized, an appropriate surrogate PRA event will be used for the cyclone separators since they support the function of the system. Therefore, this assumption has no impact on the acceptance criteria for 10 CFR 50.69 categorization.

23 Two inch or smaller lines that contain two or more closed manual pressure isolation valves are considered to be insignificant contributors to ISLOCA risk HNP-F/PSA-080,,

Item 469.

In the HNP PRA model, the probability of a manual valve transferring position is 6.4E-09 per hour (type code XV FN).

Conservatively assuming the first valve could transfer open any time during the 18 month cycle, the probability of the first valve transferring open is 8.4E-05.

Conservatively assuming the second valve could also transfer open any time during the 18 month cycle, the probability of the second valve transferring open is also 8.4E-

05. Since common cause failures are typically only applied to active failure modes, the likelihood of this failure mode is 7.0E-09. Given the very low likelihood of this event occurring and the small size of the lines involved, this assumption has a negligible impact on the acceptance criteria for 10 CFR 50.69 categorization. Any impact of the exclusion of these lines on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 34 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 24 ATWS scenarios are not evaluated for LOCA scenarios, which are assumed to be mitigated by boration from the flow from the safety injection systems.

HNP-F/PSA-080,,

Item 547.

A safety injection (SI) is initiated when RCS pressure reaches 1850 psig. SI flow from the RWST begins at the same time. Given the initial pressure and start of injection flow when the reactor trip is demanded, the potential for an ATWS induced overpressure event is not credible. Failure of the SI function generally is modeled as core damage for LOCAs, so there would be a negligible change in CDF or LERF if ATWS is considered for LOCA, and therefore a negligible change to importance measures. Any impact of the exclusion of these scenarios on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 35 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 25 In considering the many possible alternatives to steam relief, the conclusion is made that the probability of no steam relief path is sufficiently small that modeling is not required

[except for events that address cooldown, such as small LOCAs or SGTRs].

HNP-F/PSA-080,,

Item 558.

Steam relief from only one of three S/Gs is required to maintain the plant in a safe and stable state (hot shutdown), and there are 6 valves per S/G (one PORV and 5 SRVs),

each of which is capable of removing the energy equivalent to full decay heat. The most likely loss of all steam relief would be a common cause failure of all 15 SRVs with a probability of 1.3E-07 (event QCCFSRVFTO) and a common cause failure of all three PORVs with a probability of 1.4E-04 (event QCCFSGABC). Thus, the approximate probability of loss of all steam relief is 1.8E-11. Therefore, this assumption has a negligible impact on the acceptance criteria for 10 CFR 50.69 categorization.

Any impact of the exclusion of these breakers on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

26 Cable routing for secondary side heat removal (SSHR) and Offsite power: The HNP fire PRA assumes that secondary side heat removal (SSHR) and offsite power are lost for nearly all fire scenarios. This assumption was used because of the lack of routing data for these cables in the Turbine Building HNP-F/PSA-082, Table 1, Item 20 Since SSHR and offsite power components are non-safety related, they would not be categorized, and therefore excluding them from the model has no impact. Any increase in the relative importance of safety related components that would arise from including non-safety SSHR and offsite power components in the model (e.g.,

EDGs, SG PORVs) is addressed by the 10 CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 36 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 27 Fire Risk Model/System Modeling: There is no requirement for chilled water for switchgear room cooling in the internal events PRA model based on a detailed room heat up analysis. No requirement was included in the fire model. In the event of a fire in the switchgear rooms, the assumptions of thermal loading used in internal events are no longer valid.

This would only be an area of uncertainty for fires where busses can be credited due to the absence of hot gas layer or limited fire induced source/target damage.

HNP-F/-PSA-082, Table 1, Item 23 The process of detecting and suppressing a fire involves operator presence in the room. Therefore, it is reasonable to assume that room temperatures will, after a short period, be low enough to assure continued equipment operation.

Additionally, in cases where there is no suppression and a hot gas layer causes high room temperature, all components in the room are failed (i.e., full room burnout). Therefore, this assumption does not significantly impact the CDF/LERF results, and thus will have a minimal impact on component importance measures. No additional sensitivities are required for 10 CFR 50.69 categorization.

U.S. Nuclear Regulatory Commission Page 37 of 44 Serial RA-18-0175 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No.

Description of Assumption or Source of Uncertainty Source Assessment 28 A review of assumptions in the HNP Internal Events Model revealed a number of assumptions that involve events excluded from the Internal Events PRA model made on the basis of low probability or that the events are subsumed under existing initiating events.

The modeling issues involve exclusion of the following features from the Internal Events PRA model: (1) SG blowdown and sampling line isolation, (2) failures contributing to the loss of an individual IA compressor, (3) Valve 1IA-648 and its associated path, (4) loss of both NSW and ESW.

HNP-F/PSA-082, Table 1, Item 28 Item 2 was screened from the internal events model on the basis that the IA initiator model does not show this as a valid initiator. Item 3 was screened from the internal events model on the basis that 1IA-648 and its associated path normally isolated by two manual valves and bypassed using manual valve 1IA-650 (i.e., 1IA-648 does not need to open). For item 4, loss of both NSW and ESW was not screened at all. Only the initiator was screened since ESW is not normally running and cannot cause a plant trip. Loss of ESW following the NSW initiator is included in the model. Failure to isolate the SG blowdown and sampling line valves was explicitly added to the fire PRA model. Therefore, no additional sensitivities are required for 10 CFR 50.69 categorization.

c.

Describe specific assumptions and sources of uncertainty that are key to this LAR for the entries in Attachment 6 of the LAR in enough detail that its impact on the application and that a specific sensitivity could be defined to examine the risk significance of the issue.

Include in this description any new sources of uncertainty or assumptions identified in Part b.

Duke Energy Response to PRA RAI 05.c.:

Based on the response to RAI 05.b. above, Attachment 6 of the original LAR is no longer applicable.

PRA RAI 06 - Very Early Warning Fire Detection Systems (VEWFDS) Utilized in the PRA:

Assumption/Uncertainty No. 5 in Attachment 6 of the LAR, dated February 1, 2018, states [t]he HNP Fire PRA assumes Incipient Detection System functions as outlined in NUREG 2180 with some exceptions. The disposition to this uncertainty states [t]he current methodology is based on NRC Frequently Asked Question (FAQ) 08-0046. The disposition further explains, based on a qualitative evaluation that the overall impact of using the current FAQ 08-0046 method is that

U.S. Nuclear Regulatory Commission Page 38 of 44 Serial RA-18-0175 Enclosure it is not expected that any SSCs would be categorized as LSS that would be categorized HSS using the NUREG 2180 methodology. It is not at all clear to the NRC staff that this is the case, especially for SSCs that are not associated with basic events where VEWFDS is not credited.

LAR Section 3.2.2 states [t]he internal Fire PRA model was developed consistent with NUREG/CR-6580 and only utilizes methods previously accepted by the NRC. However, in a letter dated July 1, 2016, Retirement of National Fire Protection Association 805 Frequently Asked Question 08-0046 Incipient Fire Detection Systems (ADAMS Accession No. ML16167A444), FAQ 08-0046 was retired. In this letter it was requested of licensees to evaluate the impact of the new guidance on their PRA in accordance with their licensing basis.

Therefore, propose a mechanism that ensures the VEWFDS methodology will be updated to the NUREG-2180, or other NRC acceptable, methodology prior to implementation of the 10 CFR 50.69 categorization process. If this update is determined to be a PRA model upgrade per the ASME/ANS PRA standard, include in this mechanism a process for conducting a focused-scope peer review and ensure any findings are closed by using an approved NRC process.

Duke Energy Response to PRA RAI 06:

Duke Energy will update the HNP Fire PRA model to incorporate either NUREG-2180 or other NRC acceptable methodology prior to implementation of 10 CFR 50.69. If this update is determined to be a PRA model upgrade per the 2009 ASME/ANS PRA standard, then a focused scope peer review will be conducted. Any findings from the focused scope peer review will be resolved and closed per an NRC approved process prior to implementation of 10 CFR 50.69.

PRA RAI 07 - Key Assumptions and Uncertainties that could Impact the Application:

Section 1.2.10 of RG 1.200 discusses the technical approach in determining the impact of assumptions and sources of uncertainty on the PRA model.

U.S. Nuclear Regulatory Commission Page 39 of 44 Serial RA-18-0175 Enclosure The licensees dispositions are presented in Attachment 6 of the LAR for key assumptions and modeling uncertainties. In a number of instances, there is not enough information provided in the dispositions for the NRC staff to determine whether the uncertainty will not impact 10 CFR 50.69 risk categorization. The staff requests HNP address the following:

a.

Cable types and their associated fire damage temperature (page 52) of the LAR states that [a]fter the Harris Fire PRA was completed, NRR [Office of Nuclear Reactor Regulation] Research tested Kerite cable damage properties and determined they will fail and then ignite 75°C higher than Thermoplastic cables. The licensees disposition states that [f]ire PRA may be updated in the future to reduce the ZOI and time to damage to reflect the actual capabilities of the Kerite cables. The disposition assesses that excluding the updated analysis is a conservatism. The NRC staff notes that conservative modeling in the PRA can skew the plants risk profile and impact the SSCs risk importance values determined as part of 10 CFR 50.69 categorization. Therefore:

1.

Provide justification, such as a sensitivity study, that the conservative modelling choice of not updating the cable fire damage analysis has no impact on the 10 CFR 50.69 categorization results.

2.

Alternatively, propose a mechanism that ensures cable fire damage analysis will be updated to incorporate the new test data on the damage temperature of HNP Kerite cables prior to implementation of the 10 CFR 50.69 categorization process. If this update is determined to be a PRA model upgrade per the ASME/ANS PRA standard, include in this mechanism a process for conducting a focused-scope peer review and resolution of any findings.

Duke Energy Response to PRA RAI 07.a.:

In general, the conservative modeling choice of not updating the cable fire damage analysis would have no impact on the 10 CFR 50.69 categorization results because the small difference in damage properties between Kerite cables and Thermoplastic cables would be very unlikely to result in a different target set. In the chart below, both the vertical and horizontal ZOIs for Thermoplastic are shown to be slightly larger than the corresponding ZOIs for Kerite. For the example of a typical 400kW electrical enclosure, the vertical ZOI for a Thermoplastic cable is shown to be about 135", while the vertical ZOI for a Kerite cable is shown to be about 125". The target set would be potentially affected by the conservative modeling choice only if a target was located precisely between those two values. If located any further away, the target would be beyond both ZOIs; and if located any closer, the target would be within both ZOIs. This already small likelihood of the difference in ZOIs making a difference in the target set is further reduced by the treatment of fire propagation to cable trays. If the first cable tray is within the ZOI, then the ZOI is extended to ceiling, which would eliminate any difference in the target set.

U.S. Nuclear Regulatory Commission Page 40 of 44 Serial RA-18-0175 Enclosure b.

Human Reliability Analysis (HRA) Modeling and Dependency : Disposition of Key Assumptions/Sources of Uncertainty also discusses Joint HEP. For performing HRA dependency analysis, NUREG-1921, EPRI/NRC-RES Fire Human Reliability Analysis Guidelines - Final Report, July 2012 (DAMS Accession No. ML12216A104), discusses the need to consider a minimum value for the joint probability of multiple HFEs, and refers to NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), April 2005 (ADAMS Accession No. ML051160213) (Table 2-1), which recommends joint HEP values should not be below 1E-5. Table 4-3 of EPRI TR 1021081, Establishing Minimum Acceptable Values 0

20 40 60 80 100 120 140 160 180 200 0

100 200 300 400 500 600 700 800 900 1000 ZOI (inches)

HRR (kW)

ZOIs For Cables Based on HRRs Thermoplastic Vertical Kerite Vertical Thermoplastic Horizontal Kerite Horizontal

U.S. Nuclear Regulatory Commission Page 41 of 44 Serial RA-18-0175 Enclosure for Probabilities of Human Failure Events, October 2010, provides a lower limiting value of 1E-6 for sequences with a very low level of dependence. Assigning joint HEPs that are less than a minimum value should be individually reviewed for timing, cues, etc., to check the dependency between all the operator actions in the cutset. of the LAR provides several statements about lower bound values for joint HEPs but includes some discussion about the number of HFEs in the cutsets.

1.

Provide an estimate of the number of joint HEP values below 1E-5 in the Fire PRA, discuss the range of values and confirm that justification is documented for each of these joint HEPs.

2. Provide an estimate of the number of these joint HEP values below 1E-6 in the Internal Events PRA, discuss the range of values and confirm that justification is documented for each of these joint HEPs.

Duke Energy Response to PRA RAI 07.b.1.:

There are five joint HEP values below 1E-5 in the Shearon Harris Nuclear Plant Fire PRA, which range from 2.3E-6 to 9.5E-6. For each of these joint HEPs, there is a specific description of the combination and a justification for the assigned joint HEP based on factors indicating very low dependence, such as disparate relative timing, presence of intervening success, and dissimilarity of cues.

Duke Energy Response to PRA RAI 07.b.2.:

The floor for dependency combos is set at 1E-6 for the HNP Internal Events and Internal Flood models. Even if the dependency combination is calculated to be below 1E-6, this floor is still applied in the quantification of risk results. Therefore there are no dependency combinations below 1E-6 as this is the absolute floor for any dependency combination no matter the number single human failure events in the combination.

PRA RAI 08 - Feedback and Adjustment Process:

Section 11.2, Following Initial Implementation, of NEI 00-04 discusses that a periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes. Specifically, NEI 00-04, Section 12.1 discusses cases for which, in some instances, an updated PRA model could result in new risk achievement worth and Fussell-Vesely importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization.

Therefore, provide the following:

a.

Explain how this periodic review will be administered. Provide a discussion to include the following:

1.

Participants involved in the review; 2.

Sources of material identified to be reviewed;

U.S. Nuclear Regulatory Commission Page 42 of 44 Serial RA-18-0175 Enclosure 3.

Periodicity for when the review will be performed; and 4.

Documentation of the review performed (e.g., corrective action program, engineering evaluation, etc.).

b.

Provide the criteria to be used to determine if the change being reviewed has any impact to a modeled PRA hazard(s) and/or any SSC categorized by the 50.69 process.

Duke Energy Response to PRA RAI 08:

Consistent with NEI 00-04 Section 12, the periodic review will be performed by a system/strategic engineer, or equivalent, and a PRA engineer.

To assess the impact of plant changes on categorized SSCs, the following items are reviewed to ensure the continued validity of categorization:

x Plant modifications since the last review that could impact the SSC categorization x

Plant specific operating experience that could impact the SSC categorization x

The impact of the updated risk information (that is, PRA model or other analysis used in the categorization) on the categorization process results x

Importance measures used for screening in the categorization process. If a review of the importance measures indicates that the SSC should be reclassified, then both the relative and absolute values of the risk metrics will be considered by the IDP.

x An update of the risk sensitivity studies performed for the categorization x

Applicable industry operational experience for impact on existing categorizations x

Input from Regulatory Affairs and Operations regarding changes that may affect the bases for the categorization results.

The periodic review is completed at least once every other fuel cycle. The Periodic Review Process will be completed in accordance with Duke Energy procedures.

The periodic review is documented and will be presented to the Integrated Decision Making Panel (IDP) to make the final decision regarding any necessary re-categorizations.

PRA RAI 09 - SSCs Categorization Based on Other External Hazards:

Section 3.2.4 of the LAR, dated February 1, 2018, states:

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized that participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS. All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

U.S. Nuclear Regulatory Commission Page 43 of 44 Serial RA-18-0175 Enclosure The last sentence implies that the assessment has been completed and concludes that all other external hazards will never need evaluation during categorization. The IPEEE screening process did not include the additional step illustrated in Figure 5-6 in Section 5.4 of NEI 00-04.

Figure 5-6 and its associated text states that an evaluation is performed to determine if there are components being categorized that participate in screened external event scenarios whose failure would result in an unscreened scenario. Clarify how the screening criteria in, Progressive Screening Approach for Addressing External Hazards, satisfy the guidelines that HSS will be assigned to SSCs whose failure would cause a screened external event scenario to become unscreened.

Duke Energy Response to PRA RAI 09:

The screening criteria in Attachment 5 of the LAR were used to determine those external hazards listed in Attachment 4 of the LAR requiring a PRA model for this application and those screened from needing a PRA model. The LAR Attachment 5 denotes the screening criteria that determines screened scenarios versus un-screened scenarios.

Per NEI 00-04 the external hazard assessment is required for each SSC categorization. As such, each SSC being categorized will be assessed in accordance with NEI 00-04 Figure 5-6 for the external hazards listed in Attachment 4 of the LAR. If the failure of the SSC results in the screening criterion from Attachment 5 not being met, then the scenario would become unscreened and the SSC would become candidate High Safety Significant. NEI 00-04 Figure 5-6 is shown below for reference.

U.S. Nuclear Regulatory Commission Serial RA-18-0175 Enclosure Figme 5-6 OTHER EXTERNAL HAZARDS Select Component Identify Safety Significant Attributes of Component Page 44 of 44

Serial: RA-18-0175 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors HNP 50.69 PRA Implementation Items

U.S. Nuclear Regulatory Commission Page 1 of 2 Serial RA-18-0175 The table below identifies the items that are required to be completed prior to implementation of 10 CFR 50.69 at Shearon Harris Nuclear Power Plant (HNP), Unit No. 1. Issues identified below will be addressed and any associated changes made, focused scope peer reviews performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2),

and findings resolved and reflected in the PRA of record prior to implementation of 10 CFR 50.69.

Harris 50.69 PRA Implementation Items Description Resolution i.

In the Fire PRA model, detailed analysis is needed for four significant HFEs identified in open finding HRC-C1-3.

This condition is described in response to RAI 02.e in Duke letter dated October 18, 2018.

Duke Energy will perform detailed analysis in accordance with current methods for the four significant HFEs identified and incorporate the analysis into the Harris Fire PRA model as indicated in the Duke letter dated October 18, 2018.

ii.

Update the HNP Fire PRA model to incorporate NUREG-2180 or other NRC acceptable methodology for incipient detection credit. If this update is determined to be a PRA model upgrade per the 2009 ASME/ANS PRA standard, then conduct a focused scope peer review. Any findings from the focused scope peer review will be resolved and closed per an NRC approved process, or the findings will be dispositioned for the application and submitted for NRC review and approval prior to implementing 10 CFR 50.69.

This condition is described in response to RAI 06 in Duke letter dated October 18, 2018.

The Fire PRA model will be updated to credit incipient detection per NUREG-2180 or other NRC acceptable methodology, as described in Duke letter dated October 18, 2018.

U.S. Nuclear Regulatory Commission Page 2 of 2 Serial RA-18-0175 iii.

Update the HNP Fire PRA model to address finding FSS-F3-01 to meet Capability Category II of the ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Revision 2. If this update is determined to be a PRA model upgrade per the 2009 ASME/ANS PRA standard, then conduct a focused scope peer review.

Any findings from the focused scope peer review will be resolved and closed per an NRC approved process, or the findings will be dispositioned for the application and submitted for NRC review and approval prior to implementing 10 CFR 50.69.

This condition is described in response to RAI 02.f in Duke letter dated October 18, 2018.

The fire PRA model will be updated to account for scenarios to address fire induced failure of structural steel in the Turbine Building, as indicated in response to RAI 02.f contained in Duke letter dated October 18, 2018.

Serial: RA-18-0175 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Markup of Proposed Renewed Facility Operating License L

This license is effective as of the date of issuance and shall expire at midnight on October 24, 2046.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

Eric J. Leeds, Director Office of Nuclear Reactor Regulation Renewed License No. NPF-63 Amendment No.-48e-APPENDIX D ADDITIONAL CONDITIONS RENEWED LICENSE NO. NPF-63 Duke Energy Progress, LLC shall comply with the following conditions on the schedule noted below:

Amendment Number Additional Conditions Implementation Date

[NUMBER]

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, and internal fire; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 1 License Amendment No. [XXX] dated [DATE].

Duke Energy will complete the implementation items list in Attachment 1 of Duke Energy letter to the NRC dated October 18, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Prior to implementation of 10 CFR 50.69.