ML18306A937

NRR E-mail Capture - Request for Additional Information - McGuire Nuclear Station, Units 1 and 2 - Esps LAR

ML18306A937
Person / Time
Site:	McGuire, Mcguire
Issue date:	11/02/2018
From:	Michael Mahoney Plant Licensing Branch II
To:	Zaremba A Duke Energy Carolinas
References
L-2017-LLA-0256, L-2017-LLA-0257
Download: ML18306A937 (19)

Text

NRR-DMPSPEm Resource From: Mahoney, Michael Sent: Friday, November 2, 2018 1:36 PM To: Art Zaremba Cc: 'Edwards, Nicole D'

Subject:

Request for Additional Information - McGuire Nuclear Station, Units 1 and 2 - ESPS LAR

Art, By letter dated May 2, 2017 (Agencywide Documents Access management System (ADAMS) Accession No. ML17122A116), as supplemented by letters dated July 20, 2017 (ADAMS Accession No. ML17201Q132),

November 21, 2017 (ADAMS ML17325A588), and July 10, 2018 (ADAMS Accession No. ML18192A002),

Duke Energy Carolinas, LLC (Duke Energy, the licensee), requested an amendment to Renewed License Nos.

NPF-9 and NPF-17 for McGuire Nuclear Station (McGuire), Units 1 and 2. The proposed amendment would revise the McGuire Technical Specifications (TS) 3.8.1, AC [Alternating Current] Sources - Operating, to allow the extension of the Completion Time (CT) for an inoperable diesel generator (DG) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days, and to ensure that at least one train of shared components has an operable emergency power supply.

The proposed changes to TS 3.8.1 in the July 10, 2018 letter superseded the proposed TS 3.8.1 changes in the November 21, 2017 and May 2, 2017 letters.

The proposed TS changes in the July 10, 2018 letter would revise MCGUIRE TS 3.8.1 by adding 1) new LCOs for the opposite unit AC power sources to supply power for the required shared systems; 2) new Required Actions (RAs) and CTs associated with Condition B (inoperable DG); and 3) new Conditions and associated RAs and CTs to address new the LCOs for shared systems. To support the 14-day extended CT request, McGuire will add a supplemental AC power source (i.e., two supplemental diesel generators (SDGs) per station) with the capability to power any emergency bus. The SDGs will have the capacity to bring the affected unit to cold shutdown. The supplemental AC power source will be referred to as the Emergency Supplemental Power Source (ESPS).

The LAR for McGuire, Units 1 and 2, dated May 2, 2017, states that the proposed change to the TS completion time (CT) has been developed using the risk-informed processes described in Regulatory Guide (RG) 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" ADAMS Accession No. ML100910006), and RG 1.177, Revision 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications (ADAMS Accession No. ML100910008). Based on Section 2.3.1 of RG 1.177, the technical adequacy of the probabilistic risk assessment (PRA) must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. The RG 1.177 endorses the guidance provided in RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of PRA Results for Risk-Informed Activities (ADAMS Accession No. ML090410014), on PRA technical adequacy. The RG 1.200 describes a peer review process utilizing American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008," as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established for evaluations that could influence the regulatory decision.

The NRC staff conducted an audit at Duke Energy offices in Charlotte, North Carolina from May 8 - 10, 2018 (ADAMS Accession No. ML18249A046). The Duke Energy staff was provided a set of audit questions that were discussed during the audit. NRC staff provided a verbal brief to Duke Energy at the end of the audit about what changes it intended to make to audit questions to develop requests for additional information (RAIs).

Subsequent to the audit, Duke Energy submitted an LAR supplement, dated July 10, 2018, addressing a majority of the McGuire, Units 1 and 2, audit questions. The NRC staff reviewed the material provided in the 1

July 10, 2018 letter and determine that the supplemental information did not address all of the concerns raised during the audit.

Regulatory Requirements The NRCs regulatory requirements related to the content of the TS are contained in Title 10 of the Code of Federal Regulations (10 CFR) at 10 CFR 50.36. For Limiting Conditions of Operation at 10 CFR 50.36(c)(2)(i),

Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met, (emphasis added).

Applicable regulatory guidance for McGuire, Units 1 and 2, is contained in: 1. Standard Technical Specifications for Westinghouse Plants, NUREG-1431, Revision 4 (STS, ADAMS Accession Number ML12100A222), and 2. Final Policy Statement (FPS) on Technical Specifications Improvements for Nuclear Power Reactors (FPS, 58 FR 39132). 10 CFR, Appendix A of Part 50, General Design Criterion (GDC) 17, Electric Power Systems, requires, in part, that an onsite electric power system and an offsite electric power system be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents. The onsite electric power supplies shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

The NRC staff also considered the following guidance document to evaluate the LAR:

Branch Technical Position (BTP) 8-8, "Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions," was developed to provide guidance to the NRC staff for reviewing license amendment requests for Allowed Outage Time (AOT) or CT extensions for the onsite and offsite power AC sources to perform online maintenance of the power sources. In the May 2, 2017 letter, the licensee stated that the LAR provides a deterministic technical justification for extending the CTs and has been developed using the guidelines established in NUREG-0800, Branch Technical Position (BTP) 8-8.

Regulatory Guide (RG) 1.93, Availability of Electric Power Sources, Revision 1, which provides guidelines that the NRC staff considers acceptable when the number of available electric power sources are less than the number of sources required by the limiting conditions for operation (LCOs) for a facility.

The NRC staff has reviewed the application and, based upon this review, determined that additional information is needed to complete our review. Please provide a response on the docket within 30 days of this correspondence.

Request for Additional Information (RAI)-1 In Attachment 1, McGuire Technical Specification Marked Up Pages, of the supplemental LAR dated July 10, 2018, the licensee proposed a new LCO 3.8.1.d that would require the operability of the DG(s) from the opposite unit necessary to supply power to the Nuclear Service Water System (NSWS), Control Room Air Ventilation System (CRAVS), Control Room Area Chilled Water System (CRACWS), and Auxiliary Building Filtered Ventilation Exhaust System (ABFVES).

In Attachment 1 of the July 10, 2018 letter, the licensee proposed to add new Required Actions (RAs) and to revise and renumber existing RAs for TS 3.8.1 Condition B (one LCO 3.8.1.b DG inoperable).

New RA B.1 would state Verify LCO 3.8.1.d DG(s) operable, with a CT of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.

2

Revised and renumbered RA B.4.2 would state: Perform SR 3.8.1.2 for operable DG(s).

The NRC staff notes:

It appears that the proposed RA B.1 is similar to the revised and renumbered RA B.4.2 with respect to the operability of the LCO 3.8.1.d DGs because the existing Surveillance Requirements (SR) 3.8.1.2 in RA B.4.2 verifies the operability of the remaining DGs including LCO 3.8.1.d DG (s) by verifying that each DG can start from standby conditions and achieve steady state voltage and frequency within the required ranges.

It does not appear that a discussion of the basis for the 1-hour and 12-hour CTs for the new RA B.1 was provided.

a) Provide a discussion that explains how the operability of the LCO 3.8.1.d DGs will be verified by RA B.1.

b) Provide a discussion that describes the basis and derivation of the CTs (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter) for RA B.1.

RAI-2

In Attachment 1 of the July 10, 2018 letter, the licensee proposed to revise TS 3.8.1 Condition B (i.e., one LCO 3.8.1.b DG inoperable) to extend the CT for restoring the DG to operable status beyond the existing 72-hour and up to 14 days, provided the ESPS is available. The licensee proposed CTs to restore the inoperable LCO 3.8.1.b DG to operable status (RA B.6).

Proposed RA B.6 would state: Restore DG to operable status, with the following CTs:

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of unavailable ESPS when in extended Completion Time AND 14 days AND 17 days from discovery of failure to meet LCO 3.8.1.a or LCO 3.8.1.b Proposed RA B.5 would state: Ensure availability of Emergency Supplemental Power Source (ESPS), with the following CT:

Prior to entering the extended CT of Action B.6 AND Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.

In Section 2.1, McGuire Evaluation of the TS 3.8.1 Change Request, of the July 10, 2018 letter, the licensee states:

The CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS of new RA B.6 (formerly RA 8.4) is based on the existing CT for an inoperable DG. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> CT of new RA B.6 is based on Branch Technical Position 8-8 and indicates that if the ESPS unavailability occurs sometime after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of continuous DG inoperability (i.e., after entering the extended CT for an inoperable DG), then the remaining time to restore the ESPS to available status or restore the DG to operable status is limited to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

In the McGuire current TS, the existing 72-hour CT is based on RG 1.93, which states, in part:

If the available onsite ac power sources are one less than the LCO, power operation may continue for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, provided that the redundant diesel generator is assessed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be free from common-cause failure or is verified to be operable in accordance with plant-specific technical specifications.

The guidance in RG 1.93 relates to redundant power sources. The allowed power operation period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> starts from the time the available onsite ac power sources (i.e., DGs) are found to be one less than the LCO (i.e., one DG is inoperable).

3

The proposed CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS of new RA B.6 (inoperable DG) would begin on discovery that both an inoperable DG exists and the ESPS is unavailable, as stated in the LAR, whereas the existing 72-hour CT for an inoperable DG begins when the DG is inoperable based on RG 1.93.

Thus, the proposed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS would not be based on the existing CT for an inoperable DG, as stated in the LAR.

The proposed CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS would allow the DG to remain inoperable beyond the existing 72-hour CT without an available ESPS or a supplemental AC power source since the proposed 72-hour CT would begin on discovery that both an inoperable DG exists and the ESPS is unavailable.

The proposed CTs for RA B.6 do not identify a non-extended CT or a time for entering the extended CT that would indicate when the RA B.5 (ensure the availability of ESPS) would be performed within the first CT (i.e.,

prior to entering the extended CT of RA B.6) and when the proposed 24-hour CT (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of unavailable ESPS when in extended CT) of RA B.6 would be applicable.

a) Provide a discussion that explains how the proposed CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from discovery of unavailable ESPS of RA B.6 is based on the existing 72-hour CT for an inoperable DG that begins when the DG is found inoperable. Otherwise, provide a revised CT for RA B.6 so that the CT for restoring the inoperable LCO 3.8.1.b DG to operable status would not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the time the LCO 3.8.1.b DG was found inoperable (i.e., Condition B) or provide a justification for the new CT b) Provide a discussion that explains how entry into the 14-day extended CT is identified in the proposed CTs for RA B.6 to allow the performance of RA B.5 prior to entering the extended CT of RA B.6, and to apply the 24-hour CT of RA B.6.

RAI-3

BTP 8-8 recommends that the time to make the supplemental or alternate AC (AAC) power source available, including cross-connection, should be approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to enable restoration of battery chargers and control reactor coolant system inventory. Also, plants must assess their ability to cope with loss of all AC power (i.e., SBO) for one hour independent of an AAC power source to support the one-hour time for making this supplemental power source available In the May 2, 2017 letter, the licensee states:

The ESPS will constitute two supplemental DGs capable of powering any one of the 4160 V essential buses on either unit during a SBO within one hour from the time that the emergency procedures direct their use as the emergency power source. []

The SDGs will become one of the options in ECA-0.0 for restoring AC power. Observations of the operators on the plant simulator show that it takes about 20 minutes for the operators to get to the point in the procedure to attempt to restore power from any source. If the ESPS is the chosen source of power, operators would be dispatched to place it in service. []

[] MNS take[s] credit for its respective SSF [Standby Shutdown Facility] diesel generator as the AAC Source for coping with a SBO within 10 minutes of a SBO event.

BTP 8-8 states that plants must assess the capability to cope with the loss of all AC power for one hour independent of a supplemental AC power source. [] MNS ha[s] [] performed calculations for SBO coping that demonstrate each [unit] is a 4-hour coping plant.

It appears that the ESPS would be connected to supply power to the 4160 volts (V) bus within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 20 minutes from the start of the SBO event since the ESPS would power the 4160 V bus within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> from the time that the emergency procedures direct ESPS use as the emergency power source, and the licensee states 4

it would take 20 minutes for the operators to get to the point [] to attempt to restore power from any source.

This indicates that the time to make the ESPS available to supply power to the station would not be within the approximately one hour timeframe described in the LAR.

The 4-hour SBO coping duration for McGuire is the time the plant can cope with an SBO event using the SSF.

The availability of the SSF within 10 minutes of an SBO event indicates that McGuire can cope with the SBO without (or independent of) the SSF for 10 minutes and not for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, as recommended in BTP 8-8.

a) Clarify the estimated time it would take to connect the ESPS power source (i.e., the two supplemental DGs) to the stations safety bus from the start of an SBO event.

b) Provide a discussion that summarizes the calculations or analysis performed to assess the McGuire ability to cope with the loss of all AC power (i.e., SBO) for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or the period of time clarified in above question until the ESPS is connected to the shutdown buses, as stated in BTP 8-8. Also, include in the discussion a summary of the coping analysis conclusions.

RAI-4

Deleted.

RAI-5

In Attachment 1 of the July 10 letter, the licensee proposed a new Condition C that would state Required Action and associated Completion Time of Required Action B.1 not met. Two alternate RA C.1.1 and RA C.1.2 are proposed for Condition C.

RA C.1.2 would state Restore the LCO 3.8.1.b DG to operable status, with a CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The proposed RA B.1 would state: Verify LCO 3.8.1.d DG(s) operable. The CT for RA B.1 would state: 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.

In Section 2.1 of the July 10, letter, the licensee stated that the 72-hour CT for new RA C.1.2 is in accordance with RG 1.93, which indicates operation may continue in this condition for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

RG 1.93 states, in part:

If the available onsite ac power sources are one less than the LCO, power operation may continue for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, provided that the redundant diesel generator is assessed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be free from common-cause failure or is verified to be operable in accordance with plant-specific technical specifications.

The guidance in RG 1.93 relates to redundant power sources. The power operation period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed per RG 1.93 starts from the time the available onsite ac power sources (i.e., DGs) are one less than the LCO (i.e., one DG is inoperable).

The NRC staff notes that the proposed RA C.1.2 and associated CT would allow the LCO 3.8.1.b DG to remain inoperable for a time longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> because the proposed 72-hour CT for C.1.2 would start from the time of discovery of inoperable LCO 3.8.1.d DG by RA B.1 (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter), and not from the time of discovery of inoperable LCO 3.8.1.b DG, as described in RG 1.93. This indicates that the proposed 72-hour CT for RA C.1.2 would not be in accordance with RG 1.93, as stated in the LAR.

Provide a discussion that explains how the 72-hour CT for RA C.1.2 (Restore LCO 3.8.1.b DG to operable status) is in accordance with RG 1.93 so that the CT for RA C.1.2 would not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the time the LCO 3.8.1.b DG is found inoperable.

5

RAI-6

In Attachment 1 of the July 10, letter, the licensee proposed a new Condition D that would state: one LCO 3.8.1.c offsite circuit is inoperable. The RAs would be modified by a Note.

The proposed Note would state: Enter applicable Conditions and Required Actions of LCO 3.8.9, Distribution Systems - Operating, when Condition D is entered with no AC power source to a train.

RA D.3 would state: Declare NSWS, CRAVS, CRACWS and ABFVES supported by the inoperable offsite circuit inoperable, with a CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In Section 2.1 of the July 10, 2018 letter, the licensee stated that the Note would allow new Condition D to provide requirements for the loss of a LCO 3.8.1.c offsite circuit and LCO 3.8.1.d DG without regard to whether a train is de-energized.

The NRC staff notes that the new Condition D is not related to the loss of an LCO 3.8.1.d DG, and as such, would not provide the requirements for the loss of an LCO 3.8.1.d DG. In addition, the proposed RAs would not require the restoration of the LCO 3.8.1.c offsite circuit to operable status to meet the TS LCO 3.8.1.c, as required by 10 CFR 50.36(c)(2).

a) Clarify how the proposed Note for the new Condition D would allow the new Condition D to provide requirements for the loss of a LCO 3.8.1.d DG, as stated above.

b) Provide a discussion that explains the purpose of RA D.3, and how the proposed RAs for the new Condition D would allow the TS LCO 3.8.1 to be met, as required by 10 CFR 50.36(c)(2).

RAI-7

In Attachment 1 of the July 10, letter, the licensee proposed a new Condition E that would apply when one LCO 3.8.1.d DG is inoperable. The RAs for new Condition E would be modified by a Note.

The Note would state: Enter applicable Conditions and Required Actions of LCO 3.8.9, Distribution Systems -

Operating, when Condition E is entered with no AC power source to a train.

RA E.1 would state: verify both LCO 3.8.1.b DGs are operable and the ESPS is available, with a CT of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.

RA E.4.2 would state: Perform SR 3.8.1.2 for operable DG(s).

RA E.5 would state: Declare NSWS, CRAVS, CRACWS and ABFVES supported by the inoperable DG inoperable, with a CT of 14 days.

In Section 2.1 of the July 10, 2018 letter, the licensee states:

[The Note] allow new Condition E to provide requirements for the loss of a LCO 3.8.1.c offsite circuit and LCO 3.8.1.d DG without regard to whether a train is de-energized.

The verification in this RA [E.1] provides assurance that the LCO 3.8.1.b safety-related DGs and the ESPS are capable of supplying the Class 1E AC Electrical Power Distribution System.

The CT of 14 days is justified by new RA E.1 (verify both unit-specific DGs are operable and the ESPS is available). The 14 day CT is also consistent with the proposed CT in ACTION B when ESPS is available.

10 CFR 50.36(c)(2) states:

6

When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

The NRC staff has identified the following discrepancies:

The new Condition E is not related to the loss of an LCO 3.8.1.c offsite circuit, and as such, it appears to not provide the requirements for the loss of an LCO 3.8.1.c offsite circuit.

It appears that the proposed RA E.1 is similar to the proposed RA E.4.2 with respect to the operability of the two LCO 3.8.1.b DGs because the existing SR 3.8.1.2 in RA E.4.2 verifies the operability of the remaining DGs including LCO 3.8.1.b DG(s) by verifying that each DG can start from standby conditions and achieve steady state voltage and frequency within the required ranges.

It does not appear that a discussion of the basis for the 1-hour and 12-hour CTs for the new RA E.1 was provided.

It does not appear that a CT for the proposed for RA E.5 when the ESPS is unavailable consistent with the proposed 72-hour CT and 24-hour CT for Condition B (i.e., one LCO 3.8.1.b DG inoperable) was provided.

The proposed RAs for the new Condition E appear to not require the restoration of the LCO 3.8.1.d DG to operable status to meet the TS LCO 3.8.1, as required by 10 CFR 50.36(c)(2).

a) Clarify how the proposed Note for the new Condition E would allow the new Condition E to provide requirements for the loss of a LCO 3.8.1.c offsite circuit, as stated above.

b) Provide a discussion that explains how the operability of the LCO 3.8.1.b DGs will be verified by RA E.1.

c) Provide a discussion that explains the basis for the proposed CTs (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter) for new RA E.1.

d) Provide a discussion about the RAs and associated CTs for Condition E for the case when the ESPS is unavailable.

e) Provide a discussion that explains the purpose of RA E.5, and how the proposed RAs for the new Condition E would allow the TS LCO 3.8.1 to be met, as required by 10 CFR 50.36(c)(2).

RAI-8

The licensee proposed a new Condition F that would be applicable when the RA E.1 (verify both LCO 3.8.1.b DGs operable and ESPS available) and associated CT (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter) are not met.

Three alternate RAs including RAs F1.1 and F.1.2 are proposed for the new Condition F.

RA F.1.1 would state Restore both LCO 3.8.1.b DGs to operable status and ESPS to available status, within the CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

RA F.1.2 would state Restore both LCO 3.8.1.d DG to operable status within the CT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In Section 2.1 of the July 10, 2018 letter, the licensee states:

The 72-hour CT for RA F.1.1 and RA F.1.2 is consistent with Regulatory Guide 1.93.

New RA F .1.3 reflects that if the opposite unit DG that is necessary to supply power to the NSWS, CRA VS, CRACWS and ABFVES cannot be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then the NSWS, CRAVS, CRACWS and ABFVES components associated with the inoperable DG must be declared inoperable.

7

RG 1.93 states, in part:

If the available onsite ac electric power sources are two less than the LCO, power operation may continue for a period that should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

If the available onsite ac power sources are one less than the LCO, power operation may continue for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, provided that the redundant diesel generator is assessed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be free from common-cause failure or is verified to be operable in accordance with plant-specific technical specifications The guidance in RG 1.93 relates to redundant power sources. The power operation period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is applicable to two inoperable AC power sources, and the period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> starts from the time the available onsite ac power sources (i.e., DGs) are one less than the LCO (i.e., one DG is inoperable).

The NRC staff has identified the following discrepancies:

Two redundant LCO 3.8.1.b DGs would be inoperable in Condition F, and as such, the CT for restoring one or two inoperable LCO 3.8.1.b DGs to operable status (RA F.1.1) would be 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, as recommended in RG 1.93.

However, the proposed CT for RA F.1.1 is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and does not appear in accordance with RG 1.93.

The proposed RA F.1.2 and associated CT (i.e., restore the LCO 3.8.1.d DG to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) would allow the McGuire power operation to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the LCO 3.8.1.d DG would become inoperable (proposed Condition E) because the proposed 72-hour for F.1.2 would start from the time the RA E.1 (i.e., verify both LCO 3.8.1.b DGs operable and ESPS available) and associated CT (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> [from discovery of LCO 3.8.1.d DG inoperability] and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter) are not met, and not from the time the LCO 3.8.1.d DG is found inoperable. It would appear that the proposed 72-hour CT for RA C.1.2 would not be in accordance with RG 1.93.

Two DGs that supply power to the trains of shared systems would be inoperable if one LCO 3.8.1.b DG that provides power to the shared systems (NSWS, CRAVS, CRACWS, and ABFVES) and one LCO 3.8.1.d DG are inoperable. For this case, the CT for restoring the LCO 3.8.1.d DG to operable status (RA F.1.2) would be 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, as recommended in RG 1.93. However, the proposed CT for RA F.1.2 is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and does not appear in accordance with RG 1.93.

It does not appear that a discussion of the specific inoperable DG which supported shared systems would be declared inoperable in RA F.1.3 was provided, as more than one DG would be inoperable in Condition F.

a) Provide a discussion of how the proposed 72-hour CT for new RA F.1.1 (restore both LCO 3.8.1.b DGs to operable status and ESPS to available status) is consistent with RG 1.93 with respect to two inoperable LCO 3.8.1.b DGs.

b) Provide a discussion that explains how the proposed 72-hour CT for new RA F.1.2 is consistent with RG 1.93 so that the CT for RA F.1.2 would not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the time the LCO 3.8.1.d DG is found inoperable.

c) Provide a discussion of how the proposed 72-hour CT for new RA F.1.2 (restore LCO 3.8.1.d DG to operable status) is consistent with RG 1.93 with respect to two inoperable DGs (i.e., one LCO 3.8.1.b DG and one LCO 3.8.1.d DG) that supply power to the shared systems.

d) Provide a discussion that explains the specific inoperable DG of which the supported shared systems would be declared inoperable in RA F.1.3. Also, provide a discussion that clarifies whether the trains of shared systems supported by all inoperable DGs would be declared inoperable, as more than one DG (i.e.,

LCO 3.8.1.d DG and LCO 3.8.1.b DG(s)) would be inoperable in Condition F; and provide the basis for the CTs for declaring the train of shared systems supported by each inoperable DG inoperable.

RAI-9

8

The proposed Condition K would apply when the RA and associated CT of Condition A, C, F, G, H, I, or J are not met; or RA and associated CT of RA B.2, B.3, B.4.1, B.4.2, or B.6 are not met; or RA and associate CT of RA E.2, E.3, E.4.1, E.4.2, or E.5 are not met.

The proposed RA K.1 would state Be in Mode 3 within a CT of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The proposed RA K.2 would state Be in Mode 5 within a CT of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The NRC staff notes that the proposed Condition K does not address the case when an RA and associated CT of the proposed new Condition D are not met. In addition, the proposed TS changes does not discuss actions when the RA D.1, D.2, or D.3 and associated CT of Condition D are not met.

The NRC staff also notes that in case the ESPS would not be restored to available status as required by the proposed new RA F.1.1 within the proposed 72-hour CT, MNS would enter Condition K to bring the unit to Mode 3 in 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This would subject the unit to transients associated with the orderly shutdown.

Provide a discussion of the applicable actions when an RA and associated CT of the new Condition D are not met.

a) Provide a discussion that explains the reasons for entering Condition K to shut down the unit and, as a result, subject the unit to transients associated with the shutdown when the ESPS cannot be restored to available status, as required by the proposed RA F.1.1.

RAI-10

The proposed note to the SRs section would state:

Note: SR 3.8.1.1 through SR 3.8.1.20 are only applicable to LCO 3.8.1.a and LCO 3.8.1.b AC sources. SR 3.8.1.21 is only applicable to LCO 3.8.1.c and LCO 3.8.1.d AC sources.

The proposed SR 3.8.1.21 would state:

SR 3.8.1.21 For the LCO 3.8.1.c and LCO 3.8.1.d AC electrical sources. SR 3.8.1.1, SR 3.8.1.2, SR 3.8.1.4, SR 3.8.1.5, and SR 3.8.1.6 are required to be met.

The NRC staff notes that a discussion about the reasons for excluding SR 3.8.1.3, SR 3.8.1.7, SR 3.8.1.8, SR 3.8.1.9, SR 3.8.1.10, SR 3.8.1.11, SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.14, SR 3.8.1.15, SR 3.8.1.16, SR 3.8.1.17, SR 3.8.1.18, SR 3.8.1.19, and SR 3.8.1.20 from the SRs required for the LCO 3.8.1.c and LCO 3.8.1.d AC electrical power sources was not provided.

Provide a discussion that explains why the performance of SR 3.8.1.3 and SR 3.8.1.7 through SR 3.8.1.20 are not required for the LCO 3.8.1.c and LCO 3.8.1.d AC power sources.

RAI-11

According to the FPS each remedial action should have bases for inclusion into the TS. The FPS gives the following questions as examples that the bases for each required action should answer e.g. why should the remedial action be taken if the associated LCO cannot be met?, how does this action relate to other actions associated with the LCO?, and what justifies continued operation of the system or component at the reduced state from the state specified in the LCO for the allowed time period?

Rationale provided for proposed Required Action (RA) B.1 on page 11 of 15 of the enclosure to supplement 3 of July 10, 2018 is:

9

New RA B.1 provides assurance that the LCO 3.8.1.d DG is operable when a LCO 3.8.1.b DG is inoperable.

It appears that revised RA B.4 already requires this determination of operability for all other DGs, including a DG on the opposite unit.

Please explain. If this is correct understanding, please consider conforming changes to proposed Condition C.

RAI-12 Modeling Alternative Alignments The LAR for McGuire, Units 1 and 2, dated May 2, 2017, states that the proposed change to the TS CT has been developed using the risk-informed processes described in RG 1.174, Revision 2, and RG 1.177, Revision

1. Based on Section 2.3.1 of RG 1.177, the technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. RG 1.177 endorses the guidance provided in RG 1.200, Revision 2, on PRA technical adequacy. The RG 1.200 describes a peer review process utilizing ASME/ANS PRA standard RA-Sa-2009 as one acceptable approach for determining the technical adequacy of the PRA once acceptable consensus approaches or models have been established for evaluations that could influence the regulatory decision. The PRA standard Supporting Requirement (SR) SY-A5 requires that both the normal and alternate alignments be modelled to the extent needed for core damage frequency (CDF) and large early release frequency (LERF) determination.

The July 10, 2018 supplement, in response to audit question 2.a, provides a table summarizing an evaluation of the impact of system asymmetries and modeling just one system alignment for many systems in the McGuire, Units 1 and 2, PRAs. LAR Table 2 of the response identifies twelve systems, structures, and components (SSCs) included in the evaluation that were determined important to the 14-day CT and describes their impact to the PRA modeling. However, other SSCs appear to be risk-significant to the emergency diesel generator (EDG) CT based on information presented in Tables 7-21, 7-23, 7-26, 7-30, 7-39, 7-42, and 7-57 of the LAR. These include, for example, 4160V switchgear, 600V components, 125 V direct current (dc) distribution (including batteries), battery charger, ESFAS components (i.e. load shed, blackout logic), 6900 V switchgear, transformers, vital instrumentation and control power, and seal water injection. Also, there could be asymmetries in how systems support risk-important frontline systems that are not addressed in the Table 2 evaluation provided in the response.

Additionally, the response states that the system analyst considers all possible system alignments, and determines whether the system failure probability would be different for one alignment versus another. It is not clear to NRC staff how these system configurations were modeled in the PRAs, when the failure probabilities were determined to be different for one alignment versus another. Moreover, it is not clear whether the most limiting configurations are always modeled in the PRAs from the point of calculating the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP).

Because the LAR indicates that the ICCDP and ICLERP for the proposed TS change meet the risk acceptance guidelines in RG 1.177 by a small margin, uncertainty in modeling assumptions could impact the conclusions of the application.

To address the observations above, the NRC staff requests the following additional information:

a) For the systems cited above that appear to be risk-significant to the EDG CT, provide an evaluation of the impact on ICCDP/ICLERP for the EDG CT due to system asymmetries and modeling just one system alignment. Also, include evaluation of other support systems not identified above if they can impact the ICCDP/ICLERP for the EDG CT.

b) For SSCs addressed in LAR Table 2 of the response and added in the response to part (a) above, identify system configurations determined to have different failure probabilities for one alignment versus another.

For each of these alignments, explain whether the most limiting configuration was modelled in the PRAs (in terms of calculating the ICCDP and ICERP for the EDG CT) and provide the basis for those determinations. If the most limiting configuration was not modelled in the PRAs, then justify why this treatment is acceptable for this application.

10

c) If the most limiting configurations were not modeled and it cannot be justified to be acceptable for this application, then incorporate the most limiting configurations into the PRA models used for this LAR that aggregate the PRA updates requested in RAI-22 RAI-13 Nuclear Service Water System (RN) Asymmetry Analysis The July 10, 2018 supplement describes, in response to audit question 2.a, an asymmetry between Train A and B of Nuclear Service Water (RN). Specifically, Train A is not required to shift alignment of its water supply given a loss of power to its safeguards bus, whereas Train B is required to shift to the Standby Nuclear Service Water Pond (SNSWP) when it loses power to its respective bus. The statement continues by stating that Train B would not be able to swap to the SNSWP because of the loss of power to the Unit 2 Train B safeguards bus.

The NRC staff notes that the McGuire SE for, Changes to Technical Specifications to Address an A Train Nuclear Service Water Non-Conforming Condition (ADAMS Accession No. ML18030A682), states that the normal supply for both trains of NSWS is Lake Norman and the SNSWP alignment is only required for severe postulated seismic events including the safe shutdown earthquake (SSE). It appears to the NRC staff that Train B of NSWS would be available for all other events when it remains aligned to Lake Norman, therefore, negating the need to swap to the SNSWP. Additionally, the supplement response only refers to one initiator, dual unit loss of offsite power, and does not address other initiators applicable to this analysis. From the information provided in the supplement, the impact on the application regarding the exclusion of other possible plant alignments and system asymmetries associated with the RN trains are not clear. Also, it is not clear that the alignment modelled in the PRA is the most limiting in terms of the calculated ICCDP and ICLERP.

Justify that the alignment modelled in the PRA (Train A operating / Train B standby) and corresponding asymmetries is the most limiting in terms of the calculated ICCDP and ICLERP compared to the other normal alternative alignments. Include discussion of how the limiting alignment is different for the significant accident scenarios.

RAI-14 Basic Event Failure Rate Anomalies Section 5, Quality Assurance, of RG 1.174, Revision 2, states, [w]hen a risk assessment of the plant is used to provide insights into the decision-making process, the PRA is to have been subject to quality control. RG 1.174, Revision 2, states, the results of the sensitivity studies should confirm that the guidelines are still met even under the alternative assumptions.

a) SR DA-C1 in the ASME/ANS 2009 PRA standard, as qualified by RG 1.200, Revision 2, requires that use of generic parameter estimates (also referred to as industry failure rates) should come from recognized sources. The NRC staff notes that the current industry failure rates for Class 1E EDGs are higher than that presented in the July 10, 2018 supplement in response to audit question 05.a for the McGuire, Units 1 and 2, PRA model [e.g., for EDG fail-to-run after load, the current industry failure rate in NUREG-6928 (2015 Update of Component Reliability Data Sheets, dated December 2016) is 1.52E-03/hour, while the same failure rate presented for McGuire, Units 1 and 2, is 7.77E-04/hour].

To address this observation, the NRC staff requests the following additional information:

i. Explain how the EDG failure rates (i.e., fail-to-load/run, fail-to-run after load) used in the risk evaluations for the July 10, 2018 supplement were developed or provide industry reference. Explain why they are significantly lower than the current industry failure rates. As part of this discussion, justify how these EDG failure rates meet SRs DA-C1 and DA-D1 at capability category (CC) II of the ASME/ANS 2009 PRA standard, as qualified by RG 1.200, Revision 2, and provide the source(s) for any generic parameter estimates used.

ii. If the generic parameter estimate(s) for the EDG cited in Part (i) above are not consistent with current industry failure rates [e.g., NUREG-6928 (2015 Update of Component Reliability Data Sheets, dated December 2016)], then justify that use of current industry failure rates in Part (i) (i.e., a reasonable alternative assumption) does not change the conclusions of the LAR (e.g., describe and provide the 11

results of an appropriate sensitivity study using the PRA models from the aggregate analysis requested in RAI-22).

iii. Alternatively to Parts (i) and (ii), incorporate the appropriate probabilities for the EDGs into the PRA models used for this LAR that aggregate the PRA updates requested in RAI-22.

b) In the July 10, 2018 supplement in response to audit question 05.a, it states that EDG failure rates were updated; however, it is unclear to the NRC staff whether the common cause failure (CCF) probabilities were also updated.

i. Confirm that the CCF probabilities associated with EDG failures were updated in response to audit question 05.a and Part (a) of this RAI.

ii. Alternatively, incorporate the appropriate CCF probabilities for the diesel generators into the PRA models used for this LAR that aggregate the PRA updates requested in RAI-22.

RAI-15 ESPS Operator Action Human Reliability Analysis Anomalies Section 5, Quality Assurance, of RG 1.174, Revision 2, states, [w]hen a risk assessment of the plant is used to provide insights into the decision-making process, the PRA is to have been subject to quality control.

As discussed in Attachment 6 of the LAR, two human failure events (HFEs) were developed for ESPS in the McGuire, Units 1 and 2, PRAs. One HFE is applied to the extended CT model case and is described in LAR , Section 6.1.4.1 as, Operator Fails to Power 4kV Bus from ESPS during 14 Day AOT [allowed outage time]. The other HFE is applied when the EDG is available (e.g., non-extended CT model case) and is described as, Operator Fails to Power 4kV from ESPS when Not Aligned for 14 Day AOT.

The MNS ESPS Alignment Action table provided in the July 10, 2018 supplement in response to audit question 06.a shows the recovered value for the AOT HFE to be the same for the internal events, fire, and high winds PRA models. Clarify whether the human reliability analysis for the fire and high winds PRAs evaluated this operator action for hazard/scenario specific conditions. If these ESPS HFEs did not account for hazard/scenario specific conditions in the fire and high winds PRA models, justify that correcting the HFEs will not impact the conclusions of the LAR.

RAI-16 Seismic Analysis Contribution to the Application Section 2.3.2 of RG 1.177, Revision 1, states, [t]he scope of the analysis should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decision.

The July 10, 2018 supplement, in response to audit question 08.a, presents an approach for determining the bounding seismic core damage frequency (CDF) and large early release frequency (LERF) increase for the impact of the 14-day EDG outage. As part of the approach, the seismic hazard was divided into six hazard bins and a mean frequency of exceedance was determined for each seismic bin. It appears that these bin frequencies were then combined with conditional core damage probabilities (CCDPs) estimated by using the CCDP resulting from an internal events PRA loss of offsite power (LOOP) initiating event. The response states that seismic events are assumed to result in a LOOP event or to be low enough in magnitude to be subsumed as an internal event. It is not clear to NRC staff that this approach of using internal event CCDPs as a surrogate for seismic event CCDPs produces bounding seismic risk estimates for a number of reasons. Of primary concern, is that this approach does not account for seismically-induced SSC failures including those that could coincide with the unavailability of an EDG producing potentially significant seismic risk contributions.

Also, the response states that human error probabilities (HEPs) are not adjusted to account for seismic scenario specific conditions. NRC staff acknowledges that at a certain magnitude (seismic bin), the fragility of the EDGs may be 100% correlated if they are located on the same elevation and location. In this case, all EDGs either fail or are successful for a given seismic bin, and if all EDGs fail then it is irrelevant whether an 12

EDG is unavailable for test or maintenance. However, for seismic bins in which all EDGS are successful, then the unavailable EDG could coincide with a seismically-induced failure of a non-EDG SSC that produces a significant seismic risk contribution. In light of these observations:

a) Provide justification (e.g., describe and provide the results of an appropriate sensitivity study) that the seismic risk impacts produced by the analysis provided in the July 10, 2018 supplement are bounding. As part of this justification, address how the risk contribution of seismic-induced SSC failures and seismic-impacted HFEs are considered b) Alternatively, appropriately update the bounding analysis and provide the revised seismic risk estimates with the new PRA results generated in response to RAI-22.

RAI-17 Avoiding Plant Configurations that Contribute to Significant Risk Section 2.3 of RG 1.177, Revision 1, cites the need to avoid risk-significant plant configurations and discusses Tier 2 of a three-tiered approach for evaluating risk associated with proposed TS CT changes. According to Tier 2, the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed TS change. Once the specific plant equipment are identified, an assessment can be made as whether certain enhancements to the TS or procedures are needed to avoid risk-significant plant configurations. In addition, Section 2.4 of RG 1.177 states, as part of the TS acceptance guidelines specific to permanent CT changes, the licensee should demonstrate that there are appropriate restrictions on dominant risk-significant configurations associated with the change.

The LAR indicates that the ICCDP and ICLERP for the proposed TS change meet the risk acceptance guidelines in RG 1.177 by a small margin, and therefore, in accordance with Tier 2, it is important that plant configurations contributing to risk be avoided when the EDGs are taken out of service for the extended CT.

Section 3.12.2 of the LAR provides a discussion of Tier 2 (Avoidance of Risk-Significant Plant Configurations) and identifies in LAR Table 2 those SSCs for McGuire, Units 1 and 2, that are important to the 14-day EDG CT based on SSC risk importance values presented in LAR Attachment 7. LAR Section 3.12.2 states that unavailability of the identified SSCs should be avoided during the extended CT. In the July 10, 2018 supplement in response to audit question 10, several methods are relied upon to avoid risk-significant plant configurations: Technical Specifications (TS), Selected License Commitments (SLCs), cycle schedules, protected equipment schemes, and the Electronic Risk Assessment Tool (ERAT).

Propose a mechanism that ensures (e.g., license condition that implements the cited methods) the SSCs listed in LAR Table 2 will not be removed from service for planned maintenance or testing during the extended EDG CT.

RAI-18 Risk Calculations for the EDG CT Extension Section 2.3 of RG 1.177, Revision 1, provides guidance on PRA modeling detail needed for TS changes.

Section 2.3.3.1 of RG 1.177 states that the PRA model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. It also states that [s]ystem fault trees should be sufficiently detailed to specifically include all the components for which surveillance tests and maintenance are performed and are to be evaluated.

It is not clear how certain aspects of the risk evaluation in support of the LAR meet the guidelines in RG 1.174, Revision 2, and RG 1.177, Revision 1. Specifically, the McGuire, Units 1 and 2, internal events, internal flooding and high winds PRA risk results reported in LAR Attachment 6 are unchanged across units. Therefore, the NRC staff requests the following additional information:

a) Explain why the McGuire, Units 1 and 2, internal events, internal flooding and high winds PRA risk results reported in LAR Attachment 6 are identical between units. If these PRAs are single unit PRA models assumed to represent both units, then explain how the single unit PRA models are representative or bounding (e.g., the most limiting) for Units 1 and 2. Include a discussion of how SSCs that are shared 13

between both units were implicitly or explicitly modeled in the single unit PRA models, and how differences between the single unit PRA models and Units 1 and 2 for risk-significant systems do not change the conclusions of the LAR. (Risk-significant systems considered by the NRC staff are those systems identified in LAR Table 2 and the additional systems cited in RAI-01.)

b) If the current modeling cannot be justified because the PRAs do not reflect the differences between units, then update the PRAs to reflect the difference between units in the McGuire, Units 1 and 2, PRA models used for this LAR that aggregate the PRA updates requested in RAI-22.

RAI-19 Implementation Verification of ESPS System Regulatory Guide 1.174, Revision 2, provides quantitative guidelines on CDF, LERF, and identifies acceptable changes to these frequencies that result from proposed changes to the plants licensing basis and describes a general framework to determine the acceptability of risk-informed changes. The NRC staffs review of the information in the LAR, as supplemented, has identified additional information that is required to fully characterize the risk estimates.

The estimated risk associated with the EDG CT extension is based on assumptions about an ESPS system that has not yet been installed and operator actions for which procedures have not been completed. Upon completion of these plant modifications and procedures, the PRA models will need to be assessed against the as-built, as-operated plant and updated, as necessary. Then new risk estimates will need to be generated and evaluated to confirm that the conclusions of the LAR have not changed.

In the July 10, 2018 supplement in response to audit question 12, the licensee identifies eight assignments that involve the review and update of specific aspects of ESPS PRA modeling after the installation of the ESPS and completion of associated operating procedures. The NRC staff interprets these assignments as commitments; however, completing these assignments is necessary to ensure that the PRA modeling represents the as-built, as-operated ESPS system and the risk acceptance guidelines in RG 1.177 and RG 1.174 are met upon completion of the ESPS plant modifications and associated procedures.

Propose a license condition requiring that after the ESPS system is installed and applicable procedures updated and prior to implementing the 14-day EDG CT: (1) update the risk estimates associated with this LAR, as necessary (including results of sensitivity studies) using PRA models that reflect the as-built, as-operated plant, and (2) confirm these updated risk estimates meet the risk acceptance guidelines of RG 1.174 and RG 1.177.

RAI-20 Updated Internal Events Logic Transferred to Other Hazard Models The LAR states that the proposed change to the TS CT has been developed using the risk-informed processes described in RG 1.174, Revision 2, and RG 1.177, Revision 1. Based on Section 2.3.1 of RG 1.177, the technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. The RG 1.177 endorses the guidance provided in RG 1.200, Revision 2, on PRA technical adequacy. Section 1 in Regulatory Position C of RG 1.200 states, the PRA results used to support an application must be derived from a baseline PRA model that represents the as-built, as-operated plant to the extent needed to support the application. Consequently, the PRA needs to be maintained and upgraded, where necessary, to ensure it represents the as-built, as-operated plant.

In the July 10, 2018 supplement, the response to audit question 13.a states the high winds PRA has been updated to Revision 4. In contrast to that, the response to 13.c states that the fire and high winds PRAs are based on Revision 3 of the internal events PRA with minor changes. The NRC staff is unclear which revision of the internal events model is incorporated in the high winds PRA model. The response to 13.a and elsewhere states that there are [s]ignficant internal events model changes between Revisions 3 and 4. The supplement lists a few of the significant changes that could impact the fire and high winds PRAs, including: updated model data, updated human reliability analysis (HRA) (change in HEP values), and incorporation of a plant modification related to a LERF pathway. Accordingly, it is not clear how the McGuire, Units 1 and 2, fire and 14

high winds PRAs address the modeling updates performed for the internal events PRAs. These internal events updates appear to represent modeling improvements that result in a more realistic representation of the as-built, as-operated plant as prescribed in RG 1.200, Revision 2. To address the above observations, provide the following information.

a) Clarify which revision of the internal events model is currently incorporated in the high winds PRA model used for this application.

b) Describe all model changes made to the internal events PRA (since Revision 3) that were not incorporated into the fire and high winds PRA models. Also include description of model updates that were performed to resolve F&Os from the 2015 peer review.

c) Provide detailed justification (e.g., describe and provide the results of an appropriate sensitivity study using the PRA models from the aggregate analysis requested in RAI-22) that incorporating the model changes described in part (b) into the fire and high winds PRA models does not impact the conclusions of the LAR, as supplemented. Alternatively, incorporate these internal events PRA updates, as applicable, into the McGuire, Units 1 and 2, fire and high winds PRA models used for this LAR that aggregate the PRA updates requested in RAI-22.

RAI-21 Sources of Model Uncertainty and Parametric Uncertainty The LAR for McGuire, Units 1 and 2, dated May 2, 2017, states that the proposed change to the TS CT has been developed using the risk-informed processes described in RG 1.174, Revision 2, and RG 1.177, Revision

1. Regulatory Position C of RG 1.174 states:

• In implementing risk-informed decision-making, LB [licensing basis] changes are expected to meet a set of key principles. In implementing these principles, the NRC staff expects [that]: Appropriate consideration of uncertainty is given in the analyses and interpretation of findings. NUREG-1855 provides further guidance.

• Section 2.5.2 further elaborates, because of the way the [risk] acceptance guidelines were developed, the appropriate numerical measures to use in the initial comparison of the PRA results to the acceptance guidelines are mean values. The mean values referred to are the means of the probability distributions [of the risk metrics] that result from the propagation of the uncertainties on the [PRA] input parameters and those model uncertainties explicitly represented in the model under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state-of-knowledge correlation [SOKC] is unimportant.

a) Revision 0 of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (2009), primarily addressed sources of model uncertainty for internal events (including internal flooding) and references EPRI report 1016737, Treatment of Parameter and Modeling Uncertainty for Probabilistic Risk Assessments (2008), which provides a generic list of sources of model uncertainty and related assumptions for internal events. Revision 1 of NUREG-1855 (March 2017, ADAMS Accession No. ML17062A466) further clarifies the NRC staff decision-making process in addressing uncertainties and addresses all hazard groups (e.g., internal events, internal flooding, internal fire, seismic, low-power and shutdown, Level 2). NUREG-1855, Revision 1, cites use of EPRI reports 1016737 and 1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (2012), which complements the NUREG and provides a generic list of sources of model uncertainty for internal events, internal flooding, internal fires, seismic, low-power and shutdown, and Level 2 hazard groups. While LAR Section 3.12.4 states a review of potential modeling uncertainties was performed using Revision 1 of NUREG-1855, the discussion in LAR Section 6.2 and the results provided in LAR Attachment 9 indicate that Revision 0 of NUREG-1855 (and EPRI report 1016737) was used to evaluate sources of uncertainty for only internal events (including internal flooding).

15

i. Clarify which version of NUREG-1855 was used for the uncertainties analysis described in the LAR.

ii. Provide a detailed summary of the process used to evaluate sources of model uncertainty and related assumptions [both generic sources (e.g., EPRI reports 1016737 and 1026511) and plant-specific sources] in the internal events, internal flooding, high winds, and internal fires PRAs for their potential impact on this application. Include in this discussion an explanation of how the process aligns with guidance in NUREG-1855, Revision 1, or other NRC-accepted method.

iii. In accordance with the process described in Part (a.ii) above, describe any additional sources of model uncertainty and related assumptions relevant to the application that were not provided in LAR Attachment 9, and describe their impact on the application results.

iv. In accordance with NUREG-1855, Revision 1, for those sources of model uncertainty and related assumptions that could potentially challenge the risk acceptance guidelines (i.e., key uncertainties and assumptions), provide qualitative or quantitative justification for why these key uncertainties and assumptions do not change the conclusions of the LAR (e.g., describe and provide the results of an appropriate sensitivity study(ies) using the PRA models used to perform the aggregate analysis requested in RAI-22); describe and provide the results of a more detailed, realistic analysis to reduce the conservatism and uncertainty; propose compensatory measures and explain how they address the key uncertainties and assumptions).

b) Section 2.3.1 of Regulatory Guide 1.177 states that current good practice (i.e., CC II of the ASME/ANS PRA standard) is the level of detail needed for the PRA to be adequate for the majority of applications. Based on RG 1.174 and Section 6.4 of NUREG-1855, Revision 1, for a CC II risk evaluation, the mean values of the risk metrics (i.e., CDF, LERF) and the means of their incremental values (i.e., ICCDP, ICLERP) need to be compared against the risk acceptance guidelines. The mean values referred to are the means of the risk metrics probability distributions that result from the propagation of the uncertainties on the PRA input parameters and those model uncertainties explicitly represented in the model. In general, the point estimate CDF/LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the SOKC is unimportant.

Attachment 6 of the LAR, as supplemented, provides the ICCDPs and ICLERPs for the proposed CT extension based on point estimate values of the risk metrics. The basis for using these point estimates is the results of an assessment provided in LAR Section 6.2.3, in which a parametric uncertainty analysis was performed on the internal events PRA to determine the baseline mean CDF and LERF which were then compared to the internal events baseline CDF and LERF determined using point estimate values. The comparison showed that the baseline CDF and LERF determined using point estimate values were within 10% of the means values. However, this approach is not consistent with NUREG-1855, Revision 1. For one reason, the licensees parametric uncertainty analysis did not include the other hazards (i.e., internal flooding, high winds, and internal fires) and its impact on ICCDP and ICLERP, which challenge the risk acceptance guidelines (i.e., Regime 3 in NUREG-1855, Revision 1) and could potentially impact the conclusions of the LAR. Additionally, the LAR states that the parametric uncertainty analysis was conducted on the internal events model before changes were made for this application and the point estimates in Figures 5 and 6 of LAR Attachment 6 appear not to match the base case CDF and LERF point estimates presented in LAR Tables 6-19 through 6-22.

i. Provide a detailed summary of the process used to evaluate parametric uncertainties in the calculation of ICCDP and ICLERP for the internal events, internal flooding, high winds, and internal fires PRAs. Include in this discussion an explanation of how the process aligns with guidance in Section 6, Stage D - Assessing Parameter Uncertainty, of NUREG-1855, Revision 1, or other NRC-accepted method. Justify any conclusions made that addressing the SOKC is not important to the quantitative conclusions of this application.

ii. In accordance with the process described in Part (b.i) above, provide the ICCDPs and ICLERPs for internal events, internal flooding, high winds, and internal fires as requested in RAI-22.

16

RAI-22 Aggregate Update Analysis Regulatory Guide 1.174, Revision 2, provides quantitative guidelines on CDF and LERF and identifies acceptable changes to these frequencies that result from proposed changes to the plants licensing basis and describes a general framework to determine the acceptability of risk-informed changes. Regulatory Guide 1.177, Revision 1, provides risk acceptance guidelines on ICCDP and ICLERP and identifies acceptable changes to these probabilities that result from proposed changes to permanent changes to the licensees TSs.

The NRC staff review of the information in the LAR, as supplemented, has identified additional information that is required to fully characterize the risk estimates.

The PRA methods and treatments discussed in the following RAIs may need to be revised to be acceptable by the NRC staff:

• RAI-012.c regarding the incorporation of the most limiting plant configurations.

• RAI-14.a regarding the use of appropriate failure rates for EDGs.

• RAI-14.b regarding the update of CCFs related to updated component failure rates.

• RAI-16.b regarding the seismic bounding analysis.

• RAI-18.b regarding modeling the differences between units in the McGuire, Units 1 and 2, PRAs.

• RAI-20.c regarding incorporation of internal events PRA modeling into the McGuire, Units 1 and 2, fire and high winds PRA models.

• RAI-21.b on providing ICCDP and ICLERP for all hazard groups in accordance with Section 6, Stage D

- Assessing Parameter Uncertainty, of NUREG-1855, Revision 1.

In the supplement letter of July 10, 2018 in response to audit question 14, an aggregate case study was provided that included resolution to audit questions as follows:

• Incorporation of updated NUREG-2169 fire ignition frequencies in the fire PRA (audit question 04).

• Consistent use of appropriate EDG, SSF, and ESPS failure probabilities across the McGuire, Units 1 and 2, hazard PRAs (audit question 05.a).

• Incorporation of appropriate non-safety equipment failure probabilities for the ESPS DGs in the McGuire, Units 1 and 2, PRA models (audit question 05.b).

The NRC staff notes that no updated aggregate risk results and separate sensitivity studies results, such as the ESPS HRA study, were provided in the supplement. In addition, the supplement response did not provide unit specific results.

To fully address the RAIs and the July 10, 2018 supplement aggregate results cited above, provide the following:

a) Provide the results of an aggregate analysis for each unit (including individual results for each hazard group) that reflect the combined impact on the LAR risk results (i.e., change in CDF, change in LERF, ICCDP and ICLERP in accordance with NUREG-1855, Revision 1) of: (1) the PRA updates required in response to the RAIs cited above, and (2) those updates incorporated in the aggregate analysis specified in the July 10, 2018 supplement. Also, provide an update of the separate sensitivity studies (e.g., the 17

sensitivity study referred to in LAR Section 6.2.5) discussed in the LAR that reflect the combined updates to the PRA described above.

b) For each RAI listed above, summarize briefly how the issue(s) cited in the RAI were resolved for the PRA or LAR. If the resolution involved an update to the PRA models, then briefly summarize the PRA update.

Also, confirm the aggregate analysis in part (a) included the PRA updates from the July 10, 2018 supplement.

c) Describe any additional changes to the McGuire, Units 1 and 2, PRA models in support of the aggregate analysis in part (a) that were not described in the LAR dated May 2, 2017 or in part (b) of this RAI. Provide justification that these additional changes, if any, meet the requirement in RG 1.200 that the PRA results used to support an application must be derived from a baseline PRA model that represents the as-built, as-operated plant to the extent needed to support the application.

d) Confirm that the updated aggregate analysis and sensitivity results still meet the risk acceptance guidelines in RG 1.177, Revision 1, and RG 1.174, Revision 2.

e) If the risk acceptance guidelines are exceeded, then identify which guidelines are exceeded and provide qualitative or quantitative justification that support the conclusions of the LAR in accordance with NUREG-1855, Revision 1 (e.g., describe and provide the results of a more detailed, realistic analysis to reduce conservatism and uncertainty; propose compensatory measures and explain how they address the exceedance).

Once this email is added to ADAMS, I will provide the accession number for your reference.

Thanks Mike Michael Mahoney McGuire and Catawba Project Manager, Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Desk: (301)-415-3867 Email: Michael.Mahoney@NRC.GOV 18

Hearing Identifier: NRR_DMPS Email Number: 650 Mail Envelope Properties (DM6PR09MB2619087957EEC2BFB106E1A5E5CF0)

Subject:

Request for Additional Information - McGuire Nuclear Station, Units 1 and 2 -

ESPS LAR Sent Date: 11/2/2018 1:35:39 PM Received Date: 11/2/2018 1:35:43 PM From: Mahoney, Michael Created By: Michael.Mahoney@nrc.gov Recipients:

"'Edwards, Nicole D'" <Nicole.Edwards@duke-energy.com>

Tracking Status: None "Art Zaremba" <Arthur.Zaremba@duke-energy.com>

Tracking Status: None Post Office: DM6PR09MB2619.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 66511 11/2/2018 1:35:43 PM Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Recipients Received: