Text

License Amendment Request to Revise Technical Specifications to Adopt Risk- Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b
	ML19280C844
Person / Time
Site:	Harris
Issue date:	10/07/2019
From:	Hamilton T; Duke Energy Progress
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RA-19-0001
	Download: ML19280C844 (233)
	v • d • e

[[:#Wiki_filter:Tanya M. Hamilton fa DUKE Vice President

 ~ ENERGY Harris Nuclear Plant 5413 Shearon Harris Road New Hill, NC 27562 10 CFR 50.90 2FWREHU, 2019 RA-19-0001 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400/Renewed License No. NPF-63

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Ladies and Gentlemen: In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Duke Energy Progress, LLC (Duke Energy) is submitting a request for an amendment to the Technical Specifications (TS) for the Shearon Harris Nuclear Power Plant, Unit 1 (HNP). The proposed amendment would modify TS requirements to permit the use of Risk-Informed Completion Times in accordance with Technical Specifications Task Force (TSTF) traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (ADAMS Accession No. ML18183A493). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (ADAMS Accession No. ML18267A259). x Attachment 1 provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific variations. x Attachment 2 provides the existing HNP TS pages marked up to show the proposed changes. x Attachment 3 provides a cross-reference between the TS included in TSTF-505, Rev. 2 and the HNP plant-specific TS. x Attachment 4 provides certain HNP TS Bases for information only. Duke Energy requests approval of the proposed license amendment within one year of the date this application is accepted by the NRC staff for review. Once approved, Duke Energy will implement the license amendment within 180 days.

U.S. Nuclear Regulatory Commission Page2 RA-19-0001 There are no regulatory commitments made in this submittal. In accordance with 10 CFR 50.91(a)(1), "Notice for Public Comment," the analysis about the issue of no significant hazards consideration using the standards in 10 CFR 50.92 is being provided to the Commission. In accordance with 10 CFR 50.91(b)(1), "Notice for Public Comment; State Consultation," a copy of this application, with attachments, is being provided to the designated North Carolina Official. Please refer any questions regarding this submittal to Art Zaremba, Manager - Nuclear Fleet Licensing, at (980) 373-2062. I declare under penalty of perjury that the foregoing is true and correct. Executed on October 7, 2019. Sincerely, Tanya M. Hamilton Attachments: 1. Description and Assessment of the Proposed Change

2. Proposed Technical Specification Changes (Mark-Up)

3. Cross-Reference of TSTF-505 and HNP Technical Specifications

4. HNP Technical Specifications Bases (Information Only)

Enclosures:

1. List of Revised Required Actions to Corresponding PRA Functions

2. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

3. Information Supporting Technical Adequacy of PRA Models Without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2

4. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

5. Baseline CDF and LERF

6. Justification of Application of At-Power PRA Models to Shutdown Modes

7. PRA Model Update Process

8. Attributes of the Real-Time Model

9. Key Assumptions and Sources of Uncertainty

10. Program Implementation

11. Monitoring Program

12. Risk Management Action Examples cc: J. Zeiler, NRC Senior Resident Inspector, HNP W. L. Cox, Ill, Section Chief N.C. DHSR M. Barillas, NRC Project Manager, HNP L. Dudes, NRC Regional Administrator, Region II

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Attachment 1 Description and Assessment of the Proposed Change

U.S. Nuclear Regulatory Commission Page 2 RA-19-0001 ATTACHMENT 1 DESCRIPTION AND ASSESSMENT OF THE PROPOSED CHANGE

1.0 DESCRIPTION

In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Duke Energy Progress, LLC (Duke Energy) is submitting a request for an amendment to the Technical Specifications (TS) for the Shearon Harris Nuclear Power Plant, Unit 1 (HNP). The proposed amendment would modify the TS requirements related to Completion Times (CTs) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). A new program, the Risk-Informed Completion Time Program, is added to TS Section 6 Administrative Controls. The methodology for using the RICT Program is described in NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, which was approved by the Nuclear Regulatory Commission (NRC) on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program. The proposed amendment is consistent with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b. However, only those HNP Required Actions described in Attachment 3 and Enclosure 1, as reflected in the proposed TS mark-ups provided in Attachment 2, are proposed to be changed because some of the modified Required Actions in TSTF-505 are not applicable to HNP, and there are some plant-specific Required Actions not included in TSTF-505 that are included in this proposed amendment. 2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation Duke Energy has reviewed TSTF-505, Revision 2, and the model safety evaluation dated November 21, 2018 (ADAMS Accession No. ML18253A085). This review included the information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, Duke Energy has concluded that the technical basis is applicable to HNP and supports incorporation of this amendment in the HNP TS. 2.2 Verifications and Regulatory Commitments In accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A, the following is provided:

1. Enclosure 1 identifies each of the TS Required Actions to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the probabilistic risk assessment (PRA) of the structures, systems and components (SSCs) subject to those actions.

U.S. Nuclear Regulatory Commission Page 3 RA-19-0001

2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as discussed in Regulatory Guide 1.200, Section 4.2.

3. Enclosure 3 is not applicable since each PRA model used for the RICT Program is addressed using a standard endorsed by the NRC.

4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.

5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

6. Enclosure 6 is not applicable since the RICT Program is not being applied to shutdown modes.

7. Enclosure 7 provides a discussion of the licensees programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified to assess real-time configuration risk, and describes the scope of, and quality controls applied to the real-time model.

9. Enclosure 9 provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.

10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.

11. Enclosure 11 provides a description of the implementation and monitoring program as described in NEI 06-09-A, Section 2.3.2, Step 7.

12. Enclosure 12 provides a description of the process to identify and provide RMAs.

2.3 Optional Changes and Variations Duke Energy is proposing the following variations from the TS changes described in TSTF-505, Revision 2, or the applicable parts of the NRC staffs model safety evaluation dated November 21, 2018. These options were recognized as acceptable variations in TSTF-505 and the NRC staffs model safety evaluation. The TSTF mark-ups applicable to HNP are based on NUREG-1431, Standard Technical Specifications Westinghouse Plants, which includes Conditions, Required Actions and CTs; whereas the HNP TS include Actions which are combination of all three of these (note that CTs are referred to as allowed outage times (AOTs) for HNP). For the purposes of this license amendment request, the terminology used will be consistent with TSTF-505 and NEI 06-09-A

U.S. Nuclear Regulatory Commission Page 4 RA-19-0001 as much as possible, except in those places where it is appropriate to use the HNP plant-specific terminology. These differences are administrative and do not affect the applicability of TSTF-505 to the HNP TS. Note also that, in several instances, the HNP TS use different numbering and titles than the Standard Technical Specifications (STS) on which TSTF-505 was based. These differences are administrative and do not affect the applicability of TSTF-505 to the HNP TS. Only TS changes consistent with the HNP design and TS are included. Attachment 3 provides specific information. is a cross-reference that provides a comparison between the NUREG-1431 Required Actions included in TSTF-505 and the HNP Actions included in this license amendment request. The attachment includes a summary description of the referenced Required Actions, which is provided for information purposes only and is not intended to be a verbatim description of the Required Action. The cross-reference identifies the following:

1. HNP Actions that have identical numbers to the corresponding NUREG-1431 Required Actions are not deviations from TSTF-505, except for administrative deviations (if any) such as formatting. These deviations are administrative with no impact on the NRCs model safety evaluation dated November 21, 2018.

2. HNP Actions that have different numbering than the NUREG-1431 Required Actions are an administrative deviation from TSTF-505 with no impact on the NRCs model safety evaluation dated November 21, 2018.

3. For NUREG-1431 Required Actions that are not contained in the HNP TS, the corresponding TSTF-505 mark-ups for the Required Actions are not applicable to HNP.

This is an administrative deviation from TSTF-505 with no impact on the NRCs model safety evaluation dated November 21, 2018.

4. The model application provided in TSTF-505, Revision 2 includes an attachment for typed (clean) TS pages reflecting the proposed changes. HNP is not including such an attachment due to the number of TS pages included in this submittal that have the potential to be affected by other unrelated license amendment requests and due to the straightforward nature of the proposed changes. Providing only mark-ups of the proposed TS changes satisfies the requirement of 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, in that mark-ups fully describe the changes desired. This is an administrative deviation from TSTF-505 with no impact on the NRCs model safety evaluation dated November 21, 2018. Because of this deviation, the contents and numbering of the attachments for this amendment request differ from the attachments specified in the model application for TSTF-505.

5. As stated in TSTF-505, Revision 2, it is necessary to adopt TSTF-439, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO, in order to adopt TSTF-505 for those Required Actions that are affected by both travelers.

Although HNP has not converted to the NUREG-1431 STS, on July 25, 2019 (ADAMS Accession No. ML19206A599), a site-specific license amendment request was submitted using technical justification similar to what is provided in TSTF-439. Specifically, that license amendment request impacts TS 3/4.8.1, AC Sources Operating, as indicated in the mark-ups provided in Attachment 2 of this submittal.

U.S. Nuclear Regulatory Commission Page 5 RA-19-0001

6. There are several plant-specific limiting conditions for operation (LCOs) and associated Actions for which HNP is proposing to apply the RICT Program that are variations from TSTF-505. These LCOs and Actions are identified in Attachment 3 with additional justification provided below:

x TS LCO 3.1.2.2: Flow Paths - Operating HNP LCO 3.1.2.2 is a plant-specific specification not in STS or TSTF-505, Revision 2. HNP LCO 3.1.2.2 addresses operability of boron injection flow paths, including the charging/safety injection pumps. Charging/safety injection pumps are also addressed by plant-specific LCO 3.1.2.4 (Charging Pumps - Operating) and LCO 3.5.2 (ECCS Subsystems). TSTF-505, Revision 2 includes LCO 3.5.2 for ECCS as long as additional technical justification is provided (refer to Enclosure 1 of this amendment request for those HNP Actions requiring additional technical justification) and also includes the high-pressure safety injection function of the charging/injection pumps. Inclusion of plant-specific LCO 3.1.2.2 in the RICT Program is necessary to permit its application for LCO 3.5.2 for inoperability of one train of charging/safety injection pumps as well as to avoid conflicts with support systems for the charging/safety injection pumps and other powered components (i.e., boric acid transfer pumps and motor-operated valves) in the boron injection flow path. Application of a RICT for the Action associated with LCO 3.1.2.2 will not adversely affect the ability of the Boron Injection System to perform its intended safety function. x TS LCO 3.1.2.4: Charging Pumps - Operating HNP LCO 3.1.2.4 is a plant-specific specification which is redundant to LCO 3.5.2. Plant-specific LCO 3.1.2.4 is not in STS or TSTF-505, Revision 2. HNP LCO 3.1.2.4 addresses operability of charging/safety injection pumps, which are also addressed by plant-specific LCO 3.1.2.2 and LCO 3.5.2 for ECCS. TSTF-505, Revision 2 includes LCO 3.5.2 for ECCS as long as additional technical justification is provided in accordance with the traveler and also includes the high-pressure safety injection function of the charging/safety injection pumps. Inclusion of this redundant LCO 3.1.2.4 in the RICT Program is necessary to permit its application for TS 3.5.2 for inoperability of one train of charging/safety injection pumps. Application of a RICT for the Action associated with LCO 3.1.2.4 will not adversely affect the ability of the charging/safety injection pumps to perform their intended safety function. x TS LCO 3.7.13: Essential Services Chilled Water System (ESCWS) HNP LCO 3.7.13 is a plant-specific LCO which addresses the ESCWS. The ESCWS provides chilled water for safety-related room coolers. ESCWS is explicitly modeled in the PRA models and unavailability of the ESCWS trains can be evaluated by the PRA models. Furthermore, one train of ESCWS inoperable

U.S. Nuclear Regulatory Commission Page 6 RA-19-0001 has a restoration action requirement. Therefore, this LCO meets the requirements for inclusion in the RICT Program. Plant-specific inclusion of LCO 3.7.13 in the RICT Program is proposed to avoid conflict where the 72-hour action requirement of LCO 3.7.13 is applicable while a RICT on a support system for ESCWS (e.g., Emergency Service Water System TS 3.7.4) is in effect. Application of a RICT for the Action associated with LCO 3.7.13 will not adversely affect the ability of the ESCWS to perform its intended safety function. Duke Energy has determined that the application of a RICT for these HNP plant-specific LCOs is consistent with TSTF-505, Revision 2, and with the NRCs model safety evaluation dated November 21, 2018. Application of a RICT for these plant-specific LCOs will be controlled under the RICT Program. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or remedial actions if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance levels of TS required SSCs are unchanged, and the remedial actions, including the requirement to shut down the reactor, are also unchanged; only the Action AOTs are extended by the RICT Program. Application of a RICT will be evaluated using the methodology and probabilistic risk guidelines contained in NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, which was approved by the NRC on May 17, 2007 (ADAMS Accession No. ML071200238). The NEI 06-09-A, Revision 0 methodology includes a requirement to perform a quantitative assessment of the potential impact of the application of a RICT on risk, to reassess risk due to plant configuration changes, and to implement compensatory measures and RMAs to maintain the risk below acceptable regulatory risk thresholds. In addition, the NEI 06-09-A, Revision 0 methodology satisfies the five key safety principles specified in Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, dated August 1998 (ADAMS Accession No. ML003740176) relative to the risk impact associated with application of a RICT. Therefore, the proposed application of a RICT to the HNP plant-specific Actions is consistent with TSTF-505, Revision 2 and with the NRC staffs model safety evaluation dated November 21, 2018. Duke Energy has reviewed these proposed changes and determined that they do not affect the applicability of TSTF-505, Revision 2 to the HNP TS.

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Determination Duke Energy Progress, LLC (Duke Energy) has evaluated the proposed changes to the Technical Specifications (TS) using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. Shearon Harris Nuclear Power Plant, Unit 1 (HNP) requests adoption of an approved change to the standard technical specifications (STS) and plant-specific TS, to modify the TS requirements

U.S. Nuclear Regulatory Commission Page 7 RA-19-0001 related to Completion Times for Required Actions to provide the option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Section 6.0, Administrative Controls, entitled the Risk-Informed Completion Time Program. As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:

1. Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No. The proposed changes permit the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes do not involve a significant increase in the probability of an accident previously evaluated because the changes involve no change to the plant or its modes of operation. The proposed changes do not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time are no different from those during the existing Completion Time. Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No. The proposed changes do not change the design, configuration, or method of operation of the plant. The proposed changes do not involve a physical alteration of the plant (no new or different kind of equipment will be installed). Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No. The proposed changes permit the extension of Completion Times provided that risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes implement a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS.

U.S. Nuclear Regulatory Commission Page 8 RA-19-0001 Therefore, the proposed changes do not involve a significant reduction in a margin of safety. Based on the above, Duke Energy concludes that the proposed changes present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified. 3.2 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. 4.0 ENVIRONMENTAL EVALUATION The proposed changes would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed changes do not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed changes meet the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed changes.

861XFOHDU5HJXODWRU\&RPPLVVLRQ 6HULDO5$ 6HULDO5$ 6KHDURQ+DUULV1XFOHDU3RZHU3ODQW8QLW

                    'RFNHW1R5HQHZHG/LFHQVH1R13)
   /LFHQVH$PHQGPHQW5HTXHVWWR5HYLVH7HFKQLFDO6SHFLILFDWLRQVWR$GRSW5LVN,QIRUPHG

&RPSOHWLRQ7LPHV767)5HYLVLRQ³3URYLGH5LVN,QIRUPHG([WHQGHG&RPSOHWLRQ7LPHV+/- 5,767),QLWLDWLYHE'

                                      $WWDFKPHQW

3URSRVHG7HFKQLFDO6SHFLILFDWLRQ&KDQJHV 0DUN8S

Harris Technical Specifications Inserts INSERT 1 or in accordance with the Risk-Informed Completion Time Program INSERT 2 Action 13a - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

INSERT 3 ACTION 26 - With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

ACTION 27 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or in accordance with the Risk-Informed Completion Time Program or be in at least HOT STANDBY within 6 hours and in at least HOT SHUTDOWN within the following 6 hours.

INSERT 4

r. Risk-Informed Completion Time Program U

This program provides controls to calculate a Risk-Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, Risk-Managed Technical Specifications (RMTS) Guidelines. The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1 and 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Action Completion Time (i.e., not the RICT) or 12 hours after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC.

The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any

change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

5($&7,9,7<&21752/6<67(06 )/2:3$7+6+/-23(5$7,1* /,0,7,1*&21',7,21)2523(5$7,21 $WOHDVWWZRRIWKHIROORZLQJWKUHHERURQLQMHFWLRQIORZSDWKVVKDOOEH23(5$%/( D 7KHIORZSDWKIURPWKHERULFDFLGWDQNYLDDERULFDFLGWUDQVIHUSXPSDQGD FKDUJLQJVDIHW\LQMHFWLRQSXPSWRWKH5HDFWRU&RRODQW6\VWHP 5&6 DQG E 7ZRIORZSDWKVIURPWKHUHIXHOLQJZDWHUVWRUDJHWDQNYLDFKDUJLQJVDIHW\LQMHFWLRQ SXPSVWRWKH5&6 $33/,&$%,/,7< 02'(6DQG ,16(57 $&7,21

LWKRQO\RQHRIWKHDERYHUHTXLUHGERURQLQMHFWLRQIORZSDWKVWRWKH5&623(5$%/(UHVWRUHDW

OHDVWWZRERURQLQMHFWLRQIORZSDWKVWRWKH5&6WR23(5$%/(VWDWXVZLWKLQKRXUVRUEHLQDW OHDVW+2767$1'%<DQGERUDWHGWRD6+87'2:10$5*,1DVVSHFLILHGLQWKH&25( 23(5$7,1*/,0,765(3257 &2/5 DW)ZLWKLQWKHQH[WKRXUVUHVWRUHDWOHDVWWZRIORZ SDWKVWR23(5$%/(VWDWXVZLWKLQWKHQH[WGD\VRUEHLQ+276+87'2:1ZLWKLQWKHQH[W KRXUV 6859(,//$1&(5(48,5(0(176 $WOHDVWWZRRIWKHDERYHUHTXLUHGIORZSDWKVVKDOOEHGHPRQVWUDWHG23(5$%/( D $WOHDVWRQFHSHUGD\VE\YHULI\LQJWKDWWKHWHPSHUDWXUHRIWKHIORZSDWK EHWZHHQWKHERULFDFLGWDQNDQGWKHFKDUJLQJVDIHW\LQMHFWLRQSXPSVXFWLRQ KHDGHUWDQNLVJUHDWHUWKDQRUHTXDOWR)ZKHQDIORZSDWKIURPWKHERULFDFLG WDQNLVXVHG E $WWKHIUHTXHQFLHVVSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ YHULI\LQJWKDWHDFKYDOYH PDQXDOSRZHURSHUDWHGRUDXWRPDWLF LQWKHIORZSDWK WKDWLVQRWORFNHGVHDOHGRURWKHUZLVHVHFXUHGLQSRVLWLRQLVLQLWVFRUUHFW SRVLWLRQ F $WWKHIUHTXHQFLHVVSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ YHULI\LQJWKDWHDFKDXWRPDWLFYDOYHLQWKHIORZSDWKDFWXDWHVWRLWVFRUUHFWSRVLWLRQ RQDVDIHW\LQMHFWLRQWHVWVLJQDODQG G $WWKHIUHTXHQFLHVVSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ YHULI\LQJWKDWWKHIORZSDWKUHTXLUHGE\6SHFLILFDWLRQDGHOLYHUVDWOHDVW JSPWRWKH5&6 6+($521+$55,681,7 $PHQGPHQW1R

5($&7,9,7<&21752/6<67(06 &+$5*,1*3803623(5$7,1* /,0,7,1*&21',7,21)2523(5$7,21 $WOHDVWWZRFKDUJLQJVDIHW\LQMHFWLRQSXPSVVKDOOEH23(5$%/( $33/,&$%,/,7< 02'(6DQG INSERT 1 $&7,21

LWKRQO\RQHFKDUJLQJVDIHW\LQMHFWLRQSXPS23(5$%/(UHVWRUHDWOHDVWWZRFKDUJLQJVDIHW\

LQMHFWLRQSXPSVWR23(5$%/(VWDWXVZLWKLQKRXUV RUEHLQDWOHDVW+2767$1'%<DQG ERUDWHGWRD6+87'2:10$5*,1DVVSHFLILHGLQWKH&25(23(5$7,1*/,0,765(3257

 &2/5 DW)ZLWKLQWKHQH[WKRXUVUHVWRUHDWOHDVWWZRFKDUJLQJVDIHW\LQMHFWLRQSXPSVWR

23(5$%/(VWDWXVZLWKLQWKHQH[WGD\VRUEHLQ+276+87'2:1ZLWKLQWKHQH[WKRXUV 127( 7KHµ$¶7UDLQFKDUJLQJVDIHW\SXPSLVDOORZHGWREHLQRSHUDEOHIRUDWRWDORIGD\VRQO\WRDOORZ IRUWKHLPSOHPHQWDWLRQRIGHVLJQLPSURYHPHQWVRQWKHµ$¶7UDLQ(6:SXPS 7KHGD\VZLOO EHWDNHQRQHWLPHQRODWHUWKDQ2FWREHU 'XULQJWKHSHULRGLQZKLFKWKHµ$¶7UDLQ (6:SXPSVXSSO\IURPWKH$X[LOLDU\5HVHUYRLURU0DLQ5HVHUYRLULVQRWDYDLODEOH1RUPDO 6HUYLFH:DWHUZLOOUHPDLQDYDLODEOHDQGLQVHUYLFHWRVXSSO\WKHµ$¶7UDLQ(6:HTXLSPHQWORDGV XQWLOWKHV\VWHPLVUHDG\IRUSRVWPDLQWHQDQFHWHVWLQJ $OORZDQFHRIWKHH[WHQGHG&RPSOHWLRQ 7LPHLVFRQWLQJHQWRQPHHWLQJWKH&RPSHQVDWRU\0HDVXUHVDQG&RQGLWLRQVGHVFULEHGLQWKH +13/$5VXEPLWWDOFRUUHVSRQGHQFHOHWWHU+13 6859(,//$1&(5(48,5(0(176 $WOHDVWWZRFKDUJLQJVDIHW\LQMHFWLRQSXPSVVKDOOEHGHPRQVWUDWHG23(5$%/(E\ YHULI\LQJRQUHFLUFXODWLRQIORZRULQVHUYLFHVXSSO\LQJIORZWRWKH5HDFWRU&RRODQW 6\VWHPDQGUHDFWRUFRRODQWSXPSVHDOVWKDWDGLIIHUHQWLDOSUHVVXUHDFURVVHDFKSXPS RIJUHDWHUWKDQRUHTXDOWRSVLGLVGHYHORSHGZKHQWHVWHGSXUVXDQWWRWKH

              ,16(59,&(7(67,1*352*5$0

6+($521+$55,681,7 $PHQGPHQW1R

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-1 REACTOR TRIP SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UN IT OF CHANNELS TO TRIP OPERABLE MODES ACTION

1. Manual Reactor Trip 2 1 2 1 2 1 2 1 2 3\ 4*, s* 9

2. Power Range, Neutron Flux

a. High Setpoint 4 2 3 1, 2 2

b. Low Setpoint 4 2 3 1###, 2 2

3. Power Range, Neutron Flux 4 2 3 1, 2 2 High Positive Rate

4. Power Range, Neutron Flux, 4 2 3 1, 2 2 High Negative Rate

5. Intermediate Range, Neutron Flux 2 1 2 1###, 2 3

6. Source Range, Neutron Flux

a. Startup 2 1 2 2## 4

b. Shutdown 2 1 2 3, 4, 5 5

7. Overtemperature .b.T 3 2 2 1, 2 6

8. Overpower .b.T 3 2 2 1, 2 6

9. Pressurizer Pressure --Low (Above P-7) 3 2 2 1 6(1)

10. Pressurizer Pressure--High 3 2 2 1, 2 6

11. Pressurizer Water Level--High 3 2 2 1 6 (Above P-7)

SHEARON HARRIS - UNIT 1 3/4 3-2 Amendment No. 84

TABLE 3.3-1 (Continued) REACTOR TRIP SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UN IT OF CHANNELS TO TRIP OPERABLE MODES ACTION

12. Reactor Coolant Flow--Low

a. Single Loop (Above P-8) 3/loop 2/loop in any 2/loop in each 1 6 operating loop operating loop

b. Two Loops (Above P-7 and below P-8) 3/loop 2/loop in two operating loops 2/loop in each operating loop 1

0 D

13. Stearn Generator Water 3/strn. gen. 2/stm. gen. in 2/stm. gen. each 1, 2 6(1)

Level--Low-Low any operating operating stm. stm. gen. gen. 14 . Stearn Generator Water Level--Low 2 strn. gen. 1 stm. gen. 1 stm. gen. l eve 1 I, 2 6 Coincident With Stearn/ level and level coincident and 2 stm./feed-Feedwater Flow Mismatch 2 stm./feed- with 1 water fl ow water fl ow stm./feedwater mismatch in same mismatch in fl ow mismatch in stm. gen. or 2 each stm. gen. same stm. gen. stm. gen. level and 1 stm./feedwater flow mismatch in same stm. gen.

15. Undervoltage--Reactor Coolant 2/pump 2/train 2/train 1 6 Pumps (Above P-7)

SHEARON HARRIS - UNIT 1 3/4 3-3 Amendment No. 84

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-1 (Continued) REACTOR TRIP SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. OF CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT CHANNELS TO TRIP OPERABLE MODES ACTION

16. Underfrequency - - Reactor Coolant Pumps 2/pump 2/train 2/train 1 6 (Above P-7)

17. Turbine Trip (Above P:-7) a Low Fluid Oil Pressure 3 2 2 1 6

b. Turbine Throttle Valve Closure 4 4 1 1 10

18. Safety Injection Input from ESF 2 1 2 1, 2 13

19. Reactor Trip System Interlocks

a. Intermediate Range Neutron Flux, P-6 2 1 2 2"## 7

b. Low Power Reactor Trips Block, P-7

1) P-10Input 4 2 3 1 7 or .

2) P-13 Input 2 1 2 1 7 C. Power Range Neutron Flux, P-8 4 2 3 1 7

d. Power Range Neutron Flux, P-10 4 2 3 1, 2 7

e. Turbine Inlet Pressure, P-13 2 1 2 1 7 SHEARON HARRIS .- UNIT 1 3/4 3-4 Amendment No. 139

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-1 (Continued) REACTOR TRIP SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UN IT OF CHANNELS TO TRIP OPERABLE MODES ACTION

20. Reactor Trip Breakers 2 1 2 1. 2 8. 11 2 1 2 3*. 4*. 5* 9

21. Automatic Trip and Interlock 2 1 2 1. 2 13 Logic 2 1 2 3*. 4*. 5* 9

22. Reactor Trip Bypass Breakers 2 1 1 ** 12 SHEARON HARRIS - UNIT 1 3/4 3-5 Amendment No. 101

TABLE 3.3-1 (Continued) TABLE NOTATIONS

  *when the Reactor Trip System breakers are closed and the Control Rod Drive System is capable of rod withdrawal.
  **whenever Reactor Trip Breakers are to be tested.
##Below the P-6 (Intermediate Range Neutron Flux Interlock) Setpoint .

1. 1. Below the P-10 (Low Setpoint Power Range Neutron Flux Interlock) Setpoint.

(l)The applicable MODES for these channels noted in Table 3.3-3 are more restrictive and, therefore. applicable. ACTION STATEMENTS :,16(57 ; ACTION 1 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable channel to OPERABLE status within 48 hours or be in HOT STANDBY within the next 6 hours.

                                                           ,16(57

ACTION 2 - With the number of OPERABLE channels one less than the Total Number of Channels. STARTUP and/or OWER OPERATION may proceed provided the following co itions are satisfied :

a. The inoperable channel i placed in the tripped condition within 6 hours.

b. The Minimum Channels OPERABLE requirement is met:

however. the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1. and

c. Either. THERMAL POWER is restricted to less than or equal to 75% of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours: or. the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

SHEARON HARRI S - UNIT 1 3/4 3-6 Amendment No . l-e-l

TABLE 3.3-1 (Continued) ACTION STATEMENTS (Continued) ACTION 3 - With the number of channels OPERABLE one less than the Minimum Channels OPERABLE requirement and with the THERMAL POWER level:

a. Below the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint, and

b. Above the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint but below 10% of RATED THERMAL POWER, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above 10% of RATED THERMAL POWER. ACTION 4 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, suspend all operations involving positive reactivity changes. ACTION 5 - a. With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoper-able channel to OPERABLE status within 48 hour~ or open the Reactor Trip System breakers, and verify compliance with the s.hutdown margin' requirements of Specification 3. 1. 1. 2 within l hour and at least once per 12 hours thereafter.

b. With no channels OPERABLE, open the Reactor Trip System breakers within 1 hour and suspend all operations involving positive reactivity changes: Verify compliance with the SHUTDOWN MARCIN requirements of Specification 3.1.1.2 within l hour and at least once per 12 hours thereafter.

ACTION 6 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

                                       ,16(57

a. The inoperable~ ced in the tripped condition within 6 hours, and

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.J.1.1.

ACTION 7 - With less than the Minimum Number of Channels OPERABLE, within 1 hour determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or apply Specification 3.0.3. SHEARON HARRIS - UNIT l 3/4 3-7 Amendment No. -l-5

TABLE 3.3-1 (Continued) ACTION STATEMENTS (Continued) ACTION 8 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. be in at least HOT STANDBY within 6 hours; however. one channel may be bypassed for up to 2 hours for surveillance testing per Specification 4.3.1.1. provided the other channel is OPERABLE . ACTION 9 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable channel to OPERABLE status within 48 hours or open the Reactor Trip System breakers within the next hour. ACTION 10 - With the number of OPERABLE channels less than the Total Number of Channels. operation may continue provided the inoperable channels are placed in the tripped condition

          ,16(57

within 6 hours. ACTION 11 - With of the diverse trip features (undervoltage or shunt trip attac n ) inoperable. restore it to OPERABLE status within 48 hou or declare the breaker inoperable and apply ACTION 8. The breaker shall not be bypassed while one of the diverse trip features is inoperable except for the time required for performing maintenance to restore the breaker to OPERABLE status. ACTION 12 - No additional corrective actions are required. ,16(57 ACTION 13 With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.1.1. provided the other channel is OPERABLE. ,16(57 L

SHEARON HARRIS - UNIT 1 3/4 3-8 Amendment No . ~

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-3 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

1. Safety Injection (Reactor Trip, Feedwater Isolation. Control Room Isolation. Start Diesel Generators . Containment Ventilation Isolation . Phase A Containment Isolation. Start Auxiliary Feedwater System Motor-Driven Pumps. Start Containment Fan Coolers. Start Emergency Service Water Pumps.

Start Emergency Service Water Booster Pumps )

a. Manual Initiation 2 1 2 1. 2. 3. 4 18

b. Automatic Actuation Logic and 2 1 2 1. 2. 3, 4 14 Actuation Relays

c. Containment Pressure--High-1 3 2 2 1. 2, 3. 4 19

d. Pressurizer Pressure--Low 3 2 2 1. 2. 3# 19

e. Steam Line Pressure--Low 3/steam 2/steam 2/steam line 1. 2. 3# 19 line line in any steam line SHEARON HARRIS - UNIT 1 3/4 3 - 18 Amendment No. 101

( ( {_ 1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ TABLE 3. l-3 (Continued} RQO\

i z ENlilNEERED SAFETY FEATURES ACTUAl ION SYSTEM INSTRUMENTATION MINIMUM

    $                                             TOTAL NO. CHANNELS        CUAHHELS APPLICABLE

ID

    ;a  FUNCTIONAL UNIT                          Of CHANNELS    TO TRIP         Ol'ERABL~    HODES        ACTION
    &II
     *I 2. Contalnaent Spray C

z a. Manual lnitt1tton '* 2 1 with 2 1. 2. 3, 4 18

    !=1                                                         2 coincident t-'                                                         ,wilcl1es

b. Autoaalic Aclualton 2 1 2 1, 2. 3, 4 14 Logic and Actuation Relays t!

w

    ~   3.

c. .Containaent. Pressure--

ffigh-3 Conlafnaent Isolation 4 2 3 1. 2. 3 16

a. Phase "A" l1olatton l) Manual lntttatton 2 l 2 1, 2, 1. 4 18

2) Auloaaltc Actuation 2 1 2 1, 2. 3, 4 14 Logic and Actuation Relay,

3) Safely lnjectton See Ilea 1. above for all Safely Injection Initiating functions and requ11eaents. .~..

b. Phase *e* Isolation

1) Manual Containaenl See Ile* 2.a. above ror Manual Contalnaenl Spray initiating functions Spray lntttallon and requireaents.

I

                             . I C

J i

( ( 1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-3 (Continued) Iz EHGINfEAfO SAFETY FEATURES ACTUATION SYSTEM INSTRUHENTATION TOTAL NO. CHANNELS HINIHl>>e

  !::a                                                                       CHANNELS         APPLICABLE H

If' t FUNCTIONAL UNIT 3,

               .                           . Of CHAHHfLS Contat1111ent Isolation (Continued)

TO TRIP OPENAOLE HODES ACTION ' i 2) Autoaattc Actuation 2 1 2 1, 2

1. 4 14 i t1 logic *nd Actuation i I

I Relay, I .,. ,. l) Contatnaent See *Ile* 2.c. abovo for Contalnaent Pres~ure lltgh-3 Initiating Pressure--Htgh-3 functions and require* ents. I i c. Contatnaent Ventilation ! holatton li l'!

1) Manual Contatnaent See lte* 2.a. above for Manual Contatnaent Spray Initiating Spray lnttbtton functions and requtre* ents.

                                                                                             ,1....2.

I

2) Autoaattc Actu.tton 2 1 2 3, 4, 17, 25 logic and Actuation Melay1 I

3) Safety Injection See Ile* 1. above for all Safety Injection tnlttattng functions and requt reaents.

l

4) Contatnaent Radioactivity

                        ** Area Monitors           4     See Ta~I* 3.l-6, Ilea, la, for tnttlattng functions (both preantry               and requlre* ent,.                                            , .1..

afld nor* al purges)

b. Airborne Gaseous Aid toac ll vtty

en i

x:

TABLE 3.3-3 (Continued) ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION ~ t-1 tll MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION ~ t-1 ~ ~ 3. Containment Isolation (Continued) (1) RCS Leak 1 See Table 3.3-6, Item lbl, for initiating functions Detection and requirements. (normal purge) (2) Preentry Purge 1 See Table 3.3-6, Item lb2, for initiating functions w Detector and requirements. ~ c. ,Airborne Particulate w Radioactivity I I',)

(1) RCS Leak 1 See Table 3.3-6, Item lCl, for initiating functions Detection and requirements. (normal purge) (2) Preentry Purge 1 See Table 3.3-6, Item 1C2, for initiating functions Detector and requirements.

5) Manual Phase "A" See Item 3.a.l) above for Manual Phase "A" Isolation initiating Isolation functions and requirements.

4. Main Steaµi Line Isolation j;' a. Manual Initiation l

~*

(f;

1) Individual MSIV 1/steam line 1/steam line 1/operating 1, 2, 3, 4 23 Closure steam line rt

2) System 2 1 2 1, 2, 3

z 0 bt

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-3 (Continued) ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO . CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

4. Main Steam Line Isolation (Continued)

b. Automatic Actuation Logic and 2 1 2 1. 2. 3. 4 14 Actuation Relays

c. Containment Pressure --High -2 3 2 2 1. 2. 3 19

d. St eam Line Pressure --Low See Item l .e. above for Steam Line Pressure--Low initiating functions and requirements .

e. Negative St eam Line Pres sure 3/steam 2 in any 2/steam line 3***. 4... 19 Rate--High line steam line

5. Turbine Trip and Feedwater Isolation

a. Automatic Actuation Logic and 2 1 2 1. 2 24 Actuation Relays

b. Steam Generator Water 4/stm. gen. 2/stm. gen. 3/stm. gen. 1. 2 19 Level--High-High (P-14) in any stm. in each gen . stm. gen .

c. Safety Injection See Item 1. above for all Safety Injection initiating functions and requirements.

SHEARON HARRIS - UNIT 1 3/4 3-22 Amendment No. 101

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-3 (Continued) ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO . CHANNELS CHANNELS APPLICABLE FUNCTIONAL UN IT OF CHANNELS TO TRl.e_ OPERABLE MODES. ACTION

6. Auxiliary Feedwater

a. Manual Initiation

1) Motor-Driven Pumps 1/pump 1/pump 1/pump 1. 2. 3 23

2) Turbine-Driven Pumps 2/pump 1/pump 2/pump 1. 2. 3 23

b. Automatic Actuation Logic and 2 1 2 1. 2. 3 21 Actuation Relays C. Steam Generator Water Level -- Low-Low

1) Start Motor - 3/stm. gen. 2/stm . gen. 2/stm . 1. 2. 3 19 Driven Pumps in any stm . gen. in gen. each stm.

gen.

2) Start Turbine- 3/stm. gen . 2/stm . gen . 2/stm. 1. 2. 3 19 Driven Pump in any 2 gen. in stm. gen. each stm .

gen .

d. Safety Injection Start See Item 1. above for all Safety Injection initiating Motor -Driven Pumps functions and requirements.

e. Loss-of-Offsite Power Start See Item 9. below for Loss of Offsite Power initiating Motor-Driven Pumps and functions and requirements.

Turbine-Driven Pump

f. Trip of All Main Feedwater Pumps 1/pump 1/pump 1/pump 1. 2 15 Start Motor-Driven Pumps SHEARON HARRIS - UNIT 1 3/4 3-23 Amendment No . 1 01

TABLE 3.3-3 (Continued) ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

6. Auxiliary Feedwater (Continued)

g. Steam Line Differential Pressure--High 3/steam line 2/steam line 2/steam 1. 2. 3 twice with any line

                                                                                                       +/-90

steamline low Coincident With Main Steam Line See Item 4. above for all Steam Line Isolation initiating Isolation (Causes AFW Isolation) functions and requirements

7. Safety Injection Switchover to Containment Sump

a. Automatic Actuation Logic and 2 1 2 1. 2. 3. 4 14 Actuation Relays

b. RWST Level--Low-Low 4 2 3 1. 2. 3. 4 16 Coincident With Safety Injection See Item 1. above for all Safety Injection initiating functions and requirements.

8. Containment Spray Switch-over to Containment Sump

a. Automatic Actuation Logic and 2 1 2 1. 2. 3. 4 14 Actuation Relays SHEARON HARRIS - UNIT 1 3/4 3-24 Amendment No ....:i...o.:i

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ TABLE 3.3-3 (Continued) ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO . CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

8. Containment Spray Switch-over to Containment Sump (Continued)

b. RWST--Low Low See Item 7.b. above for all RWST--Low Low initiating functions and requirements.

Coincident With Containment See Item 2 above for all Containment Spray initiating functions Spray and requirements .

9. Loss-of-Offsite Power

a. 6.9 kV Emergency Bus-- 3/bus 2/bus 2/bus 1. 2. 3. 4 15a*

Undervoltage Primary

b. 6.9 kV Emergency Bus-- 3/bus 2/bus 2/bus 1. 2. 3. 4 15a*

Undervoltage Secondary

10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer Pressure.

P-11 3 2 2 1. 2. 3 20 Not P-11 3 2 2 1. 2. 3 20

b. Low-Low Tavg

P-12 3 2 2 1. 2. 3 20 C. Reactor Trip. P-4 2 2 2 1. 2. 3 22

d. Steam Generator Water Level. See Item 5.b. above for all P-14 initiating functions and P-14 requirements.

SHEARON HARRIS - UNIT 1 3/4 3-25 Amendment 79 I

TABLE 3.3-3 (Cont inued) TABLE NOTATI ONS

 *The prov i sions of Specification 3.0.4 are not applicable .
 #Trip function may be blocked 1n this MODE below the P-11 (Pressurizer Pressure Interlock) Setpoint .
**During CORE ALTERATIONS or movement of irradiated fuel in containment.

refer to Specification 3.9.9.

- - Trip function automatically blocked above P-11 and may be blocked below P-11 when Safety Injection on low steam line pressure is not blocked.

                                                   ,16(57

ACTION 14 - With the number of OPERABLE cha nels one less than the Minimum Channels OPERABLE requirement. estore the inoperable channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1. provided the other channel is OPERABLE . ACTION 15 - With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed until performance of the next required CHANNEL OPERATIONAL TEST provided the inoperable channel is placed in the tripped condition within 1 hour -~ I,16(57 I ACTION 15a - With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the inoperable channel is placed in the tripped condition within 1 hour. With less than the minimum channels OPERABLE. operation may proceed provided the minimum number of channels is restored within one hour. otherwise declare the affected diesel generator inoperable. When performing surveillance testing of either primary or secondary undervoltage relays, the redundant emergency bus and associated primary and secondary relays shall be OPERABLE . ACTION 16 - With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the inoperable channel is placed in the bypassed condition within 6 hours and the Minimum Channels OPERABLE requirement is met. One additional channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1. ACTION 17 - With less than the Minimum Channel s OPERABLE requirement. operation may continue provided the Containment Purge Makeup and Exhaust Isolation valves are maintained closed while in MODES 1.

2. 3 and 4 (refer to Specification 3.6.1.7). For MODE 6. refer to Specification 3.9.4 .

                                                    ,16(57

ACTION 18 - With the number of OPERABLE chan els one less than the Minimum Channels OPERABLE requirement. store the inoperable channel to OPERABLE status within 48 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. SHEARON HARRIS - UNIT 1 3/4 3-26 Amendment No. +-0-l

TABLE 3.3-3 (Continued) ACTION STATEMENTS (Continued) ACTION 19 - With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the following conditions are satisfied: .---------.

                                                ,16(57

a. The inoperable annel is placed in the tripped condition within 6 hours. and

b. The Minimum Channels OPERABLE requirement is met; however.

the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1. ACTION 20 - With less than the Minimum Number of Channels OPERABLE. within 1 hour determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition. or apply Specification 3.0.3. ,16(57 ACTION 21 - With the number of OPERABLE cha nels one less than the Minimum Channels OPERABLE requirement. estore the inoperable channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in at least HOT SHUTDOWN within the following 6 hours: however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE. ACTION 22 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours or be in at least HOT STANDBY within 6 hours and in at least HOT SHUTDOWN within the following 6 hours. ACTION 23 - With the number of OPERABLE channels less than the Total Number of Channels. declare the associated equipment inoperable and take the appropriate ACTION required in accordance with the specific equipment specification. ,16(57 ACTION 24 - With the number of OPERABLE cha els one less than the Minimum Channels OPERABLE requirement. estore the inoperable channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE. ACTION 25 - During CORE ALTERATIONS or movement of irradiated fuel within containment. comply with the ACTION statement of Specification 3.9.9. ,16(57 L

SHEARON HARRIS - UNIT 1 3/4 3-27 Amemdment No . U)..l

REACTOR COOLANT SYSTEM 3/4.4.4 RELIEF VALVES LIMITING CONDITION FOR OPERATION 3.4.4 All power-operated relief valves (PORVs) and their associated block valves shall be OPERABLE. APPLICABILITY: MODES 1. 2. and 3 ACTION:

a. With one or more PORV(s) inoperable, because of excessive seat leakage. within 1 hour either restore the PORV(s) to OPERABLE status or close the associated block valve(s) with power maintained to the block valve(s): otherwise. be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

b. With one or more PORV(s) inoperable due to causes other than excessive seat leakage. within 1 hour either restore the PORV(s) to OPERABLE status or close the associated block valve(s) and remove power from the block valve(s). and ,16(57

1. With only one safety grade P OPERABLE. restore at least a total of two safety gra ORVs to OPERABLE status within the following 72 hours be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. or

2. With no safety grade PORVs OPERABLE. restore at least one safety grade PORV to OPERABLE status within 1 hour and follow ACTION b.1. above. with the time requirement of that ACTION statement based on the time of initial loss of the remaining inoperable safety grade PORV or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

c. With one or more block valve(s) inoperable. within 1 hour:

(1) restore the block valve(s) to OPERABLE status. or close the block valve(s) and remove power from the block valve(s). or close the PORV and remove power from its associated solenoid valve: and (2) apply the ACTION b.. above. as appropriate. for the isolated PORV(s).

d. The provisions of Specification 3.0.4 are not applicable .

SHEARON HARRIS - UNIT 1 3/4 4-11 Amendment No. 2l-

EMERGENCY CORE COOLING SYSTEMS 3/4.5.2 ECCS SUBSYSTEMS - Tavg GREATER THAN OR EQUAL TO 350°F LIMITING CONDITION FOR OPERATION 3.5.2 Two independent Emergency Core Cooling System (ECCS) subsystems shall be OPERABLE with each subsystem comprised of:

a. One OPERABLE Charging/safety injection pump,

b. One OPERABLE RHR heat exchanger,

c. One OPERABLE RHR pump, and

d. An OPERABLE flow path capable of taking suction from the refueling water storage tank on a Safety Injection signal and, upon being manually aligned, transferring suction to the containment sump during the recirculation phase of operation.

APPLICABILITY: MODES 1, 2, and 3. ,16(57 ACTION:

a. With one ECCS subsystem inoperable, restore the inoperable subsystem to OPERABLE status within 72 hours* or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

b. In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date. The current value of the usage factor for each affected Safety Injection nozzle shall be provided in this Special Report whenever its value exceeds 0.70.

NOTE -----------------------------------------------------------

The A Train ECCS subsystem is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump supply from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056.

SURVEILLANCE REQUIREMENTS 4.5.2 Each ECCS subsystem shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by:

1. Verifying that the following valves are in the indicated positions with the control power disconnect switch in the "OFF" position, and the valve control switch in the "PULL TO LOCK" position:

SHEARON HARRIS - UNIT 1 3/4 5-3 Amendment No. 154

CONTAINMENT SYSTEMS CONTAINMENT AIR LOCKS LIMITING CONDITION FOR OPERATION

b. One or more containment air locks with containment air lock interlock mechanism inoperable.##

1. Within one hour, verify an OPERABLE door is closed in the affected air lock, and

2. Within 24 hours, lock an OPERABLE door closed in the affected air lock, and

3. Once per 31 days, verify the OPERABLE door is locked closed in the affected air lock*, or

4. Otherwise, be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

c. One or more containment air locks inoperable for reasons other than 3.6.1.3.a or 3.6.1.3.b.

                                          ,16(57

1. Immediately initiate action to evaluate overall containment leakage rate per LC 3.6.1.2, and

2. Within one hour, door is closed in the affected air lock, and

3. Within 24 hours, restore air lock to OPERABLE status, or

4. Otherwise be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

1. 1. ACTIONS 3.6.1.3.b.l, 3.6.1.3.b.2, 3.6.1.3.b.3, and 3.6.1.3.b.4 are not applicable if both doors in the same air lock are inoperable and ACTION 3.6.1.3.c is entered.

2. Entry and exit of containment is permissible under the control of a dedicated individual.

Air lock doors in high radiation areas may be verified closed by administrative means.

SHEARON HARRIS - UNIT 1 3/4 6-4a Amendment No. -99

&217$,10(176<67(06 '(35(6685,=$7,21$1'&22/,1*6<67(06 &217$,10(17635$<6<67(0 /,0,7,1*&21',7,21)2523(5$7,21 7ZRLQGHSHQGHQW&RQWDLQPHQW6SUD\6\VWHPVVKDOOEH23(5$%/(ZLWKHDFK6SUD\ 6\VWHPFDSDEOHRIWDNLQJVXFWLRQIURPWKH5:67DQGWUDQVIHUULQJVXFWLRQWRWKH FRQWDLQPHQWVXPS $33/,&$%,/,7< 02'(6DQG $&7,21 ,16(57

LWKRQH&RQWDLQPHQW6SUD\6\VWHPLQRSHUDEOHUHVWRUHWKHLQRSHUDEOH6SUD\6\VWHPWR

23(5$%/(VWDWXVZLWKLQKRXUV RUEHLQDWOHDVW+2767$1'%<ZLWKLQWKHQH[WKRXUV UHVWRUHWKHLQRSHUDEOH6SUD\6\VWHPWR23(5$%/(VWDWXVZLWKLQWKHQH[WKRXUVRUEHLQ &2/'6+87'2:1ZLWKLQWKHIROORZLQJKRXUV 5HIHUDOVRWR6SHFLILFDWLRQ$FWLRQ 127( 7KHµ$¶7UDLQ&RQWDLQPHQW6SUD\6\VWHPLVDOORZHGWREHLQRSHUDEOHIRUDWRWDORIGD\VRQO\ WRDOORZIRUWKHLPSOHPHQWDWLRQRIGHVLJQLPSURYHPHQWVRQWKHµ$¶7UDLQ(6:SXPS 7KH GD\VZLOOEHWDNHQRQHWLPHQRODWHUWKDQ2FWREHU 'XULQJWKHSHULRGLQZKLFKWKHµ$¶ 7UDLQ(6:SXPSVXSSO\IURPWKH$X[LOLDU\5HVHUYRLURU0DLQ5HVHUYRLULVQRWDYDLODEOH1RUPDO 6HUYLFH:DWHUZLOOUHPDLQDYDLODEOHDQGLQVHUYLFHWRVXSSO\WKHµ$¶7UDLQ(6:HTXLSPHQWORDGV XQWLOWKHV\VWHPLVUHDG\IRUSRVWPDLQWHQDQFHWHVWLQJ $OORZDQFHRIWKHH[WHQGHG&RPSOHWLRQ 7LPHLVFRQWLQJHQWRQPHHWLQJWKH&RPSHQVDWRU\0HDVXUHVDQG&RQGLWLRQVGHVFULEHGLQ+13 /$5VXEPLWWDOFRUUHVSRQGHQFHOHWWHU+13 6859(,//$1&(5(48,5(0(176 (DFK&RQWDLQPHQW6SUD\6\VWHPVKDOOEHGHPRQVWUDWHG23(5$%/( D $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ YHULI\LQJWKDWHDFKYDOYH PDQXDOSRZHURSHUDWHGRUDXWRPDWLF LQWKHIORZSDWK WKDWLVQRWORFNHGVHDOHGRURWKHUZLVHVHFXUHGLQSRVLWLRQLVLQLWVFRUUHFW SRVLWLRQ E %\YHULI\LQJWKDWRQDQLQGLFDWHGUHFLUFXODWLRQIORZRIDWOHDVWJSPHDFK SXPSGHYHORSVDGLIIHUHQWLDOSUHVVXUHRIJUHDWHUWKDQRUHTXDOWRSVLZKHQ WHVWHGSXUVXDQWWRWKH,16(59,&(7(67,1*352*5$0 F $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\

                      9HULI\LQJWKDWHDFKDXWRPDWLFYDOYHLQWKHIORZSDWKDFWXDWHVWRLWVFRUUHFW

SRVLWLRQRQDFRQWDLQPHQWVSUD\DFWXDWLRQWHVWVLJQDODQG

                      9HULI\LQJWKDWHDFKVSUD\SXPSVWDUWVDXWRPDWLFDOO\RQDFRQWDLQPHQWVSUD\

DFWXDWLRQWHVWVLJQDO

                      9HULI\LQJWKDWFRLQFLGHQWZLWKDQLQGLFDWLRQRIFRQWDLQPHQWVSUD\SXPS

UXQQLQJHDFKDXWRPDWLFYDOYHIURPWKHVXPSDQG5:67DFWXDWHVWRLWV DSSURSULDWHSRVLWLRQIROORZLQJDQ5:67/R/RWHVWVLJQDO G $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ SHUIRUPLQJDQDLURUVPRNHIORZWHVWWKURXJKHDFKVSUD\KHDGHUDQGYHULI\LQJ HDFKVSUD\QR))OHLVXQREVWUXFWHG H $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ YHULI\LQJWKDWFRQWDLQPHQWVSUD\ORFDWLRQVVXVFHSWLEOHWRJDVDFFXPXODWLRQDUH VXIILFLHQWO\ILOOHGZLWKZDWHU

  1RWUHTXLUHGWREHPHWIRUV\VWHPYHQWIORZSDWKVRSHQHGXQGHUDGPLQLVWUDWLYHFRQWURO

6+($521+$55,681,7 $PHQGPHQW1R

CONTAINMENT SYSTEMS CONTAINMENT COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.6.2.3 Four containment fan coolers (AH-1, AH-2, AH-3, and AH-4) shall be OPERABLE with one of two fans in each cooler capable of operation at low speed. Train SA consists of AH-2 and AH-3. Train SB consists of AH-1 and AH- 4. APPLICABILITY: MODES 1, 2, 3, and 4. ,16(57 ACTION:

a. With one train of the above required containment fan coolers inoperable and both Containment Spray Systems OPERABLE, restore the inoperable train of fan coolers to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. ,16(57

b. With both trains of the above required containment fan coolers inoperable and

,16(57 both Containment Spray Systems OPERABLE, restore at least one train of fan coolers to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. Restore both above required trains of fan coolers to OPERABLE status within 7 days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. ,16(57

c. With one train of the above required containment fan coolers inoperable and one

,16(57                 Containment Spray System inoperable, restore the inoperable Spray System to OPERABLE status within 72 hours* or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. Restore the inoperable train of containment fan coolers to OPERABLE status within 7 days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.
   ----------------------------------------------------------- NOTE -----------------------------------------------------------
   *The A Train containment fan coolers and the A Train Containment Spray System are allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump supply from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056.

SURVEILLANCE REQUIREMENTS 4.6.2.3 Each train of containment fan coolers shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by:

1. Starting each fan train from the control room, and verifying that each fan train operates for at least 15 minutes, and

2. Verifying a cooling water flow rate, after correction to design basis service water conditions, of greater than or equal to 1300 gpm to each cooler.

b. At the frequency specified in the Surveillance Frequency Control Program by verifying that each fan train starts automatically on a safety injection test signal.

SHEARON HARRIS - UNIT 1 3/4 6-13 Amendment No. 154

CONTAINMENT SYSTEMS 3/4.6.3 CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3 Each containment isolation valve specified in the Technical Specification Equipment List Program, plant procedure PLP-106, shall be OPERABLE with isolation times less than or equal to required isolation times. APPLICABILITY: MODES 1, 2, 3, and 4. ACTION:

                                                                             ,16(57

With one or more of the containment isolation valve(s) inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and :

                                                          ,16(57

a. Restore the inoperable valve(s) to OPERABLE status within 4 hours, or

b. Isolate each affected penetration within 4 hours y use of at least one deactivated automatic valve secured in the isolation position, or

c. Isolate each affected penetration within 4 hours least one closed manual valve or blind flange,

d. Be in at least HOT STANDBY within the next sand in COLD SHUTDOWN within the following 30 hours.

                                                               ,16(57

SURVEILLANCE REQUIREMENTS 4.6.3.1 Each isolation valve shall be demonstrated OPERABLE prior to returning the valve to service after maintenance, repair or replacement work is performed on the valve or its associated actuator, control or power circuit by performance of a cycling test, and verification of isolation time. SHEARON HARRIS - UNIT 1 3/4 6-14 Amendment No. 84

PLANT SYSTEMS AUXILIARY FEEDWATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.2 At least three independent steam generator auxiliary feedwater pumps and associated flow paths shall be OPERABLE with:

a. Two motor-driven auxiliary feedwater pumps, each capable of being powered from separate emergency buses, and

b. One steam turbine-driven auxiliary feedwater pump capable of being powered from an OPERABLE steam supply system.

                                                                                           ,16(57

APPLICABILITY: MODES 1, 2, and 3. ACTION:

a. With one auxiliary feedwater pump inoperable, restore the required auxiliary feedwater pumps to OPERABLE status within 72 hours* or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

b. With two auxiliary feedwater pumps inoperable, be in at least HOT STANDBY within 6 hours and in HOT SHUTDOWN within the following 6 hours.

c. With three auxiliary feedwater pumps inoperable, immediately initiate corrective action to restore at least one auxiliary feedwater pump to OPERABLE status as soon as possible. (NOTE: LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status. Following restoration of one AFW train, all applicable LCOs apply based on the time the LCOs initially occurred.)

NOTE -----------------------------------------------------------

The A Train auxiliary feedwater pump is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump supply from the Auxiliary Reservoir or the Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056.

SURVEILLANCE REQUIREMENTS 4.7.1.2.1 Each auxiliary feedwater pump shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by:

1. Demonstrating that each motor-driven pump satisfies performance requirements by either:

a) Verifying each pump develops a differential pressure that (when temperature - compensated to 70°F) is greater than or equal to 1514 psid at a recirculation flow of greater than or equal to 50 gpm (25 KPPH), or b) Verifying each pump develops a differential pressure that (when temperature - compensated to 70°F) is greater than or equal to 1259 psid at a flow rate of greater than or equal to 430 gpm (215 KPPH). SHEARON HARRIS - UNIT 1 3/4 7-4 Amendment No. 154

3/$176<67(06 0$,167($0/,1(,62/$7,219$/9(6 /,0,7,1*&21',7,21)2523(5$7,21 (DFKPDLQVWHDPOLQHLVRODWLRQYDOYH 06,9 VKDOOEH23(5$%/( $33/,&$%,/,7< 02'(6DQG ,16(57 $&7,21 02'(

LWKRQH06,9LQRSHUDEOHEXWRSHQ32:(523(5$7,21PD\FRQWLQXHSURYLGHGWKH

LQRSHUDEOHYDOYHLVUHVWRUHGWR23(5$%/(VWDWXVZLWKLQKRXUVRWKHUZLVHEHLQ+27 67$1'%<ZLWKLQWKHQH[WKRXUVDQGLQ+276+87'2:1ZLWKLQWKHIROORZLQJKRXUV 02'(6DQG

LWKRQH06,9LQRSHUDEOHVXEVHTXHQWRSHUDWLRQLQ02'(RUPD\SURFHHG

SURYLGHGWKHLVRODWLRQYDOYHLVPDLQWDLQHGFORVHG 2WKHUZLVHEHLQ+2767$1'%< ZLWKLQWKHQH[WKRXUVDQGLQ+276+87'2:1ZLWKLQWKHIROORZLQJKRXUV 6859(,//$1&(5(48,5(0(176 (DFK06,9VKDOOEHGHPRQVWUDWHG23(5$%/(E\YHULI\LQJIXOOFORVXUHZLWKLQ VHFRQGVZKHQWHVWHGSXUVXDQWWRWKH,16(59,&(7(67,1*352*5$0 7KH SURYLVLRQVRI6SHFLILFDWLRQDUHQRWDSSOLFDEOHIRUHQWU\LQWR02'(6RU 6+($521+$55,681,7 $PHQGPHQW1R

PLANT SYSTEMS 3/4.7.3 COMPONENT COOLING WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.3 At least two component cooling water (CCW) pumps*, heat exchangers and essential flow paths shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

                                                  ,16(57

ACTION: With only one component cooling water flow path OPERABLE, restore at least two flow paths to OPERABLE status within 72 hours** or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. SURVEILLANCE REQUIREMENTS 4.7.3 At least two component cooling water flow paths shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) servicing safety-related equipment that is not locked, sealed, or otherwise secured in position is in its correct position; and

b. At the frequency specified in the Surveillance Frequency Control Program by verifying that:

1. Each automatic valve servicing safety-related equipment or isolating non-safety-related components actuates to its correct position on a Safety Injection test signal, and

2. Each Component Cooling Water System pump required to be OPERABLE starts automatically on a Safety Injection test signal.

3. Each automatic valve serving the gross failed fuel detector and sample system heat exchangers actuates to its correct position on a Low Surge Tank Level test signal.

The breaker for CCW pump 1C-SAB shall not be racked into either power source (SA or SB) unless the breaker from the applicable CCW pump (1A-SA or 1B-SB) is racked out.
- The A Train component cooling water flow path is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump.

The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump supply from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056. SHEARON HARRIS - UNIT 1 3/4 7-11 Amendment No. 154

PLANT SYSTEMS 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.4 At least two independent emergency service water loops shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

                                                          ,16(57

ACTION: With only one emergency service water loop OPERABLE, restore at least two loops to OPERABLE status within 72 hours* or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

NOTE -----------------------------------------------------------

The A Train emergency service water loop is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump supply from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056.

SURVEILLANCE REQUIREMENTS 4.7.4 At least two emergency service water loops shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) servicing safety-related equipment that is not locked, sealed, or otherwise secured in position is in its correct position; and

b. At the frequency specified in the Surveillance Frequency Control Program by verifying that:

1. Each automatic valve servicing safety-related equipment or isolating non-safety portions of the system actuates to its correct position on a Safety Injection test signal, and

2. Each emergency service water pump and each emergency service water booster pump starts automatically on a Safety Injection test signal.

SHEARON HARRIS - UNIT 1 3/4 7-12 Amendment No. 154

3/$176<67(06 (66(17,$/6(59,&(6&+,//(':$7(56<67(0 /,0,7,1*&21',7,21)2523(5$7,21 $WOHDVWWZRLQGHSHQGHQW(VVHQWLDO6HUYLFHV&KLOOHG:DWHU6\VWHPORRSVVKDOOEH 23(5$%/( $33/,&$%,/,7< 02'(6DQG

                                                                 ,16(57

$&7,21

LWKRQO\RQH(VVHQWLDO6HUYLFHV&KLOOHG:DWHU6\VWHPORRS23(5$%/(UHVWRUHDWOHDVWWZR

ORRSVWR23(5$%/(VWDWXVZLWKLQKRXUV RUEHLQDWOHDVW+2767$1'%<ZLWKLQWKHQH[W KRXUVDQGLQ&2/'6+87'2:1ZLWKLQWKHIROORZLQJKRXUV 127( 7KHµ$¶7UDLQ(VVHQWLDO6HUYLFHV&KLOOHG:DWHU6\VWHPORRSLVDOORZHGWREHLQRSHUDEOHIRUDWRWDO RIGD\VRQO\WRDOORZIRUWKHLPSOHPHQWDWLRQRIGHVLJQLPSURYHPHQWVRQWKHµ$¶7UDLQ(6: SXPS 7KHGD\VZLOOEHWDNHQRQHWLPHQRODWHUWKDQ2FWREHU 'XULQJWKHSHULRG LQZKLFKWKHµ$¶7UDLQ(6:SXPSVXSSO\IURPWKH$X[LOLDU\5HVHUYRLURU0DLQ5HVHUYRLULVQRW DYDLODEOH1RUPDO6HUYLFH:DWHUZLOOUHPDLQDYDLODEOHDQGLQVHUYLFHWRVXSSO\WKHµ$¶7UDLQ(6: HTXLSPHQWORDGVXQWLOWKHV\VWHPLVUHDG\IRUSRVWPDLQWHQDQFHWHVWLQJ $OORZDQFHRIWKH H[WHQGHG&RPSOHWLRQ7LPHLVFRQWLQJHQWRQPHHWLQJWKH&RPSHQVDWRU\0HDVXUHVDQG&RQGLWLRQV GHVFULEHGLQ+13/$5VXEPLWWDOFRUUHVSRQGHQFHOHWWHU+13 6859(,//$1&(5(48,5(0(176 7KH(VVHQWLDO6HUYLFHV&KLOOHG:DWHU6\VWHPVKDOOEHGHPRQVWUDWHG23(5$%/(E\ D 3HUIRUPDQFHRIVXUYHLOODQFHVDVUHTXLUHGE\WKH,16(59,&(7(67,1* 352*5$0DQG E $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\ GHPRQVWUDWLQJWKDW

                      1RQHVVHQWLDOSRUWLRQVRIWKHV\VWHPDUHDXWRPDWLFDOO\LVRODWHGXSRQUHFHLSW

RID6DIHW\,QMHFWLRQDFWXDWLRQVLJQDODQG

                      7KHV\VWHPVWDUWVDXWRPDWLFDOO\RQD6DIHW\,QMHFWLRQDFWXDWLRQVLJQDO

6+($521+$55,681,7 $PHQGPHQW1R

3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1 A.C. SOURCES OPERATING LIMITING CONDITION FOR OPERATION 3.8.1.1 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. Two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system, and

b. Two separate and independent diesel generators, each with:

1. A separate day tank containing a minimum of 1457 gallons of fuel,

2. A separate main fuel oil storage tank containing a minimum of 100,000 gallons of fuel, and

3. A separate fuel oil transfer pump.

c. Automatic Load Sequencers for Train A and Train B.

APPLICABILITY: MODES 1, 2, 3 and 4. ACTION:

a. With one offsite circuit of 3.8.1.1.a inoperable: ,16(57

1. Perform Surveillance Requirement 4.8.1.1.1.a within 1 hour and once per 8 hours thereafter; and

2. Restore the offsite circuit to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; and

3. Verify required feature(s) powered from the OPERABLE offsite A.C. source are OPERABLE. If required feature(s) powered from the OPERABLE offsite circuit are discovered to be inoperable at any time while in this condition, restore the required feature(s) to OPERABLE status within 24 hours from discovery of inoperable required feature(s) or declare the redundant required feature(s) powered from the inoperable A.C. source as inoperable.

b. With one diesel generator of 3.8.1.1.b inoperable:

1. Perform Surveillance Requirement 4.8.1.1.1.a within 1 hour and once per 8 hours thereafter; and

                *2. Within 24 hours, determine the OPERABLE diesel generator is not inoperable due to a common cause failure or perform Surveillance Requirement 4.8.1.1.2.a.4#; and

This ACTION is required to be completed regardless of when the inoperable EDG is restored to OPERABILITY.

Activities that normally support testing pursuant to 4.8.1.1.2.a.4, which would render the diesel inoperable (e.g., air roll), shall not be performed for testing required by this ACTION statement.

SHEARON HARRIS - UNIT 1 3/4 8-1 Amendment No. 153

ELECTRICAL POWER SYSTEMS A.C. SOURCES OPERATING

                                                                                                   ,16(57

LIMITING CONDITION FOR OPERATION ACTION (Continued):

3. Restore the diesel generator to OPERABLE status within 72 hours** or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; and

4. Verify required feature(s) powered from the OPERABLE diesel generator are OPERABLE. If required feature(s) powered from the OPERABLE diesel generator are discovered to be inoperable at any time while in this condition, restore the required feature(s) to OPERABLE status within 4 hours from discovery of inoperable required feature(s) or declare the redundant required feature(s) powered from the inoperable A.C. source as inoperable.

c. With one offsite circuit and one diesel generator of 3.8.1.1 inoperable:

NOTE: Enter applicable Condition(s) and Required Action(s) of LCO 3/4.8.3, ONSITE POWER DISTRIBUTION - OPERATING, when this condition is

        ,16(57          entered with no A.C. power to one train.

1. Restore one of the inoperable A.C. sources to OPERABLE status within 12 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

2. Following restoration of one A.C. source (offsite circuit or diesel generator),

restore the remaining inoperable A.C. source to OPERABLE status pursuant to requirements of either ACTION a or b, based on the time of initial loss of the remaining A.C. source.

- The A diesel generator is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the A Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the A Train ESW pump from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A Train ESW equipment until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence HNP-16-056.

SHEARON HARRIS - UNIT 1 3/4 8-2 Amendment No. 153

                                               'HOHWHG WH[W LQ 0DUNXS UHIOHFWV FKDQJHV SURSRVHG LQ ELECTRICAL POWER SYSTEMS
                                               'XNH (QHUJ\ /$5 A.C. SOURCES                          VXEPLWWHG -XO\

OPERATING $'$06 $FFHVVLRQ 1R 0/$ LIMITING CONDITION FOR OPERATION ACTION (Continued): ,16(57

d. With two of the required offsite A.C. sources inoperable:

1. Restore one offsite circuit to OPERABLE status within 24 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours: and

2. Verify required feature(s) are OPERABLE. If reguired feature(s) are discovered to be inoperable at any time while in this condition. restore the required feature(s) to OPERABLE status within 12 hours from discovery of inoperable required feature(s) or declare the redundant required feature(s) inoperable.

3. Following restoration of one offsite A.C. source. restore the remaining offsite A.C. source in accordance with the provisions of ACTION a with the time requirement of that ACTION based on the time of initial loss of the remaining inoperable A.C. source.

e. With two of the required diesel generators inoperable:

1. Perform Surveillance Requirement 4.8.1.1.1.a within 1 hour and once per 8 hours thereafter: and

              #2. Restore one of the diesel generators to OPERABLE status within 2 hours or be in at least ROT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

3. Following restoration of one diesel generator. restore the remaining diesel generator in accordance with the provisions of ACTION b with the time requirement of that ACTION based on the time of initial loss of the remaining inoperable diesel generator.

f. With three or more of the required A.C. sources inoperable:

1. Immediately enter Technical Specification 3.0.3.

2. Following restoration of one or more A.C. sources. restore the remaining inoperable A.C. sources in accordance with the provisions of ACTION a.b.c.d and/ore as applicable with the time

'HOHWHG requirement of that ACTION based on the time of initial loss of the remaining inoperable A.C. sources. With coAtiguous events of either an offsite or onsite A.G. source becorniAg iAoperable and resulting in failure to ffieet the LGO: t: WithiA 6 days , restore all A.G. sources required by 3.8.1.1 or be i1'l at least IIOT STANDBY withiA the next 6 hours ana in GOLD SIIUTOOWN withiA the follo vv'ing 30 hours . 1

        #Activities that normally support testing pursuant to 4.8.1 .1.2.a.4.

which would render the ~iesel inoperable (e.g .. air roll). shall not be performed for testing required by this ACTIO~ statement. SHEARON HARRIS - UNIT 1 3/4 8-3 Amendment No . 1B. I

(/(&75,&$/32:(56<67(06 $&6285&(6 23(5$7,1* /,0,7,1*&21',7,21)2523(5$7,21 $&7,21 &RQWLQXHG

                                                                                                      ,16(57

K :LWKRQHDXWRPDWLFORDGVHTXHQFHULQRSHUDEOH

                  5HVWRUHWKHDXWRPDWLFORDGVHTXHQFHUWR23(5$%/(VWDWXVZLWKLQKRXUV

RUEHLQDWOHDVW+2767$1'%<ZLWKLQWKHQH[WKRXUVDQG&2/' 6+87'2:1ZLWKLQWKHIROORZLQJKRXUV 6859(,//$1&(5(48,5(0(176 (DFKRIWKHDERYHUHTXLUHGSK\VLFDOO\LQGHSHQGHQWFLUFXLWVEHWZHHQWKHRIIVLWH WUDQVPLVVLRQQHWZRUNDQGWKHRQVLWH&ODVV(GLVWULEXWLRQV\VWHPVKDOOEH D 'HWHUPLQHG23(5$%/(DWWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\

                 &RQWURO3URJUDPE\YHULI\LQJFRUUHFWEUHDNHUDOLJQPHQWDQGSRZHUDYDLODELOLW\

DQG E 'HPRQVWUDWHG23(5$%/(DWWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH

                 )UHTXHQF\&RQWURO3URJUDPE\PDQXDOO\WUDQVIHUULQJWKHRQVLWH&ODVV(SRZHU

VXSSO\IURPWKHXQLWDX[LOLDU\WUDQVIRUPHUWRWKHVWDUWXSDX[LOLDU\WUDQVIRUPHU (DFKGLHVHOJHQHUDWRUVKDOOEHGHPRQVWUDWHG23(5$%/( D $WWKHIUHTXHQF\VSHFLILHGLQWKH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPE\

                  9HULI\LQJWKHIXHOOHYHOLQWKHGD\WDQN
                  9HULI\LQJWKHIXHOOHYHOLQWKHPDLQIXHORLOVWRUDJHWDQN
                  9HULI\LQJWKHIXHORLOWUDQVIHUSXPSFDQEHVWDUWHGDQGWUDQVIHUVIXHOIURPWKH

VWRUDJHV\VWHPWRWKHGD\WDQN

                  9HULI\LQJWKHGLHVHOJHQHUDWRUFDQVWDUW DQGDFFHOHUDWHWRV\QFKURQRXV

VSHHG USP ZLWKJHQHUDWRUVWHDG\VWDWHYROWDJHDQGIUHTXHQF\

                      YROWVDQG+]
                  9HULI\LQJWKHGLHVHOJHQHUDWRULVV\QFKURQL]HGJUDGXDOO\ORDGHG WRDQ

LQGLFDWHGN: DQGRSHUDWHVIRUDWOHDVWPLQXWHV

                  9HULI\LQJWKHSUHVVXUHLQDWOHDVWRQHDLUVWDUWUHFHLYHUWREHJUHDWHUWKDQRU

HTXDOWRSVLJDQG

                  9HULI\LQJWKHGLHVHOJHQHUDWRULVDOLJQHGWRSURYLGHVWDQGE\SRZHUWRWKH

DVVRFLDWHGHPHUJHQF\EXVHV 7KLVWHVWVKDOOEHFRQGXFWHGLQDFFRUGDQFHZLWKWKHPDQXIDFWXUHU VUHFRPPHQGDWLRQV UHJDUGLQJHQJLQHSUHOXEHDQGZDUPXSSURFHGXUHVDQGDVDSSOLFDEOHUHJDUGLQJORDGLQJ UHFRPPHQGDWLRQV

  7KLVEDQGLVPHDQWDVJXLGDQFHWRDYRLGURXWLQHRYHUORDGLQJRIWKHHQJLQH  /RDGVLQH[FHVV

RIWKLVEDQGIRUVSHFLDOWHVWLQJRUPRPHQWDU\YDULDWLRQVGXHWRFKDQJLQJEXVORDGVVKDOOQRW LQYDOLGDWHWKHWHVW 7KHYROWDJHDQGIUHTXHQF\FRQGLWLRQVVKDOOEHPHWZLWKLQVHFRQGVRUJUDGXDODFFHOHUDWLRQ WRQRORDGFRQGLWLRQVSHUYHQGRUUHFRPPHQGDWLRQVZLOOEHDQDFFHSWDEOHDOWHUQDWLYH 6+($521+$55,681,7 $PHQGPHQW1R

ELECTRICAL POWER SYSTEMS 3/4.8.2 D.C. SOURCES OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.1 As a minimum, the following D.C. electrical sources shall be OPERABLE:

a. 125-volt Emergency Battery Bank 1A-SA and either full capacity charger, 1A-SA or 1B-SA, and,

b. 125-volt Emergency Battery Bank 1B-SB and either full capacity charger, 1A-SB or 1B-SB.

APPLICABILITY: MODES 1, 2, 3, and 4. ,16(57 ACTION: With one of the required D.C. electrical sources inoperable, restore the inoperable D.C. electrical source to OPERABLE status within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. SURVEILLANCE REQUIREMENTS 4.8.2.1 Each 125-volt Emergency Battery and charger shall be demonstrated OPERABLE:

a. At the frequency specified in the Surveillance Frequency Control Program by verifying that:

1. The parameters in Table 4.8-2 meet the Category A limits, and

2. The total battery terminal voltage is greater than or equal to 129 volts on float charge.

b. At the frequency specified in the Surveillance Frequency Control Program and within 7 days after a battery discharge with battery terminal voltage below 110 volts, or battery overcharge with battery terminal voltage above 150 volts, by verifying that:

1. The parameters in Table 4.8-2 meet the Category B limits,

2. There is no visible corrosion at either terminals or connectors, or the connection resistance of these items is less than 150 x 10-6 ohm, and

3. The average electrolyte temperature of 10 connected cells is above 70° F.

SHEARON HARRIS - UNIT 1 3/4 8-12 Amendment No. 154

1R SURSRVHG FKDQJHV RQ WKLV SDJH 3URYLGHG IRU LQIRUPDWLRQ RQO\ ELECTRICAL POWER SYSTEMS 3/4.8.3 0NSITE POWER DISTRIBUTION r OPERATING ' LIMITING COHOITION FOR OPERATION 3.8.3~1 _The !allowing electrical buses shall bl 1n1rgiz1d in the spacified manner with t11 breakers open between r.dundant buses within the unit:

a. Division A ESF A.C. Buses consisting of:

l. 6900-volt Bus lA*SA.

2. 480-valt Bus lAZ*SA.

3. 480-valt Bus lAJ*SA.

b. Division B ESF A.C. Buses consisting of:

l. 6900-volt Bus lS*SB.

2. 480-valt Bus lBZ*SB.

3. 480-volt Bus l83*SB.

c. US-volt A.C. Vital Bus lDP-lA-SI energized from 1ts usoc:iatad inverter connected to US-volt O.C. Bus DP-µ-sA*,

d. US-volt A.C. Vital Bus lllP-lA-SIII energized froa its associated inv1rtar connacted to US-volt D.C. Bus DP*lA-SA*,

             **      us-volt A.C. Viul Bus lDP-lS*SII energized frca its associated inverter connected to µs-volt D.C. Bus DP-1B*Sa*,

f. 118-volt A.C. Vital Bus lDP-11-SIV 1nergized f1"011 fts usoc:iated fnv1rtar cannactad ta 125-volt D.C. Bus DP-18-SB*,

g. 125-volt O.C. Bus OP*lA*SA energized fraa Emergency Battery lA-SA and charger lA*SA or lS*SA, and

n. 1.25-volt.D.C. Bus DP-lS*SB energized frca Emergency Battery lB*SB and charger lB-SB or lA*S8 APPLICABILITY: MODES l, Z, 3, and 4.

      -rwo.invert,rs uy be disconnacted from their 125-valt O.C. bus for up to 2t hours as necessary, for tn* puri,os* of p1rforming an equalizing charg1 on their associated EHrgenc:y Battery provided: (1) their vital buses are giz1d and (2) the vit&l buses assoc:iatad with the other Emergency Battery
                                                                                            *n*r-ue- energi ied f1"011t tnei .- assoc..1 ated i nvertars and connac:ted to th1i r uso- *

~._./ ciatld US-volt O.C. bus. SHEARON HARRIS* UNIT l 3/4 8-16

ELECTRICAL POWER SYSTEMS ONSITE POWER DISTRIBUTION OPERATING

                                                                ,16(57

LIMITING CONDITION FOR OPERATION ACTION: ,16(57

a. With one of the required divisions of A.C. ESF buses not fully energized, reenergize the division within 8 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

b. With one 118-volt A.C. vital bus not energized from its associated inverter, reenergize the 118-volt A.C. vital bus within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following

,16(57 30 hours.

c. With one 118-volt A.C. vital bus not energized from its associated inverter connected to its associated D.C. bus, re-energize the 118-volt A.C. vital bus through its associated inverter connected to its associated D.C. bus within 24 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

d. With either 125-volt D.C. bus 1A-SA or 1B-SB not energized from its associated Emergency Battery, reenergize the D.C. bus from its associated Emergency Battery within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

                                          ,16(57

SURVEILLANCE REQUIREMENTS 4.8.3.1 The specified buses shall be determined energized in the required manner at the frequency specified in the Surveillance Frequency Control Program by verifying correct breaker alignment and indicated voltage on the buses. SHEARON HARRIS - UNIT 1 3/4 8-17 Amendment No. 154

ADMINISTRATIVE CONTROLS PROCEDURES AND PROGRAMS (Continued)

p. Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1.

c. The provisions of Surveillance Requirements 4.0.2 and 4.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

q. Diesel Fuel Oil Testing Program A diesel fuel oil testing program to implement required testing of both new fuel oil and stored fuel oil shall be established. The program shall include sampling and testing requirements, and acceptance criteria, all in accordance with applicable ASTM Standards.

The purpose of the program is to establish the following:

1. Acceptability of new fuel oil for use prior to addition to storage tanks by determining that the fuel oil has:

a. An API gravity or an absolute specific gravity within limits,

b. A flash point and kinematic viscosity within limits for ASTM 2D fuel oil, and

c. A clear and bright appearance with proper color or a water and sediment content within limits.

2. Within 31 days following addition of the new fuel oil to storage tanks, verify that the properties of the new fuel oil, other than those addressed in 1., above, are within limits for ASTM 2D fuel oil, and

3. Total particulate concentration of the fuel oil is 10 mg/l when tested every 31 days.

The provisions of Surveillance Requirement 4.0.2 and Surveillance Requirement 4.0.3 are applicable to the Diesel Fuel Oil Testing Program test frequencies. ,16(57 SHEARON HARRIS - UNIT 1 6-19j Amendment No. 158

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Attachment 3 Cross-Reference of TSTF-505 and HNP Technical Specifications

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Flow Paths - Operating YES VARIATION: HNP LCO 3.1.2.2 is a plant-specific specification not TSTF-505: N/A in Standard Technical Specifications (STS) or TSTF-505. LCO HNP: 3.1.2.2 Action (undesignated) 3.1.2.2 addresses operability of boron injection flow paths, including the charging/safety injection pumps which are also addressed by plant-specific LCO 3.1.2.4 and LCO 3.5.2 for ECCS. TSTF-505 includes LCO 3.5.2 (as long as additional technical justification is provided - see LAR Enclosure 1) and also includes the high pressure safety injection function of the charging/injection pumps. Inclusion of this plant-specific LCO in the RICT Program is necessary to permit its application for LCO 3.5.2 for inoperability of one train of charging/safety injection pumps, as well as to avoid conflicts with support systems for the charging/safety injection pumps and other powered components (boric acid transfer pumps and motor-operated valves) in the boron injection flow path. Charging Pumps - Operating YES VARIATION: HNP LCO 3.1.2.4 is a plant-specific LCO which is TSTF-505: N/A redundant to LCO 3.5.2. This LCO is not in STS or TSTF-505. HNP: 3.1.2.4 Action (undesignated) LCO 3.1.2.4 addresses operability of charging/safety injection pumps, which are also addressed by plant-specific LCO 3.1.2.2 and LCO 3.5.2 for ECCS. TSTF-505 includes LCO 3.5.2 and the high pressure safety injection function of the charging/safety injection pumps. Inclusion of this redundant plant-specific LCO in the RICT Program is necessary to permit its application for TS 3.5.2 for inoperability of one train of charging/safety injection pumps. Manual Reactor Trip (MODES 1 and 2) YES TSTF-505: 3.3.1 Function 1 Required Action B.1 HNP: 3.3.1 Functional Unit 1 Action 1 Manual Reactor Trip (MODES 3, 4 and 5) NO This Condition has MODE 3 - 5 applicability only and is not TSTF-505: 3.3.1 Function 1 Required Action C.1 proposed to be included in the HNP scope. HNP: 3.3.1 Functional Unit 1 Action 9

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Power Range Neutron Flux - High YES Additional Technical Justification is provided in LAR Enclosure 1 TSTF-505: 3.3.1 Function 2.a Required Actions for this Specification in accordance with Table 1 of TSTF-505, D.1.1, D.1.2, D.2.1 Revision 2. HNP: 3.3.1 Functional Unit 2.a Action 2.a1 Power Range Neutron Flux - Low YES TSTF-505: 3.3.1 Function 2.b Required Action E.1 HNP: 3.3.1 Functional Unit 2.b Action 2.a1 Power Range Neutron Flux Rate - High Positive YES Rate I TSTF-505: 3.3.1 Function 3.a Required Action E.1 HNP: 3.3.1 Functional Unit 3 Action 2.a1 Source Range Neutron Flux (MODES 3, 4 and 5) NO This Condition has MODE 3 - 5 applicability only and is not TSTF-505: 3.3.1 Function 5 Required Action J.1 proposed to be included in the HNP scope. HNP: 3.3.1 Functional Unit 6.b Action 5.a 2YHUWHPSHUDWXUH7 YES TSTF-505: 3.3.1 Function 6 Required Action E.1 HNP: 3.3.1 Functional Unit 7 Action 6.a1 2YHUSRZHU7 YES TSTF-505: 3.3.1 Function 7 Required Action E.1 HNP: 3.3.1 Functional Unit 8 Action 6.a1 Pressurizer Pressure (Low) YES TSTF-505: 3.3.1 Function 8.a Required Action L.1 HNP: 3.3.1 Functional Unit 9 Action 6.a1 Pressurizer Pressure (High) YES TSTF-505: 3.3.1 Function 8.b Required Action E.1 HNP: 3.3.1 Functional Unit 10 Action 6.a1 Pressurizer Water Level - High YES TSTF-505: 3.3.1 Function 9 Required Action L.1 HNP: 3.3.1 Functional Unit 11 Action 6.a1

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Reactor Coolant Flow - Low (Single Loop - Above YES EDITORIAL: Action 6.a is also applicable to the Reactor Coolant P-8) I Flow - Low (Two Loops - Above P-7 and Below P-8) Functional TSTF-505: 3.3.1 Function 10 Required Action L.1 Unit 12.b, which is not in the plant-specific RICT Program scope. HNP: 3.3.1 Functional Unit 12.a Action 6.a1 Therefore, a new Action 13a that corresponds to Functional Unit 12.b with the same exact wording as existing Action 6 is created such that Action 6.a can be applied to Functional Units that are proposed to be in the scope of the RICT Program. Reactor Coolant Pump (RCP) Breaker Position NO VARIATION: The HNP TS do not have this specification. (Single Loop) TSTF-505: 3.3.1 Function 11.a Required Action N.1 HNP: N/A Reactor Coolant Pump (RCP) Breaker Position NO VARIATION: The HNP TS do not have this specification. (Two Loops) TSTF-505: 3.3.1 Function 11.b Required Action P.1 HNP: N/A Undervoltage RCPs YES TSTF-505: 3.3.1 Function 12 Required Action L.1 HNP: 3.3.1 Functional Unit 15 Action 6.a1 Underfrequency RCPs YES TSTF-505: 3.3.1 Function 13 Required Action L.1 HNP: 3.3.1 Functional Unit 16 Action 6.a1 Steam Generator (SG) Water Level - Low Low YES TSTF-505: 3.3.1 Function 14 Required Action E.1 HNP: 3.3.1 Functional Unit 13 Action 6.a1 SG Water Level - Low Coincident w/ Steam YES Flow/Feedwater Mismatch TSTF-505: 3.3.1 Function 15 Required Action E.1 HNP: 3.3.1 Functional Unit 14 Action 6.a1

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Turbine Trip (Low Fluid Oil Pressure) YES TSTF-505: 3.3.1 Function 16.a Required Action R.1 HNP: 3.3.1 Functional Unit 17.a Action 6.a1 Turbine Trip (Turbine Stop Valve Closure) NO VARIATION: One inoperable channel results in reactor trip TSTF-505: 3.3.1 Function 16.b Required Action capability not being maintained (i.e., loss of function). Therefore, a R.1 RICT should not be applied to Action 10. HNP: 3.3.1 Functional Unit 17.b Action 10 Safety Injection (SI) Input from ESFAS YES TSTF-505: 3.3.1 Function 17 Required Action T.1 HNP: 3.3.1 Functional Unit 18 Action 131 Reactor Trip Breakers (RTBs) NO VARIATION: The HNP TS Action 8 is a 6-hour shutdown with no TSTF-505: 3.3.1 Function 19 Required Action U.1 allowed outage time provided; therefore, it does not meet the HNP: 3.3.1 Functional Unit 20 Action 8 and requirements to be in the scope of the RICT Program. The HNP Functional Unit 22 Action 12 TS have a separate Functional Unit 22 for the reactor trip bypass breakers which are included in TSTF-505 Function 19 scope. HNP Action 12 states "No additional corrective actions are required." Therefore, it is not necessary to include the reactor trip bypass breakers Function Unit 22 in the scope of the RICT Program. Reactor Trip Breakers (RTBs) (MODES 3, 4 and 5) NO This Condition has MODE 3 - 5 applicability only and is not TSTF-505: 3.3.1 Function 19 Required Action C.1 proposed to be included in the HNP scope. HNP: 3.3.1 Functional Unit 20 Action 9 Reactor Trip Breaker Undervoltage and Shunt Trip YES EDITORIAL: The HNP TS do not have a separate function for Mechanisms reactor trip breaker trip mechanisms, and the final action is to TSTF-505: 3.3.1 Function 20 Required Action Y.1 declare the reactor trip breaker inoperable and apply Action 8. HNP: 3.3.1 Functional Unit 20 Action 11 Action 8 is a shutdown action requirement to HOT STANDBY (i.e., Mode 3), which is consistent with TSTF-505 for the default Condition for Function 20.

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Reactor Trip Breaker Undervoltage and Shunt Trip NO VARIATION: The HNP TS do not have this specification. Also, this Mechanisms (MODES 3, 4 and 5) Condition has MODE 3 - 5 applicability only and is not proposed to TSTF-505: 3.3.1 Function 20 Required Action C.1 be included in the HNP scope. HNP: N/A Automatic Trip Logic (MODES 1 and 2) YES TSTF-505: 3.3.1 Function 21 Required Action T.1 HNP: 3.3.1 Functional Unit 21 Action 13 Automatic Trip Logic (MODES 3, 4 and 5) NO This Condition has MODE 3 - 5 applicability only and is not TSTF-505: 3.3.1 Function 21 Required Action C.1 proposed to be included in the HNP scope. HNP: 3.3.1 Functional Unit 21 Action 9 Safety Injection (Manual Initiation) YES TSTF-505: 3.3.2 Function 1.a Required Action B.1 HNP: 3.3.2 Functional Unit 1.a Action 18 Safety Injection (Automatic Actuation Logic and YES Actuation Relays) TSTF-505: 3.3.2 Function 1.b Required Action C.1 HNP: 3.3.2 Functional Unit 1.b Action 141 Safety Injection (Containment Pressure - High 1) YES TSTF-505: 3.3.2 Function 1.c Required Action D.1 HNP: 3.3.2 Functional Unit 1.c Action 19.a1 Safety Injection (Pressurizer Pressure - Low) YES TSTF-505: 3.3.2 Function 1.d Required Action D.1 HNP: 3.3.2 Functional Unit 1.d Action 19.a1 Safety Injection (Steam Line Pressure - Low) YES TSTF-505: 3.3.2 Function 1.e.(1) Required Action D.1 HNP: 3.3.2 Functional Unit 1.e Action 19.a1

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Safety Injection (Steam Line Pressure - High NO VARIATION: The HNP TS do not have this specification. Differential Pressure Between Steam Lines) TSTF-505: 3.3.2 Function 1.e.(2) Required Action D.1 HNP: N/A Safety Injection (High Steam Flow in Two Steam NO VARIATION: The HNP TS do not have this specification. Lines Coincident with Tavg - Low Low) TSTF-505: 3.3.2 Function 1.f Required Action D.1 HNP: N/A Safety Injection (High Steam Flow in Two Steam NO VARIATION: The HNP TS do not have this specification. Lines Coincident with Steam Line Pressure - Low) TSTF-505: 3.3.2 Function 1.g Required Action D.1 HNP: N/A Containment Spray (Manual Initiation) YES TSTF-505: 3.3.2 Function 2.a Required Action B.1 HNP: 3.3.2 Functional Unit 2.a Action 18 Containment Spray (Automatic Actuation Logic and YES Actuation Relays) TSTF-505: 3.3.2 Function 2.b Required Action C.1 HNP: 3.3.2 Functional Unit 2.b Action 141 Containment Spray (Containment Pressure High - 3 NO TSTF-505, Revision 2 cannot be used to justify modifying Required (High High)) Actions that specify placing an instrument channel in bypass and TSTF-505: 3.3.2 Function 2.c Required Action E.1 HNP Action 16 states to place an inoperable channel in the HNP: 3.3.2 Functional Unit 2.c Action 16 bypassed condition. Containment Spray (Containment Pressure High - 3 NO VARIATION: The HNP TS do not have this specification. (Two Loop Plants)) TSTF-505: 3.3.2 Function 2.d Required Action E.1 HNP: N/A

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Containment Isolation (Phase A Isolation - Manual YES Initiation) TSTF-505: 3.3.2 Function 3.a.(1) Required Action B.1 HNP: 3.3.2 Functional Unit 3.a.(1) Action 18 Containment Isolation (Phase A Isolation - YES Automatic Actuation Logic and Actuation Relays) TSTF-505: 3.3.2 Function 3.a.(2) Required Action C.1 HNP: 3.3.2 Functional Unit 3.a.(2) Action 141 Containment Isolation (Phase B Isolation - Manual YES EDITORIAL: The HNP TS for this function refers directly to Initiation) Functional Unit 2.a and does not have separate actions. TSTF-505: 3.3.2 Function 3.b.(1) Required Action B.1 HNP: 3.3.2 Functional Unit 3.b.(1) Containment Isolation (Phase B Isolation - YES Automatic Actuation Logic and Actuation Relays) TSTF-505: 3.3.2 Function 3.b.(2) Required Action C.1 HNP: 3.3.2 Functional Unit 3.b.(2) Action 141 Containment Isolation (Phase B Isolation - NO EDITORIAL: The HNP TS for this function refers directly to Containment Pressure High - 3) Functional Unit 2.c and does not have separate actions. TSTF-505: 3.3.2 Function 3.b.(3) Required Action E.1 HNP: 3.3.2 Functional Unit 3.b.(3) Steam Line Isolation (Manual Initiation) YES EDITORIAL: Action 22 is also applicable to the P-4 interlock of TSTF-505: 3.3.2 Function 4.a Required Action F.1 Functional Unit 10.c, which is not in the plant-specific RICT HNP: 3.3.2 Functional Unit 4.a.(2) Action 22 Program scope. Therefore, a new Action 27 is created to separately address Functional Unit 4.a.(2).

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Steam Line Isolation (Automatic Actuation Logic YES and Actuation Relays) TSTF-505: 3.3.2 Function 4.b Required Action G.1 HNP: 3.3.2 Functional Unit 4.b Action 141 Steam Line Isolation (Containment Pressure - High YES 2) I TSTF-505: 3.3.2 Function 4.c Required Action D.1 HNP: 3.3.2 Functional Unit 4.c Action 19a1 Steam Line Isolation (Steam Line Pressure - Low) YES EDITORIAL: The HNP TS for this function refers directly to TSTF-505: 3.3.2 Function 4.d.(1) Required Action Functional Unit 1.e and does not have separate actions. D.1 HNP: 3.3.2 Functional Unit 4.d Steam Line Isolation (Steam Line Pressure - NO This Condition has MODE 3 - 4 applicability only and is not Negative Rate - High) proposed to be included in the HNP scope. TSTF-505: 3.3.2 Function 4.d.(2) Required Action D.1 HNP: 3.3.2 Functional Unit 4.e Steam Line Isolation (High Steam Flow in Two NO VARIATION: The HNP TS do not have this specification. Steam Lines Coincident with Tavg - Low Low) TSTF-505: 3.3.2 Function 4.e Required Action D.1 HNP: N/A Steam Line Isolation (High Steam Flow in Two NO VARIATION: The HNP TS do not have this specification. Steam Lines Coincident with Steam Line Pressure - Low) I TSTF-505: 3.3.2 Function 4.f Required Action D.1 HNP: N/A Steam Line Isolation (High Steam Flow Coincident NO VARIATION: The HNP TS do not have this specification. with Safety Injection and Coincident with Tavg - Low Low) I TSTF-505: 3.3.2 Function 4.g Required Action D.1 HNP: N/A

U.S. Nuclear Regulatory Commission Page 10 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Steam Line Isolation (High High Steam Flow NO VARIATION: The HNP TS do not have this specification. Coincident with Safety Injection) TSTF-505: 3.3.2 Function 4.h Required Action D.1 HNP: N/A Turbine Trip and Feedwater Isolation (Automatic YES Actuation Logic and Actuation Relays) TSTF-505: 3.3.2 Function 5.a Required Action H.1 HNP: 3.3.2 Functional Unit 5.a Action 241 Turbine Trip and Feedwater Isolation (SG Water YES Level - High High) TSTF-505: 3.3.2 Function 5.b Required Action I.1 HNP: 3.3.2 Functional Unit 5.b Action 19.a1 Auxiliary Feedwater (Automatic Actuation Logic and YES Actuation Relays (Solid State Protection System)) TSTF-505: 3.3.2 Function 6.a Required Action G.1 HNP: 3.3.2 Functional Unit 6.b Action 211 Auxiliary Feedwater (Automatic Actuation Logic and NO VARIATION: The HNP TS do not have this specification. Actuation Relays (Balance of Plant ESFAS)) TSTF-505: 3.3.2 Function 6.b Required Action G.1 HNP: N/A Auxiliary Feedwater (SG Water Level - Low Low) YES TSTF-505: 3.3.2 Function 6.c Required Action D.1 HNP: 3.3.2 Functional Units 6.c.(1) and 6.c.(2) Action 19a1 Auxiliary Feedwater (Loss of Offsite Power) NO EDITORIAL: The HNP TS for this function refers directly to TSTF-505: 3.3.2 Function 6.e Required Action F.1 Functional Unit 9 and does not have separate actions. HNP: 3.3.2 Functional Unit 6.e

U.S. Nuclear Regulatory Commission Page 11 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Auxiliary Feedwater (Undervoltage Reactor Coolant NO VARIATION: The HNP TS do not have this specification. Pump) TSTF-505: 3.3.2 Function 6.f Required Action I.1 HNP: N/A Auxiliary Feedwater (Trip of all Main Feedwater YES EDITORIAL: The HNP TS action permits continued operation if the Pumps) inoperable channel is placed in trip, similar to other ESFAS TSTF-505: 3.3.2 Function 6.g Required Action J.1 functions in the scope of the RICT Program in TSTF-505, Revision HNP: 3.3.2 Functional Unit 6.f Action 15 2. Auxiliary Feedwater (Auxiliar Feedwater Pump NO VARIATION: The HNP TS do not have this specification. Suction Transfer on Suction Pressure - Low) TSTF-505: 3.3.2 Function 6.h Required Action F.1 HNP: N/A Automatic Switchover to Containment Sump YES EDITORIAL: The HNP TS is separated into two separate functions (Automatic Actuation Logic and Actuation Relays) for Safety Injection and Containment Spray, with the same action TSTF-505: 3.3.2 Function 7.a Required Action C.1 requirements. HNP: 3.3.2 Functional Units 7.a and 8.a Action 141 Automatic Switchover to Containment Sump NO TSTF-505, Revision 2 cannot be used to justify modifying Required (Refueling Water Storage Tank (RWST) Level - Low Actions that specify placing an instrument channel in bypass and Low Coincident with SI) HNP Action 16 states to place an inoperable channel in the TSTF-505: 3.3.2 Function 7.b Required Action K.1 bypassed condition. HNP: 3.3.2 Functional Unit 7.b Action 16 Automatic Switchover to Containment Sump NO VARIATION: The HNP TS do not have this specification. (Refueling Water Storage Tank (RWST) Level - Low Low Coincident with SI and Coincident with Containment Sump Level - High) TSTF-505: 3.3.2 Function 7.c Required Action K.1 HNP: N/A

U.S. Nuclear Regulatory Commission Page 12 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? ESFAS Interlocks - Reactor Trip, P-4 NO VARIATION: The P-4 interlock action is not proposed to be TSTF-505: 3.3.2 Function 8.a Required Action F.1 included in the HNP scope. The functions of the P-4 interlock are HNP: 3.3.2 Functional Unit 10.c Action 22 not explicitly modeled in the plant-specific PRA and do not have a significant impact on severe accident mitigation. ESFAS Interlocks - Pressurizer Pressure, P-11 NO VARIATION: The P-11 interlock action is not proposed to be TSTF-505: 3.3.2 Function 8.b Required Action L.1 included in the HNP scope. The functions of the P-11 interlock are HNP: 3.3.2 Functional Unit 10.a Action 20 not explicitly modeled in the plant-specific PRA and do not have a significant impact on severe accident mitigation. ESFAS Interlocks - Tavg - Low Low, P-12 NO VARIATION: The P-12 interlock action is not proposed to be TSTF-505: 3.3.2 Function 8.c Required Action L.1 included in the HNP scope. The functions of the P-12 interlock are HNP: 3.3.2 Functional Unit 10.b Action 20 not explicitly modeled in the plant-specific PRA and do not have a significant impact on severe accident mitigation. Loss of Power (LOP) Diesel Generator (DG) Start NO EDITORIAL: The final action in TSTF-505 (TS 3.3.5) is to enter the Instrumentation applicable Conditions and Required Actions for the DG made TSTF-505: 3.3.5 Function 8.b Required Actions inoperable by the inoperable instrumentation, and so a RICT A.1, B.1 should not apply to both this action and the DG LCO 3.8.1 actions. HNP: 3.3.2 Functional Units 9.a and 9.b Action 15a Boron Dilution Protection System (BDPS) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.3.9 Required Action A.1 HNP: N/A RCS Loops - MODE 3 NO This Condition has MODE 3 applicability only and is not proposed TSTF-505: 3.4.5 Required Action A.1 to be included in the HNP scope. HNP: 3.4.1.2 Action a RCS Loops - MODE 3 NO This Condition has MODE 3 applicability only and is not proposed TSTF-505: 3.4.5 Required Action C.1 to be included in the HNP scope. HNP: 3.4.1.2 Action b Pressurizer NO VARIATION: The pressurizer heaters action is not proposed to be TSTF-505: 3.4.9 Required Action B.1 included in the HNP scope. The functions of the pressurizer HNP: 3.4.3 Action a heaters are not explicitly modeled in the plant-specific PRA and do not have a significant impact on severe accident mitigation.

U.S. Nuclear Regulatory Commission Page 13 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Pressurizer Power Operated Relief Valves (PORVs) YES EDITORIAL: The TSTF-505 Condition of one (or two) PORVs TSTF-505: 3.4.11 Required Action B.3 inoperable and unable to be manually cycled is equivalent to the HNP: 3.4.4 Action b.1 HNP action for one inoperable safety grade PORV. Pressurizer Power Operated Relief Valves (PORVs) NO VARIATION: The HNP TS for inoperable block valves requires TSTF-505: 3.4.11 Required Action C.2 closing and removing power from the inoperable block valve or HNP: 3.4.4 Action c associated PORV, and then requires application of Action b. Since the RICT Program is applicable to Action b, it is not proposed to also apply to Action c. ECCS - Operating YES EDITORIAL: The HNP TS include redundant LCOs 3.1.2.2 and TSTF-505: 3.5.2 Required Action A.1 3.1.2.4 for the charging/safety injection pumps, which are also HNP: 3.5.2 Action a, 3.1.2.2 Action proposed to be included in the plant-specific scope. (undesignated), and 3.1.2.4 Action (undesignated) Additional Technical Justification is provided in LAR Enclosure 1 for this Specification in accordance with Table 1 of TSTF-505, Revision 2. Containment Air Locks (Atmospheric, YES Additional Technical Justification is provided in LAR Enclosure 1 Subatmospheric, Ice Condenser, and Dual)) for this Specification in accordance with Table 1 of TSTF-505, TSTF-505: 3.6.2 Required Action C.3 Revision 2. HNP: 3.6.1.3 Action c.3 Containment Isolation Valves (Atmospheric, YES EDITORIAL: The HNP TS have two separate actions identifying Subatmospheric, Ice Condenser, and Dual)) different methods of isolation. TSTF-505: 3.6.3 Required Action A.1 HNP: 3.6.3 Actions a, b, c Containment Isolation Valves (Atmospheric, NO VARIATION: The HNP TS do not permit the single isolation valve Subatmospheric, Ice Condenser, and Dual)) in a penetration path to be inoperable where only one isolation TSTF-505: 3.6.3 Required Action C.1 valve exists. Therefore, this TSTF-505 Condition is not applicable HNP: N/A to HNP.

U.S. Nuclear Regulatory Commission Page 14 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Containment Spray and Cooling Systems YES Additional Technical Justification is provided in LAR Enclosure 1 (Atmospheric and Dual) (Credit taken for iodine for this Specification in accordance with Table 1 of TSTF-505, removal by the Containment Spray System)) Revision 2. TSTF-505: 3.6.6A Required Action A.1 HNP: 3.6.2.1 Action (undesignated) Containment Spray and Cooling Systems YES EDITORIAL: The HNP TS provide separate LCOs for the (Atmospheric and Dual) (Credit taken for iodine Containment Spray and Containment Cooling Systems; HNP LCO removal by the Containment Spray System)) 3.6.2.3 Action a identifies that both Containment Spray Systems TSTF-505: 3.6.6A Required Action C.1 (i.e., trains) must be operable, so it is the action corresponding to HNP: 3.6.2.3 Action a TSTF-505 LCO 3.6.6A Condition C. Additional Technical Justification is provided in LAR Enclosure 1 for this Specification in accordance with Table 1 of TSTF-505, Revision 2. Containment Spray and Cooling Systems YES EDITORIAL: The HNP TS provide separate LCOs for the (Atmospheric and Dual) (Credit taken for iodine Containment Spray and Containment Cooling Systems; HNP LCO removal by the Containment Spray System)) 3.6.2.3 Action b identifies that both Containment Spray Systems TSTF-505: 3.6.6A Required Action D.1 (i.e., trains) must be operable, so it is the action corresponding to HNP: 3.6.2.3 Action b TSTF-505 LCO 3.6.6A Condition D. Additional Technical Justification is provided in LAR Enclosure 1 for this Specification in accordance with Table 1 of TSTF-505, Revision 2. Containment Spray and Cooling Systems YES EDITORIAL: In STS, LCO 3.6.6A Conditions A and C can be (Atmospheric and Dual) (Credit taken for iodine concurrently applicable. For HNP TS, a separate Action c is removal by the Containment Spray System)) provided for one inoperable Containment Spray train and one TSTF-505: 3.6.6A Required Actions A.1, C.1 inoperable train of containment fan coolers, which corresponds to HNP: 3.6.2.3 Action c concurrent applicability of TSTF-505 LCO 3.6.6A Conditions A and C. Additional Technical Justification is provided in LAR Enclosure 1 for this Specification in accordance with Table 1 of TSTF-505, Revision 2.

U.S. Nuclear Regulatory Commission Page 15 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Hydrogen Ignition System (HIS) (Ice Condenser) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.6.10 Required Actions A.1, B.1 HNP: N/A Air Return System (ARS) (Ice Condenser) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.6.14 Required Action A.1 HNP: N/A Ice Condenser Doors (Ice Condenser) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.6.16 Required Actions A.1, B.2 HNP: N/A Divider Barrier Integrity (Ice Condenser) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.6.17 Required Action A.1 HNP: N/A Main Steam Isolation Valves (MSIVs) YES Additional Technical Justification is provided in LAR Enclosure 1 TSTF-505: 3.7.2 Required Action A.1 for this Specification in accordance with Table 1 of TSTF-505, HNP: 3.7.1.5 Action for MODE 1 Revision 2. Atmospheric Dump Valves (ADVs) NO VARIATION: The HNP TS do not have this specification. TSTF-505: 3.7.4 Required Actions A.1 and B.1 HNP: N/A Auxiliary Feedwater (AFW) System NO VARIATION: The HNP TS do not have a separate action TSTF-505: 3.7.5 Required Action A.1 requirement for one inoperable turbine-driven AFW pump steam HNP: N/A supply. Auxiliary Feedwater (AFW) System YES TSTF-505: 3.7.5 Required Action B.1 HNP: 3.7.1.2 Action a Component Cooling Water (CCW) System YES TSTF-505: 3.7.7 Required Action A.1 HNP: 3.7.3 Action (undesignated)

U.S. Nuclear Regulatory Commission Page 16 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Service Water System (SWS) YES TSTF-505: 3.7.8 Required Action A.1 HNP: 3.7.4 Action (undesignated) Ultimate Heat Sink (UHS) NO VARIATION: The HNP TS LCO for the UHS does not include any TSTF-505: 3.7.9 Required Action A.1 active plant equipment, and therefore this LCO is not proposed to HNP: 3.7.5 be included in the HNP scope. Essential Services Chilled Water System (ESCWS) YES VARIATION: The HNP TS include a plant-specific LCO for the TSTF-505: N/A ESCWS. This is a plant-specific required support system for room HNP: 3.7.13 Action (undesignated) cooling of other plant systems subject to the RICT Program, and the ESCWS is itself supported by systems subject to the RICT Program. The TS satisfies the requirements to be included in the plant-specific scope, since it is a restoration action, is modeled in the PRA, and inoperability of the ESCWS can be evaluated directly by the PRA. It is proposed to be included in the HNP scope to avoid conflict where the 72-hour action requirement of LCO 3.7.13 is applicable while a RICT on a support system for ESCWS is in effect. AC Sources - Operating YES TSTF-505: 3.8.1 Required Action A.3 HNP: 3.8.1.1 Action a.2 AC Sources - Operating YES TSTF-505: 3.8.1 Required Action B.4 HNP: 3.8.1.1 Action b.3 AC Sources - Operating YES TSTF-505: 3.8.1 Required Action C.2 HNP: 3.8.1.1 Action d.1 AC Sources - Operating YES TSTF-505: 3.8.1 Required Actions D.1, D.2 HNP: 3.8.1.1 Action c.1

U.S. Nuclear Regulatory Commission Page 17 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? AC Sources - Operating YES TSTF-505: 3.8.1 Required Actions F.1 HNP: 3.8.1.1 Action h.11 DC Sources - Operating YES EDITORIAL: The HNP TS LCO 3.8.2.1 does not distinguish TSTF-505: 3.8.4 Required Action A.3 separate actions for different causes of inoperability, but applies HNP: 3.8.2.1 Action (undesignated) the limiting 2-hour action for any cause of inoperability. DC Sources - Operating YES EDITORIAL: The HNP TS LCO 3.8.2.1 does not distinguish TSTF-505: 3.8.4 Required Action B.1 separate actions for different causes of inoperability, but applies HNP: 3.8.2.1 Action (undesignated) the limiting 2-hour action for any cause of inoperability. DC Sources - Operating YES EDITORIAL: The HNP TS LCO 3.8.2.1 does not distinguish TSTF-505: 3.8.4 Required Action C.1 separate actions for different causes of inoperability, but applies HNP: 3.8.2.1 Action (undesignated) the limiting 2-hour action for any cause of inoperability. Inverters - Operating YES EDITORIAL: The HNP TS do not have a separate LCO applicable TSTF-505: 3.8.7 Required Action A.1 to inverters, but instead include the inverters in LCO 3.8.3.1, which HNP: 3.8.3.1 Action c is the TSTF-505 equivalent of TS 3.8.9. HNP LCO 3.8.3.1 Action c does not identify the inverter as inoperable, but as "118-volt A.C. vital bus not energized from its associated inverter connected to its associated D.C. bus." The same 24-hour restoration time is identified in HNP LCO 3.8.3.1 Action c as TSTF-505. Distribution Systems - Operating YES EDITORIAL: The HNP LCO 3.8.3.1 Action a does not address TSTF-505: 3.8.9 Required Action A.1 more than one division inoperable, which is conservative HNP: 3.8.3.1 Action a compared to TSTF-505, which permits one or more inoperable AC electrical power distribution systems. Distribution Systems - Operating YES EDITORIAL: The HNP LCO 3.8.3.1 Actions b and c do not address TSTF-505: 3.8.9 Required Action B.1 more than one bus de-energized, which is conservative compared HNP: 3.8.3.1 Action b and c to TSTF-505, which permits one or more inoperable AC vital busses. EDITORIAL: The HNP TS has two separate actions for the bus not being energized from its inverter and not being energized by the inverter connected to its D.C. bus.

U.S. Nuclear Regulatory Commission Page 18 Serial: RA-19-0001 Cross-Reference of TSTF-505 and HNP Technical Specifications LCO ACTION TSTF-505/HNP TS IN DISCUSSION SCOPE? Distribution Systems - Operating YES EDITORIAL: The HNP LCO 3.8.3.1 Action d does not address TSTF-505: 3.8.9 Required Action C.1 more than one division inoperable, which is conservative HNP: 3.8.3.1 Action d compared to TSTF-505, which permits one or more inoperable DC electrical power distribution systems. 1 The HNP TS action has a different Completion Time (i.e., allowed outage time) than STS and TSTF-505, Revision 2. This has no impact on implementation of the RICT Program and is not considered an optional change or variation.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt RiskInformed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Attachment 4 H13 Technical Specifications Bases (Information Only)

REACTIVITY CONTROL SYSTEMS BASES MODERATOR TEMPERATURE COEFFICIENT (Continued) The Surveillance Requirements for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup. 3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITY This specification ensures that the reactor will not be made critical with the Reactor Coolant System average temperature less than 551°F. This limitation is required to ensure: (1) the moderator temperature coefficient is within its analyzed temperature range, (2) the trip instrumentation is within its normal operating range, (3) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (4) the reactor vessel is above its minimum RTNDT temperature, 3/4.1.2 BORATION SYSTEMS The Boron Injection System ensures that negative reactivity control is available during each mode of facility operation. The components required to perform this function include: (1) borated water sources, (2) chargipg/safety injection pumps, (3) separate flow paths, (4) boric acid transfer pumps, and (5) an emergency power supply from OPERABLE diesel generators. With the RCS average temperature above 350°F, a minimum of two boron injection flow paths are required to ensure single functional capability in the event an assumed failure renders one of the flow paths inoperable. The boration capability of either flow path is sufficient to provide the required SHUTDOWN MARGIN as defined by Specification 3/4.1.1.2 after xenon decay and cooldown to 200°F. The maximum expected boration capability requirement occurs at BOL SHEARON HARRIS - UNIT 1 B 3/4 1-2 Amendment No. 46

REACTIVITY CONTROL SYSTEMS BASES BORATION SYSTEMS (Continued) from full power equilibrium xenon conditions and requires 24,150 gallons of 7000 ppm borated water be maintained in the boric acid storage tanks or 436,000 gallons of 2400-2600 ppm ~orated water be maintained in the refueling water storage tank (RWST). With the RCS temperature below 350°F, one boron injection flow path is accept-able without single failure consideration on the basis of the stable reactivity SHEARON HARRIS - UNIT 1 B 3/4 1-2a Amendment No. 30

REACTIVITY CONTROL SYSTEMS BASES BORATION SYSTEMS (Continued) condition of the reactor and the additional restrictions prohibiting CORE ALTERATIONS and positive reactivity changes in the event the single boron injection flow path becomes inoperable. The limitation for a maximum of one charging/safety injection pump (CSIP) to be OPERABLE and the Surveillance Requirement to verify all CSIPs except the required OPERABLE pump to be inoperable below 325°F provides assurance that a mass addition pressure transient can be relieved by the operation of a single PORV. The boron capability required below 200°F is sufficient to provide the required SHUTDOWN MARGIN as defined by Specification 3/4.1.1.2 after xenon decay and cooldown from 200°F to 140°F. This condition requires either 7150 gallons of 7000 ppm borated water be maintained in the boric acid storage tanks or 106.000 gallons of 2400-2600 ppm borated water be maintained in the RWST. The gallons given above are the amounts that need to be maintained in the tank in the various circumstances . To get the specified indicated levels used for surveillance testing, each value had added to it an allowance for the unusable volume of water in the tank. allowances for other identified needs. and an allowance for possible instrument error. In addition. for human factors purposes. the percent indicated levels were then raised to either the next whole percent or the next even percent and the gallon figures rounded off. This makes the LCO values conservative to the analyzed values . The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.0 and 11 .0 for the solution recirculated within I containment after a LOCA. This pH band minimizes the evolution of iodine and minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components. The BAT minimum temperature of 65°F ensures that boron solubility is maintained for concentrations of at least the 77~0 ppm limit. The RWST minimum temperature is consistent with the STS value and is based upon other considerations since solubility is not an issue at the specified concentration levels. The RWST high temperature was selected to be consistent with analytical assumptions for containment heat load. The OPERABILITY of one Boron Injection System during REFUELING ensures that this system is available for reactivity control while in MOOE 6. 3/4.1.3 MOVABLE CONTROL ASSEMBLIES The specifications of this section ensure that: (1) acceptable power distribution limits are maintained. (2) the minimum SHUTDOWN MARGIN is maintained. and (3) the potential effects of rod misalignment on associated accident analyses are limited. OPERABILITY of the control rod position indicators is required to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits. SHEARON HARRIS - UNIT 1 B 3/4 1-3 Amendment No. 134

3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated ACTION and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its Setpoint (2) the specified coincidence logic and sufficient redundancy is maintained to permit a channel to be out-of-service for testing or maintenance consistent with maintaining an appropriate level of reliability of the Reactor Trip System and Engineered Safety Features Actuation System instrumentation, and (3) sufficient system functional capability is available from diverse parameters. The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. The periodic surveillance tests are sufficient to demonstrate this capability. Surveillance intervals have been determined in accordance with the Surveillance Frequency Control Program and surveillance and maintenance outage times have been determined in accordance with WCAP-10271, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System," and supplements to that report as approved by the NRC and documented in the SERs and SSER (letters to J. J. Sheppard from Cecil O. Thomas dated February 21, 1985; Roger A. Newton from Charles E. Rossi dated February 22, 1989; and Gerard T. Goering from Charles E. Rossi dated April 30, 1990). The Engineered Safety Features Actuation System Instrumentation Trip Setpoints specified in Table 3.3-4 are the nominal values at which the bistables are set for each functional unit. A Setpoint is considered to be adjusted consistent with the nominal value when the "as measured" Setpoint is within the band allowed for calibration accuracy. For example, if a bistable has a trip setpoint of 100%, a span of 125%, and a calibration accuracy of +/-0.50%, then the bistable is considered to be adjusted to the trip setpoint as long as the "as measured" value for the bistable is 100.62%. To accommodate the instrument drift assumed to occur between operational tests and the accuracy to which Setpoints can be measured and calibrated, Allowable Values for the Setpoints have been specified in Table 3.3-4. Operation with Setpoints less conservative than the Trip Setpoint but within the Allowable Value is acceptable since an allowance has been made in the safety analysis to accommodate this error. An optional provision has been included for determining the OPERABILITY of a channel when its Trip Setpoint is found to exceed the Allowable Value. The methodology of this option utilizes the "as measured" deviation from the specified calibration point for rack and sensor components in conjunction with a statistical combination of the other uncertainties of the instrumentation to measure the process variable and the uncertainties in calibrating the instrumentation. In Equation 3.3-1, Z + R + S TA, the interactive effects of the errors in the rack and the sensor, and the "as measured" values of the errors are considered. Z, as specified in Table 3.3-4, in percent span, is the statistical summation of errors assumed in the analysis excluding those associated with the sensor and rack drift and the accuracy of their measurement. TA or Total Allowance is the difference, in percent span, between the trip setpoint and the value used in the analysis for the actuation. R or Rack Error is the "as measured" deviation, in the percent span, for the affected channel from the specified Trip Setpoint. S or Sensor Error is either the "as measured" deviation of the sensor from its calibration point or the value specified in Table 3.3-4, in percent span, from the analysis assumptions. Use of Equation 3.3-1 allows for a sensor draft factor, an increased rack drift factor, and provides a SHEARON HARRIS - UNIT 1 B 3/4 3-1 Amendment No. 154

3/4.3 INSTRUMENTATION BASES threshold value for determination of OPERABILITY. The methodology to derive the Trip Setpoints is based upon combining all of the uncertainties in the channels. Inherent to the determination of the Trip Setpoints are the magnitudes of these channel uncertainties. Sensor and rack instrumentation utilized in these channels are expected to be capable of operating within the allowances of these uncertainty magnitudes. Rack drift in excess of the Allowable Value exhibits the behavior that the rack has not met its allowance. Being that there is a small statistical chance that this will happen, an infrequent excessive drift is expected. Rack or sensor drift, in excess of the allowance that is more than occasional, may be indicative of more serious problems and should warrant further investigation. Engineered Safety Features Actuation System Instrumentation Trip Setpoints and TSTF-493-A, Option A This section applies only to the Functional Units to which Notes 1 and 2 in the Trip Setpoint Column are applicable. Those Functional Units have revisions in accordance with Technical Specification Task Force Traveler 493-A (TSTF-493-A), Revision 4, Clarify Application of Setpoint Methodology for LSSS Functions, Option A. Those Functional Units are limited to Functional Unit 6.e, Auxiliary Feedwater, Loss of Offsite Power Start Motor-Driven Pumps and Turbine-Driven Pumps. Because HNP TS Table 3.3-4, Functional Unit 6.e refers to TS Table 3.3-4, Item 9 for all Loss-of-Offsite Trip Setpoint and Allowable Values, the two Notes are applied to TS Table 3.3-4, Functional Unit 9.a. Notes 1 and 2 have been added to Table 3.3-4 that require verifying both trip setpoint setting as-found and as-left values during surveillance testing. In accordance with 10 CFR 50.36, these functions are Limiting Safety System Settings. Adding test requirements ensures that instruments will function as required to initiate protective systems or actuate mitigating systems at the point assumed in the applicable safety analysis. These notes address NRC staff concerns with Technical Specification Allowable Values. Specifically, calculated Allowable Values may be non-conservative depending upon the evaluation of instrument performance history, and the as-left requirements of the calibration procedures could have an adverse effect on equipment operability. In addition, using Allowable Values as the limiting setting for assessing instrument channel operability may not be fully in compliance with the intent of 10 CFR 50.36, and the existing surveillance requirements would not provide adequate assurance that instruments will always actuate safety functions at the point assumed in the applicable safety analysis. In the Harris Technical Specifications, the term Trip Setpoint is analogous to Nominal Trip Setpoint (NTSP) in TSTF-493-A, Option A. Note 1 requires a channel performance evaluation when the as-found setting is outside its as-found tolerance. The performance evaluation verifies that the channel will continue to behave in accordance with safety analysis and instrument performance assumptions in the setpoint methodology. The purpose of this evaluation is to provide confidence in the performance prior to returning the channel to service. If the as-found setting is non-conservative with respect to the Allowable Value, the channel is inoperable. If the as-found setting is conservative with respect to the Allowable Value but is outside the as-found tolerance band, the channel is OPERABLE but degraded. The degraded channel condition will be further evaluated during performance of the surveillance. This evaluation will consist of resetting the channel setpoint to within the as-left tolerances applicable to the actual setpoint implemented in the surveillance procedures (field setting), and evaluating the channel response. If the channel is functioning as required and is expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition is entered into the corrective action program for further analysis and trending. SHEARON HARRIS - UNIT 1 B 3/4 3-2 Amendment No. 146

3/4.3 INSTRUMENTATION BASES Note 2 requires that the as-left channel setting be reset to a value that is within the as-left tolerances about the Trip Setpoint in Table 3.3-4 or within as-left tolerances about a more conservative actual (field) setpoint. As-left channel settings outside the as-left tolerances of PLP-106 and the surveillance procedures cause the channel to be INOPERABLE. A tolerance is necessary because no device perfectly measures the process. Additionally, it is not possible to read and adjust a setting to an absolute value due to the readability and/or accuracy of the test instruments or the ability to adjust potentiometers. The as-left tolerance is considered in the setpoint calculation. Failure to set the actual plant trip setpoint to within as-left the tolerances of the NTSP or within as-left tolerances of a more conservative actual field setpoint would invalidate the assumptions in the setpoint calculation, because any subsequent instrument drift would not start from the expected as-left setpoint. The determination will consider whether the instrument is degraded or is capable of being reset and performing its specified safety function. If the channel is determined to be functioning as required (i.e., the channel can be adjusted to within the as-left tolerance and is determined to be functioning normally based on the determination performed prior to returning the channel to service), then the channel is OPERABLE and can be restored to service. If the as-left instrument setting cannot be returned to a setting within the prescribed as-left tolerance band, the instrument would be declared inoperable. The methodologies for calculating the as-found tolerances and as-left tolerances about the Trip Setpoint or more conservative actual field setpoint are specified in EGR-NGGC-0153, Engineering Instrument Setpoints, which is incorporated by reference into the FSAR. The actual field setpoint and the associated as-found and as-left tolerances are specified in PLP-106, the applicable section of which is incorporated by reference into the FSAR. Limiting Trip Setpoint (LTSP) is generic terminology for the setpoint value calculated by means of the setpoint methodology documented in EGR-NGGC-0153. HNP uses the plant-specific term NTSP in place of the generic term LTSP. The NTSP is the LTSP with margin added, and is always equal to or more conservative than the LTSP. The NTSP may use a setting value that is more conservative than the LTSP, but for Technical Specification compliance with 10 CFR 50.36, the plant-specific setpoint term NTSP is cited in Note 2. The NTSP meets the definition of a Limiting Safety System Setting per 10 CFR 50.36 and is a predetermined setting for a protective channel chosen to ensure that automatic protective actions will prevent exceeding Safety Limits during normal operation and design basis anticipated operational occurrences, and assist the Engineered Safety Features Actuation System in mitigating the consequences of accidents. The Allowable Value is the least conservative value of the as-found setpoint that the channel can have when tested, such that a channel is OPERABLE if the as-found setpoint is within the as-found tolerance and is conservative with respect to the Allowable Value during a CHANNEL CALIBRATION or CHANNEL OPERATIONAL TEST. As such, the Allowable Value differs from the NTSP by an amount greater than or equal to the expected instrument channel uncertainties, such as drift, during the surveillance interval. In this manner, the actual NTSP setting ensures that a Safety Limit is not exceeded at any given point of time as long as the channel has not drifted beyond expected tolerances during the surveillance interval. Although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance band, in accordance with uncertainty assumptions stated in the setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria). Field setting is the term used for the actual setpoint implemented in the plant surveillance procedures, where margin has been added to the calculated field setting. The as-found and as-left tolerances apply to the field settings implemented in the surveillance procedures to confirm SHEARON HARRIS - UNIT 1 B 3/4 3-2a Amendment No. 161

3/4.3 INSTRUMENTATION BASES channel performance. A trip setpoint may be set more conservative than the NTSP as necessary in response to plant conditions. However, in this case, the instrument operability must be verified based on the field setting and not the NTSP. The measurement of response time at the frequencies specified in the Surveillance Frequency Control Program provides assurance that the reactor trip and the Engineered Safety Features actuation associated with each channel is completed within the time limit assumed in the safety analyses. No credit was taken in the analyses for those channels with response times indicated as not applicable. Response time may be demonstrated by any series of sequential, overlapping, or total channel test measurements provided that such tests demonstrate the total channel response time as defined. Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements; or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise or power interrupt tests); (2) inplace, onsite, or offsite (e.g., vendor) test measurements; or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Rev. 2, "Elimination of Pressure Sensor Response Time Testing Requirements," provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test. WCAP 14036-P-A, Rev. 1, "Elimination of Periodic Response Time Tests," provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time. The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component into operational service and re-verified following maintenance or modification that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for the repair are the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing element of a transmitter. The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) charging/safety injection pumps start and automatic valves position, (2) reactor trip, (3) feedwater isolation, (4) startup of the emergency diesel generators, (5) containment spray pumps start and automatic valves position (6) containment isolation, (7) steam line isolation, (8) turbine trip, (9) auxiliary feedwater pumps start and automatic valves position, (10) containment fan coolers start and automatic valves position, (11) emergency service water pumps start and automatic valves position, and (12) control room isolation and emergency filtration start. SHEARON HARRIS - UNIT 1 B 3/4 3-2b Amendment No. 154

3/4.3 INSTRUMENTATION BASES Table 3.3-4 includes values for 6.9 kV Emergency Bus Undervoltage - Secondary (degraded grid) trip setpoints and allowable values. The secondary undervoltage relays are connected to two distinct time delay relays. Upon expiration of the first time delay, which is long enough to accommodate the starting of the motor which has the longest starting time, an alarm is actuated at the main control board to alert the operator of this condition and to permit operator actions to restore the system voltage. Automatic tripping actions as described for the primary protection are initiated if a safety actuation signal is present after the expiration of the time delay. In the event of a coincident large break loss of coolant accident (LBLOCA) and voltage dropping to actuate the short-term DVR function (bus voltage drops into the range between the DVR dropout voltage setting and the loss of offsite power voltage setpoint), a safety injection actuation signal is generated, emergency loads begin to sequence onto the emergency buses (still powered from the normal offsite supply), and the emergency diesel generator starts but does not load. If the degraded voltage condition continues to exist until the short-term DVR time delay setting is reached, the emergency loads are then separated from offsite power, loads on emergency buses are shed, the emergency diesel generator output breaker is shut, and the emergency loads are sequenced back onto the emergency buses. The LBLOCA analysis timeline for the safety functions provided by the equipment in this scenario is used to establish the analytical limit for the maximum short-term DVR time delay. This meets the intent of Branch Technical Position PSB-1 regarding maximum time delays consistent with design basis accident analysis. If degraded voltage conditions exist without a simultaneous accident (normal operating conditions), a longer time delay (Device 2-2) is allowed before the automatic tripping actions are initiated. This second time delay is based on the maximum time for which the most sensitive load can perform its safety function without impairment at the degraded voltage. Calculations to determine time delay allowable values and trip setpoints to protect time delay analytical limits were performed consistent with the methodology of Technical Specification Task Force Traveler 493, Clarify Application of Setpoint Methodology for LSSS Functions. Although the DVR function is not a limiting safety system setting function, the methodology is a conservative approach for determination of these parameters. The Engineered Safety Features Actuation System interlocks perform the following functions: P-4 Reactor tripped - Actuates Turbine trip, closes main feedwater valves on Tavg below Setpoint, prevents the opening of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level signal, allows Safety Injection block so that components can be reset or tripped. Reactor not tripped - prevents manual block of Safety Injection. P-11 On increasing pressurizer pressure, P-11 automatically reinstates Safety Injection actuation on low pressurizer pressure and low steam-line pressure, sends an open signal to the accumulator discharge valves and automatically blocks steam-line isolation on a high rate of decrease in steam-line pressure. On decreasing pressurizer pressure, P-11 allows the manual block of Safety Injection on low pressurizer pressure and low steam-line pressure and allows steam-line isolation, on a high rate of decrease in steam-line pressure, to become active upon manual block of Safety Injection from low steam-line pressure. P-12 P-12 has no ESF or reactor trip functions. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System. SHEARON HARRIS - UNIT 1 B 3/4 3-3 Amendment No. 143

REACTOR COOLANT SYSTEM BASES SAFETY VALVES (Continued) overpressure condition which could occur during shutdown. In the event that no safety valves are OPERABLE, an operating RHR loop, connected to the RCS, provides overpressure relief capability and will prevent RCS overpressurization. In addition, the Overpressure Protection System provides a diverse means of protection against RCS overpressurization at low temperatures. During operation, all pressurizer Code safety valves must be OPERABLE to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. The combined relief capacity of all of these valves is greater than the maximum surge rate resulting from a complete loss-of-load assuming no reactor trip until the second Reactor Trip System trip setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of the power-operated relief valves or steam dump valves. Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of Section XI of the ASME Boiler and Pressure Code. 3/4.4.3 PRESSURIZER In MODES 1, 2 and 3 the LCO requirement for a steam bubble is reflected implicitly in the accident analyses. Safety analyses performed for lower MODES are not limiting. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption, the analyses neglect the small fraction of non-condensable gases normally present. Safety analyses presented in the FSAR do not take credit for pressurizer heater operation; however, an implicit initial condition assumption of the safety analyses is that the RCS is operating at normal pressure. The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, is an initial condition for the RCS overpressurization that occurs during Turbine Trip in MODE 1. The initial pressurizer water level for other FSAR events is in accordance with applicable methodologies. This satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737, is the reason for providing an LCO. 3/4.4.4 RELIEF VALVES In MODES 1, 2, and 3 the power-operated relief values (PORVs) provide an RCS pressure boundary, manual RCS pressure control for mitigation of accidents, and automatic RCS pressure relief to minimize challenges to the safety valves. Providing an RCS pressure boundary and manual RCS pressure control for mitigation of a steam generator tube rupture (SGTR) are the safety-related functions of the PORVs in MODES 1, 2, and

3. The capability of the PORV to perform its function of providing an RCS pressure boundary requires that the PORV or its associated block valve is closed. The capability of the PORV to perform manual RCS pressure control for mitigation of a SGTR accident is based on manual actuation and does not require the automatic RCS pressure control function. The automatic RCS pressure control function of the PORVs is not a safety-related function in MODES 1, 2, and 3. The automatic pressure control function limits the number of challenges to the safety valves, but the safety valves perform the safety function of RCS overpressure protection. Therefore, the automatic RCS pressure control function of the PORVs does not have to be available for the PORVs to be operable.

SHEARON HARRIS - UNIT 1 B 3/4 4-2 Amendment No. 151

REACTOR COOLANT SYSTEM BASES RELIEF VALVES (Continued) Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable. Operation with the block valves opened is preferred. This allows the PORVs to perform automatic RCS pressure relief should the RCS pressure actuation setpoint be reached. However, operation with the block valve closed to isolate PORV seat leakage is permissible since automatic RCS pressure relief is not a safety-related function of the PORVs. The OPERABILITY of the PORVs and block valves in MODES 1, 2, and 3 is based on their being capable of performing the following functions:

1. Maintaining the RCS pressure boundary,

2. Manual control of PORVs to control RCS pressure as required for SGTR mitigation,

3. Manual closing of a block valve to isolate a stuck open PORV,

4. Manual closing of a block valve to isolate a PORV with excessive seat leakage, and

5. Manual opening of a block valve to unblock an isolated PORV to allow it to be used to control RCS pressure for SGTR mitigation.

The non-safety PORV and block valve are used only as a backup to the two redundant safety grade PORVs and block valves to control RCS pressure for accident mitigation. Therefore, continued operation with the non-safety PORV unavailable for RCS pressure control is allowed as long as the block valve or PORV can be closed to maintain the RCS pressure boundary. Surveillance Requirements provide the assurance that the PORVs and block valves can perform their safety functions. Surveillance Requirements 4.4.4.1 and 4.4.4.3 address the PORVs and Surveillance Requirement 4.4.4.2 addresses the block valves. The surveillance frequencies are controlled under the Surveillance Frequency Control Program. Surveillance Requirements 4.4.4.1.a provides assurance the actuation instrumentation for automatic PORV actuation is calibrated such that the automatic PORV actuation signal is within the required pressure range even though automatic actuation capability of the PORV is not necessary for the PORV to be OPERABLE in MODES 1, 2, and 3. Surveillance Requirement 4.4.4.1.b provides assurance the PORV is capable of opening and closing. The associated block valve should be closed prior to stroke testing a PORV to preclude depressurization of the RCS. This test will be done in MODES 3 or 4, before the PORV is required for overpressure protection in TS 3.4.9.4. SHEARON HARRIS - UNIT 1 B 3/4 4-2a Amendment No. 154

REACTOR COOLANT SYSTEM BASES RELIEF VALVES (Continued) Surveillance Requirements 4.4.4.3 provides assurance of operability of the accumulators and that the accumulators are capable of supplying sufficient air to operate PORV(s) if they are needed for RCS pressure control and normal air and nitrogen systems are not available . Surveillance Requirements 4.4.4.2 addresses the block valves . The block valves are exempt from the surveillance requirements to cycle the valves when they have been closed to comply with ACTION statements "b" or "c". This precludes the need to cycle the valves with a full system differential pressure or when maintenance is being performed to restore an inoperable PORV to OPERABLE status . 3/4.4 .5 STEAM GENERATOR (SG)TUBE INTEGRITY

Background

Steam generator (SG) tubes are small diameter. thin walled tubes that carry primary coolant through the primary-to-secondary heat exchangers. The SG tubes have a number of important safety functions. SG tubes are an integral part of the reactor coolant pressure boundary CRCPB) and. as such. are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition. as part of the RCPB. the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This specification addresses only the RCPB integrity function of the SG . The SG heat removal function is addressed by LCO 3.4 .1.1. "Reactor Coolant Loops and Coolant Circulation. Startup and Power Operation." LCO 3.4.1.2. "Reactor Coolant System. Hot Standby," LCO 3.4.1.3.

Reactor Coolant System. Hot Shutdown." and LCO 3.4.1.4.1. "Reactor Coolant System. Cold Shutdown-Loops Filled."

SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis. including applicable regulatory requirements. SHEARON HARRIS - UNIT 1 B 3/4 4-2b Amendment No. 124

3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures. The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met. The value of 66% indicated level ensures that a minimum of 7440 gallons is maintained in the accumulators. The maximum indicated level of 96% ensures that an adequate volume exists for nitrogen pressurization. The accumulator power operated isolation valves are considered to be "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required. The limits for operation with an accumulator inoperable for any reason except an isolation valve closed or boron concentration not within limits minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on the available ECCS water and an insignificant effect on core subcriticality during reflood. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis demonstrates that the accumulators do not discharge following a large steam line break for HNP. Therefore, 72 hours is permitted to return the boron concentration to within limits. If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required. 3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the recirculation mode during the accident recovery period. Management of gas voids is important to ECCS OPERABILITY. ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel. A Surveillance Requirement verifies that required ECCS locations susceptible to gas accumulation are sufficiently filled with water. Selection of ECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and SHEARON HARRIS - UNIT 1 B 3/4 5-1 Amendment No. 150

3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued) instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions. The ECCS is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits. If any accumulated gas is eliminated or brought within the acceptance criteria limits as part of the Surveillance performance, the Surveillance is considered met and the system is OPERABLE. Past operability is then evaluated under the Corrective Action program. If it is suspected that a gas intrusion event is occurring, then this is evaluated under the Operability Determination Process. ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval. With the RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable without single failure consideration on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements. The limitation for a maximum of one charging/safety injection pump to be OPERABLE and the Surveillance Requirement to verify one charging/safety injection pump OPERABLE below 325°F provides assurance that a mass addition pressure transient can be relieved by the operation of a single PORV. SHEARON HARRIS - UNIT 1 B 3/4 5-1a Amendment No. 150

EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued) The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the safety analyses are met and that subsystem OPERABILITY is maintained. Surveillance Requirements for throttle valve position and flow balance testing provide assurance that proper ECCS flows will be maintained in the event of a LOCA. Maintenance of proper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and (3) provide an acceptable level of total ECCS flow to all injection points equal to or above that assumed in the ECCS-LOCA analyses. The Surveillance Requirement provided to verify the correct position of valves in the flow path is modified by a note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed. 3/4.5.4 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling water storage tank (RWST) as part of the ECCS ensures that a sufficient supply of borated water is available for injection into the core by the ECCS. This borated water is used as cooling water for the core in the event of a LOCA and provides sufficient negative reactivity to adequately counteract any positive increase in reactivity caused by RCS cooldown. RCS cooldown can be caused by inadvertent depressurization, a LOCA, or a steam line rupture. The limits on RWST minimum volume and boron concentration assure that: (1) sufficient water is available within containment to permit recirculation cooling flow to the core and (2) the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes with all shutdown and control rods inserted except for the most reactive control assembly. These limits are consistent with the assumption of the LOCA and steam line break analyses. The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics. The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.0 and 11.0 for the solution recirculated within containment after a LOCA. This pH band minimizes the evolution of iodine and minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components. An RWST allowed outage time of 12 hours is permitted during performance of Technical Specification surveillance 4.4.6.2.2 with a dedicated attendant stationed at valve 1CT-22 in communication with the Control Room. The dedicated attendant is to remain within the RWST compartment whenever valve 1CT-22 is open during the surveillance. The dedicated attendant can manually close valve 1CT-22 within 30 minutes in case of a line break caused by a seismic event. Due to the piping configuration, a break in the non-seismic portion of piping during this surveillance could result in draining the RWST below the minimum analyzed volume. SHEARON HARRIS - UNIT 1 B 3/4 5-2 Amendment No. 150

3/4 .6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1 .1 CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses . This restriction. in conjunction with the leakage rate limitation. will limit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR Part 100 during accident conditions. 3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates ensure that the total containment leakage volume will not exceed the value assumed in the safety analyses at the peak acci*dent pressure. Pa. As an added conservatism. the measured overall integrated leakage rate is further limited to less than or equal to 0.75 La, during performance of the periodic test. to account for possible degradation of the containment leakage barriers between leakage tests. The surveillance testing for measuring leakage rates is consistent with the requirements of Appendix J of 10 CFR Part 50. Option A for Type Band C tests. and the Containment Leakage Rate Testing Program for Type A tests. 3/4.6.1.3 CONTAINMENT AIR LOCKS fhe limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance testing of the air lock seals provides assurance that the overall air lock leakage will not become excessive due to seal damage during the intervals between air lock leakage tests. Action statement "a" has been modified by a note. The note allows use of the air lock for entry and exit for seven days under administrative controls if both air locks have an inoperable door. This seven day restriction begins when a door in the second air lock is discovered to be inoperable. Containment entry may be required to perform Technical Specification surveillances and actions. as well as other activities on equipment inside containment that are required by Technical Specifications (TS) or other activities that support TS required equipment. In addition. containment entry may be required to perform repairs on vital plant equipment. which if not repaired. could lead to a plant transient or a reactor trip. This note is not intended to preclude performing other activities Ci .e .. non-TS required activities or repairs on non-vital plant equipment) if the containment is entered. using the inoperable air lock. to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize containment during the short time that an OPERABLE door is expected to be open. SHEARON HARRIS - UNIT 1 B 3/4 6-1 Amendment No. 91

3/4.6 CONTAINMENT SYSTEMS BASES CONTAINMENT AIR LOCKS (Continued) Maintaining containment air locks OPERABLE reguires compliance with the leakage rate test requirements of 10 CFR 50. Appendix J . as modified by approved exemptions. HNP has an approved exemption to Appendix J Option A. paragraph 111 .0.2 of 10 CFR 50 in that the Overall air lock leakage test is required to be performed if maintenance has been performed that could affect the air lock sealing capability prior to establishing CONTAINMENT INTEGRITY . This is in contrast to the Appendix J requirement if air locks are opened during periods when containment integrity is not required by the plant's Technical Specifications shall be tested at the end of such periods. 3/4.6.1.4 INTERNAL PRESSURE The limitations on containment internal pressure ensure that: (1) the containment structure is prevented from exceeding its design negative pressure differential with respect to the outside atmosphere of -2 psig . and (2) the containment peak pressure does not exceed the design pressure of 45 psig. The maximum peak pressure expected to be obtained from a postulated LOCA is 41.8 psig using a value of 1.6 psig for initial positive containment Rressure . The -1" wg was chosen to be consistent with the initial assumptions of the accident analyses. SHEARON HARRIS - UNIT 1 B 3/ 4 6-la Amendment No . 107 I , I

CONTAINMENT SYSTEMS BASES The Containment Fan Coolers and the Containment Spray System are redundant to each other in providing post-accident cooling of the containment atmosphere. As a result of this redundancy in cooling capability. the allowable out-of-service time requirements for the Containment Fan Coolers have been appropriately adjusted. However. the allowable out-of-service time requirements for the Containment Spray System have been maintained consistent with that assigned other inoperable ESF equipment since the Containment Spray System also provides a mechanism for removing iodine from the containment atmosphere. 3/4.6.3 CONTAINMENT ISOLATION VALVES The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment and is consistent with the requirements of General Design Criteria 54 through 57 of Appendix A to 10 CFR Part 50. Containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA. Reopening of an inoperable containment isolation valve is allowed to permit I surveillance testing to demonstrate its operability of the operability of other equipment per Specification 4.6.3.1. or to change to compliance with another action statement for the LCD . An example of choosing an alternate action statement would be installing a blind flange versus using the failed closed containment isolation valve to isolate the penetration . This action would facilitate repair of the failed isolation valve. then removing the blind flange and re-installing the repaired valve . This process is acceptable because it results in restoring the penetration to its design configuration sooner that waiting for a plant shutdown to complete the repairs . 3/4 .6.4 COMBUSTIBLE GAS CONTROL Deleted. 3/4 .6.5 VACUUM RELIEF SYSTEM The OPERABILITY of the primary containment to atmosphere vacuum relief valves ensures that the containment internal pressure does not become more negative than -1.93 psig. This condition is necessary to prevent exceeding the con-tainment design limit for internal vacuum of -2 psig . SHEARON HARRIS - UNIT 1 B 3/4 6-4 Amendment No. 131

3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM The OPERABILITY of the Auxiliary Feedwater System ensures that the Reactor Coolant System can be cooled down to less than 350°F from normal operating conditions so that the Residual Heat Removal System may be placed into operation. The AFW System provides decay heat removal immediately following a station blackout event, and is required to mitigate the Loss of Normal Feedwater and Feedwater Line break accidents analyzed in FSAR Chapter 15. The minimum pump performance requirements are based upon a maximum allowable degradation of the pump performance curves. Pump operation at this level has been demonstrated by calculation to deliver sufficient AFW flow to satisfy the accident analysis acceptance criteria. With regard to the AFW valve position verification of Surveillance Requirement 4.7.1.2.1 Sub-paragraph b.1, this requirement does not include in its scope the AFW flow control valves inline from the AFW motor-driven pump discharge header to each steam generator when they are equipped with an auto-open feature. The auto-open logic feature is designed to automatically open these valves upon receipt of an Engineered Safety Features System AFW start signal. As a consequence, valves with an auto-open feature do not have a "correct position" which must be verified. The valves may be in any position, in any MODE of operation thereby allowing full use of the AFW System for activities such as to adjust steam generator water levels prior to and during plant start-up, as an alternate feedwater system during hot standby, for cooldown operations, and to establish and maintain wet layup conditions in the steam generators. SHEARON HARRIS - UNIT 1 B 3/4 7-1a Amendment No. 154

3/4.7 PLANT SYSTEMS BASES 3/4.7.1.3 CONDENSATE STORAGE TANK The OPERABILITY of the condensate storage tank with the minimum water volume ensures that sufficient water is available to maintain the RCS at HOT STANDBY conditions for 6 hours with steam discharge to the atmosphere concurrent with total loss-of-offsite power. The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics, and the value has also been adjusted in a manner similar to that for the RWST and BAT, as discussed on page B 3/4 1-3. 3/4.7.1.4 SPECIFIC ACTIVITY The limitations on Secondary Coolant System specific activity ensure that the resultant offsite radiation dose will be limited to a small fraction of 10 CFR Part 100 dose guideline values in the event of a steam line rupture. This dose also includes the effects of a coincident 1 gpm reactor-to-secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the safety analyses. 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES The OPERABILITY of the main steam line isolation valves ensures that no more than one steam generator will blow down in the event of a steam line rupture. This restriction is required to: (1) minimize the positive reactivity effects of the Reactor Coolant System cooldown associated with the blowdown, and (2) limit the pressure rise within containment in the event the steam line rupture occurs within containment. The OPERABILITY of the main steam isolation valves within the closure times of the Surveillance Requirements are consistent with the assumptions used in the safety analyses. 3/4.7.2 STEAM GENERATOR PRESSURE / TEMPERATURE LIMITATION The limitation on steam generator pressure and temperature ensures that the pressure-induced stresses in the steam generators do not exceed the maximum allowable fracture toughness stress limits. The limitations of 70°F and 200 psig are based on a steam generator RTNDT of 60°F (a generic maximum) and are sufficient to prevent brittle fracture. The Shearon Harris specific RTNDT is limited to a maximum value of 10°F. SHEARON HARRIS - UNIT 1 B 3/4 7-2 Amendment No. 107

3/4.7 PLANT SYSTEMS BASES 3/4.7.3 COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Component Cooling Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses. 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM The OPERABILITY of the Emergency Service Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

NOTE-----------------------------------------------------------

A one-time change to TS 3.7.4 extends the action statement completion time from 72 hours to 14 days in order to replace the 'A' ESW pump. This change also affects TS 3.1.2.4, Charging Pumps - Operating, TS 3.5.2, ECCS Subsystems - Tavg Greater Than or Equal To 350°F, TS 3.6.2.1, Containment Spray System, TS 3.6.2.2, Spray Additive System, TS 3.6.2.3, Containment Cooling System, TS 3.7.1.2, Auxiliary Feedwater System, TS 3.7.3, Component Cooling Water System, TS 3.7.4, Emergency Service Water System, TS 3.7.6, Control Room Emergency Filtration System, TS 3.7.7, Reactor Auxiliary Building (RAB) Emergency Exhaust System, TS 3.7.13, Essential Services Chilled Water System, and TS 3.8.1.1, AC Sources - Operating. A note similar to the following is placed in each of the above listed TS:

The 'A' Train emergency service water loop is allowed to be inoperable for a total of 14 days only to allow for the implementation of design improvements on the 'A' Train ESW pump. The 14 days will be taken one time no later than October 29, 2016. During the period in which the 'A' Train ESW pump supply from the Auxiliary Reservoir or Main Reservoir is not available, Normal Service Water will remain available and in service to supply the A' Train ESW equipment loads until the system is ready for post maintenance testing. Allowance of the extended Completion Time is contingent on meeting the Compensatory Measures and Conditions described in HNP LAR submittal correspondence letter HNP-16-056.

SHEARON HARRIS - UNIT 1 B 3/4 7-3 Amendment No. 153

3/4.7 PLANT SYSTEMS BASES 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM (Continued)

 #                     CONDITIONS ASSOCIATED WITH ONE TIME TS CHANGE 1       Normal Service Water (NSW) will remain available and in service for the duration of the allowed outage time (AOT) to support operation of the A Emergency Diesel Generator if required. OP-155, Diesel Generator Emergency Power System, Section 5.1.2, EDG Control Room Manual Start, step 2 says VERIFY service water flow has been established to the EDG per OP-139. OP-139, Section 5.3, Supplying Both ESW [Emergency Service Water] Headers with NSW/Securing ESW Pump, requires the NSW header in service and the ESW header filled and vented per Section 8.24, which would align Service Water to the EDG.

This condition is an assumption in the risk metric calculations for the AOT. 2 The 'B' Train ESW will remain operable. OWP-SW, Service Water, includes component lineups necessary when an ESW pump is inoperable that provides defense-in-depth for prevention of core damage and containment failure. The lineup steps for time periods when the A ESW pump is inoperable include the lifting of leads to disable the Safety Injection (SI) close signal to service water valve 1SW-39 and service water valve 1SW-276. This allows the breakers to be maintained on and allows expeditious isolation capability in the event of a SW leak in the Reactor Auxiliary Building (RAB). This lineup also defeats the SI signal to service water valve 1SW-276 to maintain it open. As long as service water valves 1SW-274 and 1SW-40 are operable, the B Train ESW header is isolable and operable. 3 In accordance with OMM-001, Operations Administrative Requirements, the following equipment is posted protected by Operations when A ESW pump is unavailable: Switchyard (Breakers 52-1, 52-2, 52-3 and Line Panels 5, 6, and 7), B ESW pump and breaker, B-Train Process Instrumentation Control (PIC) cabinets (PIC 2, 4, 10, 14, and 18), and the A Start-up Transformer. This condition is an assumption in the risk metric calculations for the AOT. 4 Prior to the AOT entry, the weather forecast will be reviewed for any forecasted weather that could affect the availability of offsite power. The outage will not commence if weather conditions are predicted that could adversely affect the availability of offsite power. WCM-001, On-line Maintenance Risk Management, requires review of the weather forecast prior to the beginning of this maintenance outage. This condition is an assumption in the risk metric calculations for the AOT. SHEARON HARRIS - UNIT 1 B 3/4 7-3a Amendment No. 153

3/4.7 PLANT SYSTEMS BASES 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM (Continued)

 #                    CONDITIONS ASSOCIATED WITH ONE TIME TS CHANGE 5       The opposite train or critical equipment listed below and supporting components will be posted protected:

x EDGs (both A and B EDGs) x NSW Pumps and power supplies (both A and B NSW Pumps) x Dedicated Shutdown Diesel Generator x Alternate Seal Injection Pump x Turbine Driven Auxiliary Feedwater (AFW) Pump x B ESW Pump Quantitative credit has been taken in the risk metric calculations for this condition. 6 Continuous fire watches in risk critical areas will be instituted on the protected train, which will include the following rooms: x B Electrical Switchgear Room x B Cable Spread Room x B Battery Room Quantitative credit has been taken in the risk metric calculations for this condition. 7 Restrictions will remain in place on hot work and transient combustibles in the following rooms: x B Electrical Switchgear Room x B Cable Spread Room x B Battery Room Qualitative Risk Impact. 8 Operators will be briefed on the procedures and guidance for the equipment lineup necessary for the proposed AOT activity. Quantitative credit has been taken in the risk metric calculations for this condition. 9 Operators will be briefed to improve operator response for ASI System actions. Quantitative credit has been taken in the risk metric calculations for this condition. SHEARON HARRIS - UNIT 1 B 3/4 7-3b Amendment No. 153

3/4.7 PLANT SYSTEMS BASES 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM (Continued)

 #                   CONDITIONS ASSOCIATED WITH ONE TIME TS CHANGE 10      The B ESW pump discharge pressure transmitter will be calibrated within three months prior to the proposed AOT.

Quantitative credit has been taken in the risk metric calculations for this condition. 11 The B ESW pump discharge strainer differential pressure will be checked when the B ESW pump is in service and a backwash will be completed to verify it is clean within one month prior to the proposed AOT. This will ensure that the strainer is clean and capable of performing its duty during the AOT. Qualitative Risk Impact. 12 Switchgear Room in Turbine Building 286 will be protected, in order to minimize the risk to NSW power supplies. Qualitative Risk Impact. 13 Restrictions will be in place on switchyard work or other maintenance and testing that could cause a plant trip for the duration of the AOT. Additionally, the system load dispatcher will be contacted once per day to ensure no significant grid perturbations are expected during the extended AOT. Qualitative Risk Impact. 14 The FLEX ESW pump will be pre-staged in advance of the AOT entry to allow for connection to the A Train ESW header, to provide alternate cooling to the A EDG in the event of a loss of offsite power (LOOP). Dedicated personnel will be available to make the necessary equipment manipulations such that the A EDG will be started within approximately one hour of the LOOP. The A EDG will be manually started and operations will energize the necessary loads to perform the safety function of decay heat removal in the event of a LOOP. Quantitative Risk Impact. SHEARON HARRIS - UNIT 1 B 3/4 7-3c Amendment No. 153

3/4.7 PLANT SYSTEMS BASES 3/4.7.4 EMERGENCY SERVICE WATER SYSTEM (Continued)

 #                    CONDITIONS ASSOCIATED WITH ONE TIME TS CHANGE 15 All associated B Train equipment for the Technical Specifications (TS) listed below, which are the only operable trains, are to be protected during the extended AOT.

TS 3.1.2.4, Charging Pumps - Operating TS 3.5.2, ECCS Subsystems - Tavg Greater Than or Equal To 350°F TS 3.6.2.1, Containment Spray System [CSS] TS 3.6.2.2, Spray Additive System TS 3.6.2.3, Containment Cooling System [CCS] TS 3.7.1.2, Auxiliary Feedwater [AFW] System TS 3.7.3, Component Cooling Water [CCW] System TS 3.7.4, Emergency Service Water System [ESWS] TS 3.7.6, Control Room Emergency Filtration System [CREFS] TS 3.7.7, Reactor Auxiliary Building [RAB] Emergency Exhaust System TS 3.7.13, Essential Services Chilled Water System [ESCWS] TS 3.8.1.1, AC Sources - Operating 16 The Demineralized Water Storage Tank will be maintained between 29 and 34 feet for the duration of the AOT. 17 The following actions will be taken prior to and during the proposed AOT as described: x EDG cooling flow will be verified prior to the AOT entry. x B EDG loading and operational check will be completed prior to the AOT entry. x B ESW pump operational check will be completed prior to the AOT entry. x Proceduralized EDG inspections and checks will be performed daily for reliability during the AOT, which are normally completed weekly. x Freeze protection equipment as required and ventilation in the intake buildings will be verified as functional prior to the AOT. x Position of low head safety injection recirculation to Refueling Water Storage Tank isolation valves, 1SI-448 and 1SI-331, will be verified prior to the AOT, in addition to other SW valves that will support the clearance for the pump replacement. SHEARON HARRIS - UNIT 1 B 3/4 7-3d Amendment No. 153

3/$176<67(06 %$6(6 8/7,0$7(+($76,1. 7KHOLPLWDWLRQVRQWKHXOWLPDWHKHDWVLQNOHYHODQGWHPSHUDWXUHHQVXUHWKDWVXIILFLHQWFRROLQJ FDSDFLW\LVDYDLODEOHHLWKHU SURYLGHQRUPDOFRROGRZQRIWKHIDFLOLW\RU PLWLJDWHWKHHIIHFWV RIDFFLGHQWFRQGLWLRQVZLWKLQDFFHSWDEOHOLPLWV 7KHOLPLWDWLRQVRQPLQLPXPZDWHUOHYHODQGPD[LPXPWHPSHUDWXUHDUHEDVHGRQSURYLGLQJD GD\FRROLQJZDWHUVXSSO\WRVDIHW\UHODWHGHTXLSPHQWZLWKRXWH[FHHGLQJLWVGHVLJQEDVLV WHPSHUDWXUHDQGLVFRQVLVWHQWZLWKWKHUHFRPPHQGDWLRQVRI5HJXODWRU\*XLGH8OWLPDWH +HDW6LQNIRU1XFOHDU3ODQWV5HY-DQXDU\ &21752/5220(0(5*(1&<),/75$7,216<67(0 %$&.*5281' 7KH&5()6SURYLGHVDSURWHFWHGHQYLURQPHQWIURPZKLFKRFFXSDQWVFDQFRQWUROWKHXQLW IROORZLQJDQXQFRQWUROOHGUHOHDVHRIUDGLRDFWLYLW\KD]DUGRXVFKHPLFDOVRUVPRNH 7KH&5()6FRQVLVWVRIWZRLQGHSHQGHQWUHGXQGDQWWUDLQVWKDWUHFLUFXODWHDQGILOWHUWKHDLULQWKH FRQWUROURRPHQYHORSH &5( DQGD&5(ERXQGDU\WKDWOLPLWVWKHLQOHDNDJHRIXQILOWHUHGDLU(DFK &5()6WUDLQFRQVLVWVRIDSUHILOWHURUGHPLVWHUDKLJKHIILFLHQF\SDUWLFXODWHDLU +(3$ ILOWHUDQ DFWLYDWHGFKDUFRDODGVRUEHUVHFWLRQIRUUHPRYDORIJDVHRXVDFWLYLW\ SULQFLSDOO\LRGLQHV DQGD IDQ 'XFWZRUNYDOYHVRUGDPSHUVGRRUVEDUULHUVDQGLQVWUXPHQWDWLRQDOVRIRUPSDUWRIWKH V\VWHPDVZHOODVGHPLVWHUVWRUHPRYHZDWHUGURSOHWVIURPWKHDLUVWUHDP $VHFRQGEDQNRI +(3$ILOWHUVIROORZVWKHDGVRUEHUVHFWLRQWRFROOHFWFDUERQILQHVDQGSURYLGHVEDFNXSLQFDVHRI IDLOXUHRIWKHPDLQ+(3$ILOWHUEDQN7KHKHDWHUVDUHQRWUHTXLUHGIRU23(5$%,/,7<VLQFHWKH FDUERQODERUDWRU\WHVWVDUHSHUIRUPHGDWUHODWLYHKXPLGLW\EXWDUHPDLQWDLQHGLQWKHV\VWHP WRSURYLGHDGGLWLRQDOHIILFLHQF\PDUJLQ 7KH&5(LVWKHDUHDZLWKLQWKHFRQILQHVRIWKH&5(ERXQGDU\WKDWFRQWDLQVWKHVSDFHVWKDWFRQWURO URRPRFFXSDQWVLQKDELWWRFRQWUROWKHXQLWGXULQJQRUPDODQGDFFLGHQWFRQGLWLRQV 7KLVDUHD HQFRPSDVVHVWKHFRQWUROURRPDQGPD\HQFRPSDVVRWKHUQRQFULWLFDODUHDVWRZKLFKIUHTXHQW SHUVRQQHODFFHVVRUFRQWLQXRXVRFFXSDQF\LVQRWQHFHVVDU\LQWKHHYHQWRIDQDFFLGHQW 7KH &5(LVSURWHFWHGGXULQJQRUPDORSHUDWLRQQDWXUDOHYHQWVDQGDFFLGHQWFRQGLWLRQV7KH&5( ERXQGDU\LVWKHFRPELQDWLRQRIZDOOVIORRUURRIGXFWLQJGRRUVSHQHWUDWLRQVDQGHTXLSPHQWWKDW SK\VLFDOO\IRUPWKH&5(7KH23(5$%,/,7<RIWKH&5(ERXQGDU\PXVWEHPDLQWDLQHGWRHQVXUH WKDWWKHLQOHDNDJHRIXQILOWHUHGDLULQWRWKH&5(ZLOOQRWH[FHHGWKHLQOHDNDJHDVVXPHGLQWKH OLFHQVLQJEDVLVDQDO\VLVRIGHVLJQEDVLVDFFLGHQW '%$ FRQVHTXHQFHVWR&5(RFFXSDQWV7KH &5(DQGLWVERXQGDU\DUHGHILQHGLQWKH&RQWURO5RRP(QYHORSH+DELWDELOLW\3URJUDP 7KH&5()6LVDQHPHUJHQF\V\VWHPSDUWVRIZKLFKPD\DOVRRSHUDWHGXULQJQRUPDOXQLW RSHUDWLRQLQWKHVWDQGE\PRGHRIRSHUDWLRQ 8SRQUHFHLSWRIWKHDFWXDWLQJVLJQDO V QRUPDODLU VXSSO\WRWKH&5(LVLVRODWHGDQGWKHVWUHDPRIYHQWLODWLRQDLULVUHFLUFXODWHGWKURXJKWKHV\VWHP ILOWHUWUDLQV7KHSUHILOWHUVRUGHPLVWHUVUHPRYHDQ\ODUJHSDUWLFOHVLQWKHDLUDQGDQ\HQWUDLQHG ZDWHUGURSOHWVSUHVHQWWRSUHYHQWH[FHVVLYHORDGLQJRIWKH+(3$ILOWHUVDQGFKDUFRDODGVRUEHUV 7KHGHPLVWHULVLPSRUWDQWWRWKHHIIHFWLYHQHVVRIWKHFKDUFRDODGVRUEHUV $FWXDWLRQRIWKH&5()6SODFHVWKHV\VWHPLQWKHHPHUJHQF\PRGH LHLVRODWLRQZLWK UHFLUFXODWLRQPRGH RIRSHUDWLRQ $FWXDWLRQRIWKHV\VWHPFORVHVWKHXQILOWHUHGRXWVLGHDLULQWDNH DQGXQILOWHUHGH[KDXVWGDPSHUVDQGDOLJQVWKHV\VWHPIRUUHFLUFXODWLRQRIWKHDLUZLWKLQWKH&5( WKURXJKWKHUHGXQGDQWWUDLQVRI+(3$DQGFKDUFRDOILOWHUV 7KHHPHUJHQF\PRGHDOVRDOORZVIRU SUHVVXUL]DWLRQDQGILOWHUHGYHQWLODWLRQRIWKHDLUVXSSO\WRWKH&5(

6+($521+$55,681,7 %H $PHQGPHQW1R

3/$176<67(06 %$6(6 6($/('6285&(&217$0,1$7,21 7KHVRXUFHVUHTXLULQJOHDNWHVWVDUHVSHFLILHGLQ&)5 F LL 7KHOLPLWDWLRQRQ UHPRYDEOHFRQWDPLQDWLRQLVUHTXLUHGE\&)5 F 7KLVOLPLWDWLRQZLOOHQVXUHWKDWOHDNDJH IURP%\SURGXFW6RXUFHDQG6SHFLDO1XFOHDU0DWHULDOVRXUFHVZLOOQRWH[FHHGDOORZDEOHLQWDNH YDOXHV 6HDOHGVRXUFHVDUHFODVVLILHGLQWRWKUHHJURXSVDFFRUGLQJWRWKHLUXVHZLWK6XUYHLOODQFH 5HTXLUHPHQWVFRPPHQVXUDWHZLWKWKHSUREDELOLW\RIGDPDJHWRDVRXUFHLQWKDWJURXS 7KRVH VRXUFHVWKDWDUHIUHTXHQWO\KDQGOHGDUHUHTXLUHGWREHWHVWHGPRUHRIWHQWKDQWKRVHWKDWDUHQRW 6HDOHGVRXUFHVWKDWDUHFRQWLQXRXVO\HQFORVHGZLWKLQDVKLHOGHGPHFKDQLVP LHVHDOHGVRXUFHV ZLWKLQUDGLDWLRQPRQLWRULQJRUERURQPHDVXULQJGHYLFHV DUHFRQVLGHUHGWREHVWRUHGDQGQHHGQRW EHWHVWHGXQOHVVWKH\DUHUHPRYHGIURPWKHVKLHOGHGPHFKDQLVP '(/(7(' '(/(7(' '(/(7(' (66(17,$/6(59,&(6&+,//(':$7(56<67(0 7KH23(5$%,/,7<RIWKH(PHUJHQF\6HUYLFH&KLOOHG:DWHU6\VWHPHQVXUHVWKDWVXIILFLHQW FRROLQJFDSDFLW\LVDYDLODEOHIRUFRQWLQXHGRSHUDWLRQRIVDIHW\UHODWHGHTXLSPHQWGXULQJQRUPDO DQGDFFLGHQWFRQGLWLRQV 7KHUHGXQGDQWFRROLQJFDSDFLW\RIWKLVV\VWHPDVVXPLQJDVLQJOH IDLOXUHLVFRQVLVWHQWZLWKWKHDVVXPSWLRQVXVHGLQWKHVDIHW\DQDO\VHV )8(/6725$*(322/%2521&21&(175$7,21 7KHIXHOVWRUDJHSRROVFRQWDLQVHYHUDOUDFNGHVLJQV7KH3:5DQG%:5UDFNVLQ3RROV&DQG 'KDYHDSRLVRQWKDWPDLQWDLQVNHIIOHVVWKDQRUHTXDOWRGXULQJQRUPDORSHUDWLRQ7KH%:5 UDFNVLQ3RROV$DQG%HLWKHUFUHGLWDSRLVRQLQWKHUDFNGHVLJQRUWKDWFRQWDLQHGLQWKHUDFN LQVHUWV)RUWKH3:5UDFNVLQ3RROV$DQG%DQGWKH%:5UDFNVWKDWXWLOL]HUDFNLQVHUWVWKH UDFNV¶LQVWDOOHGSRLVRQLVQRWFUHGLWHGDQGVROXEOHERURQLVUHOLHGXSRQWRPDLQWDLQWKHVWRUDJH.HII OHVVWKDQRUHTXDOWRGXULQJQRUPDORSHUDWLRQ6ROXEOHERURQLVDOVRUHOLHGXSRQGXULQJGHVLJQ EDVLVDFFLGHQWV HJIXHOKDQGOLQJDFFLGHQW )+$ RUPLVORDGLQJ WRPDLQWDLQNHIIOHVVWKDQRU HTXDOWR7KHPRVWOLPLWLQJERURQUHTXLUHPHQWLVSSPRIDQ\RIWKHSRROV 7KH GLIIHUHQFHEHWZHHQSSPDQGSSPSURYLGHVPDUJLQIRUERURQPHDVXUHPHQW XQFHUWDLQWLHVDQGWKHGHWHFWLRQDQGPLWLJDWLRQRIDQDFFLGHQWDOERURQGLOXWLRQHYHQW,WLVQRW UHTXLUHGWRSRVWXODWHWKHERURQGLOXWLRQDFFLGHQWVFRQFXUUHQWZLWKDQRWKHUDFFLGHQWVXFKDVIXHO PLVORDGLQJRU)+$ 7KHZDWHULQWKHSRROVQRUPDOO\FRQWDLQVDFRQFHQWUDWLRQLQH[FHVVRISSP7KHSRROVDUH W\SLFDOO\LQWHUFRQQHFWHGWKURXJKFDQDOV<HDUVRIRSHUDWLQJGDWDVKRZWKDWWKHERURQ FRQFHQWUDWLRQGRHVQRWYDU\VLJQLILFDQWO\IURPSRROWRSRRO7KHVDPSOLQJVXUYHLOODQFHSHUPLWV WDNLQJDVDPSOHIURPDQ\ORFDWLRQLQWKHFRQQHFWHGYROXPHRIWKHSRROV7KLVLVW\SLFDOO\GRQHE\ URWDWLQJEHWZHHQIRXUZLGHO\VHSDUDWHGORFDWLRQV HJ3RRO$3RRO%3RRO&DQG 7UDQVIHU &DQDO LQWKHHQWLUHSRROYROXPH6DPSOLQJRIDQLQGLYLGXDOSRROLVRQO\UHTXLUHGZKHQDVSHFLILF SRROLVLVRODWHGVXFKWKDWGLIIXVLRQRIWKHERURQEHWZHHQSRROVLVUHVWULFWHG 6+($521+$55,681,7 % $PHQGPHQW1R

(/(&75,&$/32:(56<67(06 %$6(6 $1' $&6285&(6'&6285&(6$1'216,7(32:(5 ',675,%87,21 7KH23(5$%,/,7<RIWKH$&DQG'&SRZHUVRXUFHVDQGDVVRFLDWHGGLVWULEXWLRQV\VWHPV GXULQJRSHUDWLRQHQVXUHVWKDWVXIILFLHQWSRZHUZLOOEHDYDLODEOHWRVXSSO\WKHVDIHW\UHODWHG HTXLSPHQWUHTXLUHGIRU WKHVDIHVKXWGRZQRIWKHIDFLOLW\DQG WKHPLWLJDWLRQDQGFRQWURORI DFFLGHQWFRQGLWLRQVZLWKLQWKHIDFLOLW\7KHPLQLPXPVSHFLILHGLQGHSHQGHQWDQGUHGXQGDQW$& DQG'&SRZHUVRXUFHVDQGGLVWULEXWLRQV\VWHPVVDWLVI\WKHUHTXLUHPHQWVRI*HQHUDO'HVLJQ &ULWHULRQRI$SSHQGL[$WR&)53DUW 7KHVZLWFK\DUGLVGHVLJQHGXVLQJDEUHDNHUDQGDKDOIVFKHPH7KHVZLWFK\DUGFXUUHQWO\KDV VHYHQFRQQHFWLRQVZLWKWKH'XNH(QHUJ\WUDQVPLVVLRQQHWZRUNHDFKRIWKHVHWUDQVPLVVLRQOLQHV LVSK\VLFDOO\LQGHSHQGHQW7KHVZLWFK\DUGKDVRQHFRQQHFWLRQZLWKHDFKRIWKHWZR6WDUWXS $X[LOLDU\7UDQVIRUPHUVDQGHDFK6$7FDQEHIHGGLUHFWO\IURPDQDVVRFLDWHGRIIVLWHWUDQVPLVVLRQ OLQH7KH6WDUWXS$X[LOLDU\7UDQVIRUPHUVDUHWKHSUHIHUUHGSRZHUVRXUFHIRUWKH&ODVV((6) EXVHV7KHPLQLPXPDOLJQPHQWRIRIIVLWHSRZHUVRXUFHVZLOOEHPDLQWDLQHGVXFKWKDWDWOHDVWWZR SK\VLFDOO\LQGHSHQGHQWRIIVLWHFLUFXLWVDUHDYDLODEOH7KHWZRSK\VLFDOO\LQGHSHQGHQWFLUFXLWVPD\ FRQVLVWRIDQ\WZRRIWKHLQFRPLQJWUDQVPLVVLRQOLQHVWRWKH6$7V HLWKHUWKURXJKWKHVZLWFK\DUGRU GLUHFWO\ DQGLQWRWKH&ODVV(V\VWHP$VORQJDVWKHUHDUHDWOHDVWWZRWUDQVPLVVLRQOLQHVLQ VHUYLFHDQGWZRFLUFXLWVWKURXJKWKH6$7VWRWKH&ODVV(EXVHVWKH/&2LVPHW 7KH$&7,21UHTXLUHPHQWVVSHFLILHGIRUWKHOHYHOVRIGHJUDGDWLRQRIWKHSRZHUVRXUFHVSURYLGH UHVWULFWLRQXSRQFRQWLQXHGIDFLOLW\RSHUDWLRQFRPPHQVXUDWHZLWKWKHOHYHORIGHJUDGDWLRQ7KH 23(5$%,/,7<RIWKHSRZHUVRXUFHVDUHFRQVLVWHQWZLWKWKHLQLWLDOFRQGLWLRQDVVXPSWLRQVRIWKH VDIHW\DQDO\VHVDQGDUHEDVHGXSRQPDLQWDLQLQJDWOHDVWRQHUHGXQGDQWVHWRIRQVLWH$&DQG '&SRZHUVRXUFHVDQGDVVRFLDWHGGLVWULEXWLRQV\VWHPV23(5$%/(GXULQJDFFLGHQWFRQGLWLRQV FRLQFLGHQWZLWKDQDVVXPHGORVVRIRIIVLWHSRZHUDQGVLQJOHIDLOXUHRIWKHRWKHURQVLWH$& VRXUFH7KH$&DQG'&VRXUFHDOORZDEOHRXWRIVHUYLFHWLPHVDUHEDVHGRQ5HJXODWRU\*XLGH $YDLODELOLW\RI(OHFWULFDO3RZHU6RXUFHV'HFHPEHU7KHUHDUHDGGLWLRQDO$&7,21 UHTXLUHPHQWVWRYHULI\WKDWDOOUHTXLUHGIHDWXUH V WKDWGHSHQGRQWKHUHPDLQLQJ23(5$%/($& VRXUFHVDVDVRXUFHRIHPHUJHQF\SRZHUDUHDOVR23(5$%/(7KHVHUHTXLUHPHQWVDOORZD SHULRGRIWLPHWRUHVWRUHDQ\UHTXLUHGIHDWXUHGLVFRYHUHGWREHLQRSHUDEOHHJRXWRIVHUYLFHIRU PDLQWHQDQFHWRDQ23(5$%/(VWDWXV,IWKHUHTXLUHGIHDWXUH V FDQQRWEHUHVWRUHGWRDQ 23(5$%/(VWDWXVWKH$&7,21VWDWHPHQWUHTXLUHVWKHUHGXQGDQWUHTXLUHGIHDWXUHLHIHDWXUH UHFHLYLQJSRZHUIURPDQLQRSHUDEOH$&VRXUFHWREHGHFODUHGLQRSHUDEOH7KHDOORZHG RSHUDWLQJWLPHVWRUHVWRUHDQLQRSHUDEOHUHTXLUHGIHDWXUHWRDQ23(5$%/(VWDWXVLVEDVHGRQWKH UHTXLUHPHQWVLQ185(*7KHWHUPYHULI\DVXVHGLQWKHVH$&7,21VWDWHPHQWVPHDQVWR DGPLQLVWUDWLYHO\FKHFNE\H[DPLQLQJORJVRURWKHULQIRUPDWLRQWRGHWHUPLQHWKH23(5$%,/,7<RI UHTXLUHGIHDWXUH V ,WGRHVQRWPHDQWRSHUIRUPWKH6XUYHLOODQFH5HTXLUHPHQWQHHGHGWR GHPRQVWUDWHWKH23(5$%,/,7<RIWKHUHTXLUHGIHDWXUH V 7KH23(5$%,/,7<RIWKHPLQLPXPVSHFLILHG$&DQG'&SRZHUVRXUFHVDQGDVVRFLDWHG GLVWULEXWLRQV\VWHPVGXULQJVKXWGRZQDQGUHIXHOLQJHQVXUHVWKDW WKHIDFLOLW\FDQEHPDLQWDLQHG LQWKHVKXWGRZQRUUHIXHOLQJFRQGLWLRQIRUH[WHQGHGWLPHSHULRGVDQG VXIILFLHQWLQVWUXPHQWDWLRQ DQGFRQWUROFDSDELOLW\LVDYDLODEOHIRUPRQLWRULQJDQGPDLQWDLQLQJWKHXQLWVWDWXV 7KH6XUYHLOODQFH5HTXLUHPHQWVIRUGHPRQVWUDWLQJWKH23(5$%,/,7<RIWKHGLHVHOJHQHUDWRUVDUH EDVHGXSRQWKHUHFRPPHQGDWLRQVRI5HJXODWRU\*XLGHV6HOHFWLRQRI'LHVHO*HQHUDWRU6HW &DSDFLW\IRU6WDQGE\3RZHU6XSSOLHV'HFHPEHU3HULRGLF7HVWLQJRI'LHVHO 5HYLVLRQ 6+($521+$55,681,7 % $PHQGPHQW1R

3/4.8 ELECTRICAL POWER SYSTEMS BASES Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1, August 1977 as modified in accordance with the guidance of IE Notice 85-32, April 22, 1985; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators," Revision 1, October 1979. Proper shedding and sequencing of loads are required functions for Emergency Diesel Generator OPERABILITY. Pressure testing of the diesel generator fuel oil piping at 110% of the system design pressure will only be required on the isolable portions of (1) fuel oil transfer pump discharge piping to the day tank, (2) fuel oil supply from the day tank to the diesel vendor-supplied piping, and (3) fuel oil return piping from the diesel vendor-supplied piping to the day tank regulator valve. The exemptions allowed by ASME Code Section XI will be invoked for the atmospheric day tanks and non-isolable piping. The surveillance frequencies are controlled in the Surveillance Frequency Control Program. The inclusion of the loss of generator potential transformer circuit lockout trip is a design feature based upon coincident logic and is an anticipatory trip prior to diesel generator overspeed. In TS 4.8.1.1.2.f.13, the phrase all diesel generator trips refers to automatic protective trips. The Surveillance Requirements for demonstrating the OPERABILITY of the station batteries are based on the recommendations of Regulatory Guide 1.129, "Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, and IEEE Std 450-1980, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations." The performance test supporting the Surveillance Requirement incorporates the guidance of IEEE Std 450-2010. The surveillance frequencies are controlled in the Surveillance Frequency Control Program. Verifying average electrolyte temperature above the minimum for which the battery was sized, total battery terminal voltage on float charge, connection resistance values, and the performance of battery service and discharge tests ensures the effectiveness of the charging system, the ability to handle high discharge rates, and compares the battery capacity at that time with the rated capacity. Table 4.8-2 specifies the normal limits for each designated pilot cell and each connected cell for electrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells float voltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's full charge specific gravity or a battery charger current that had stabilized at a low value, is characteristic of a charged cell with adequate capacity. The normal limits for each connected cell for float voltage and specific gravity, greater than 2.13 volts and not more than 0.020 below the manufacturer's full charge specific gravity with an average specific gravity of all the connected cells not more than 0.010 below the manufacturer's full charge specific gravity, ensures the OPERABILITY and capability of the battery. Operation with a battery cell's parameter outside the normal limit but within the allowable value specified in Table 4.8-2 is permitted for up to 7 days. During this 7-day period: (1) the allowable values for electrolyte level ensures no physical damage to the plates with an adequate electron transfer capability; (2) the allowable value for the average specific gravity of all the cells, not more than 0.020 below the manufacturer's recommended full charge specific gravity, ensures that the decrease in rating will be less than the safety margin provided in sizing; (3) the allowable value for an individual cell's specific gravity, ensures that an individual cell's specific gravity will not be more than 0.040 below the manufacturer's full charge specific gravity and that the overall capability of the battery will be maintained within an acceptable limit; and (4) the allowable value for an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability to perform its design function. SHEARON HARRIS - UNIT 1 B 3/4 8-2 Amendment No. 154

3/4.8 ELECTRICAL POWER SYSTEMS BASES LCOs 3.8.3.1 and 3.8.3.2 include requirements for energizing 118 VAC vital buses from the associated inverters connected to 125 VDC buses. In the event the 118 VAC vital buses are not energized by the inverters connected to the 125 VDC buses, system design provides for energizing the 118 VAC buses from the Bypass Source or the Alternate Power Supply. The Bypass Source is regulated, transfer to the source is automatic within the inverters, and operation on the Bypass Source requires entry into LCO 3.8.3.1 Action c or LCO 3.8.3.2 Action, depending on the OPERATIONAL MODE. The Alternate Power Supply is unregulated and the voltage may not be sufficient to support loads as documented in calculation E-6007. Operation on the Alternate Power Supply, requires entry into LCO 3.8.3.1 Action b or LCO 3.8.3.2 Action, depending on the OPERATIONAL MODE. 3/4.8.4 ELECTRICAL EQUIPMENT PROTECTIVE DEVICES Containment electrical penetrations and penetration conductors are protected by either deenergizing circuits not required during reactor operation or by demonstrating the OPERABILITY of primary and backup overcurrent protection circuit breakers during periodic surveillance. The Surveillance Requirements applicable to lower voltage circuit breakers provide assurance of breaker reliability by testing at least one representative sample of each manufacturer's brand of circuit breaker. Each manufacturer's molded case and metal case circuit breakers are grouped into representative samples which are then tested on a rotating basis to ensure that all breakers are tested. If a wide variety exists within any manufacturer's brand of circuit breakers, it is necessary to divide that manufacturer's breakers into groups and treat each group as a separate type of breaker for surveillance purposes. For surveillance 4.8.4.1.a.1.c and 4.8.4.1.a.2, testing of the breakers includes a representative sample of 10% of each type of breaker as described in the table below. Types 15-Amp(A) 30A-40A 50A 60A 70A-90A 100-110A 125-150A 225A The bypassing of the motor-operated valves thermal overload protection during accident conditions by integral bypass devices ensures that safety-related valves will not be prevented from performing their function. The Surveillance Requirements for demonstrating the bypassing of the thermal overload protection during accident conditions are in accordance with Regulatory Guide 1.106, Thermal Overload Protection for Electric Motors on Motor Operated Valves, Revision 1, March 1977. Revision 1 SHEARON HARRIS - UNIT 1 B 3/4 8-3 Amendment No. 78

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE The purpose of this enclosure is to provide a mapping of identified in-scope Technical Specifications (TS) statements to modeled (and surrogate) Probabilistic Risk Assessment (PRA) functions. This mapping provides the basis by which to quantify the increase in risk associated with extending the Completion Time for a given TS Action and to calculate a Risk-Informed Completion Time (RICT) for the RICT Program application.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. NUREG/CR-5500, Volume 2, Reliability Study: Westinghouse Reactor Protection System, 1984-1995, December 1998.

4. TSTF-505-A, Rev. 2, Technical Specifications Task Force Improved Standard Technical Specifications Change Traveler, November 2018.

5. Updated Final Safety Analysis Report (FSAR) - Shearon Harris Nuclear Power Plant, Unit 1, Amendment 62.

3.0 INTRODUCTION

Section 4.0, Item 2 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) identifies the following necessary content: x The license amendment request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and Required Actions to which the RMTS (or RICT for TSTF-505 and HNP) will apply. x The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems and components (SSCs) subject to those LCO actions. x The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 10 CFR 50.46 emergency core cooling system (ECCS) flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided. This enclosure provides confirmation that Shearon Harris Nuclear Power Plant, Unit 1 (HNP) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope of TS LCOs. The enclosure also provides the information requested by Section 4.0, Item 2 of Reference 1. The comparison includes each of the TS LCOs and associated Required Actions within the scope of the RICT Program. The HNP PRA model has the capability to model directly, or using a bounding surrogate, the risk impact of entering each of the Actions associated with the TS LCOs that are in the scope of the RICT Program.

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 Table E1-1 below lists each HNP TS Action to which the RICT Program is proposed to be applied. The table also documents the following information regarding the TS with the associated safety analyses, the analogous PRA functions and the results of the comparison: x Column Technical Specification Statement: Lists the LCOs within the scope of the proposed RICT Program x Column Action: Lists the corresponding Action currently in the HNP TS x Column Corresponding SSC(s): Lists the SSCs addressed by each TS Action x Column Function Covered by LCO: Lists the required functions from the design basis analyses x Column Design Success Criteria: Contains a summary of the success criteria from the design basis analyses x Column SSCs Modeled in the PRA: Indicates whether the SSCs addressed by the TS LCO and Action are included in the PRA x Column PRA Success Criteria: Lists the functions success criteria in the PRA model x Column Comments: Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO Action can be evaluated using appropriate surrogate events in the PRA model. Differences in the success criteria for TS functions are addressed to demonstrate PRA criteria provide a realistic estimate of the risk of the TS LCOs and Actions as required by Reference 2. The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA models. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT Program. Differences in success criteria typically arise due to the requirement in the ASME/ANS PRA Standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to Capability Category II of the ASME/ANS PRA Standard as required by NEI 06-09-A (Reference 2). Examples of calculated RICTs are provided in Table E1-2 for each individual Action to which the RICT Program is proposed to apply. These calculations assume the SSC in question is the only SSC out-of-service, and thus the values in Table E1-2 are representative examples only. Following RICT Program implementation, RICT calculations will be based upon the actual real-time maintenance configuration of the plant and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A (Reference 2) and the NRC Safety Evaluation. Thus, in practice, RICT values may differ from the RICTs presented in Table E1-2. For the purposes of the following information, the terms subsystem, train, and division are all considered interchangeable.

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.1.2.2 With only one of the above x Flow path from Negative reactivity 1 of 3 flow paths SAME SSCs are modeled Boron Injection required boron injection flow boric acid tank via control consistently with the Flow Paths - paths to the RCS OPERABLE, boric acid transfer TS scope and so can Operating restore at least two boron pump and be directly evaluated injection flow paths to the RCS Charging/Safety by the Configuration to OPERABLE status within 72 Injection pump to Risk Management hours or be in at least HOT the RCS (CRM) Tool. STANDBY and borated to a x 2 flow paths from SHUTDOWN MARGIN as RWST via YES The success criteria specified in the CORE charging/Safety in the PRA are OPERATING LIMITS REPORT Injection pumps to consistent with the (COLR) at 200°F within the next the RCS design basis criteria. 6 hours; restore at least two flow paths to OPERABLE status This Action is within the next 7 days or be in bounded by TS 3.5.2, HOT SHUTDOWN within the below. next 6 hours. 3.1.2.4 With only one charging/safety x 2 Charging/Safety Negative reactivity 1 of 2 pumps SAME SSCs are modeled Charging Pumps - injection pump OPERABLE, Injection pumps control consistently with the Operating restore at least two TS scope and so can charging/safety injection be directly evaluated pumps to OPERABLE status by the CRM tool. within 72 hours* or be in at least HOT STANDBY and The success criteria borated to a SHUTDOWN in the PRA are MARGIN as specified in the consistent with the YES CORE OPERATING LIMITS design basis criteria. REPORT (COLR) at 200°F within the next 6 hours; This Action is restore at least two bounded by TS 3.5.2, charging/safety injection below. pumps to OPERABLE status within the next 7 days or be in HOT SHUTDOWN within the next 6 hours.

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 2 channels Initiate reactor trip 1 channel See Note 1 See Note 1. Functional Unit 1 channels one less than the upon manual actuation Action 1 Minimum Channels OPERABLE The operator action Manual Reactor requirement, restore the for failure to actuate a Trip (MODES 1 inoperable channel to manual reactor trip and 2) I OPERABLE status within 48 NOT will be used as a hours or be in HOT STANDBY EXPLICITLY surrogate to within the next 6 hours. conservatively bound the risk increase associated with this function as permitted by NEI 06-09.

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 4 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 2.a channels one less than the when monitored Action 2 Total Number of Channels, parameter reaches Power Range STARTUP and/or POWER setpoint Neutron Flux - OPERATION may proceed High I provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance NOT testing of other channels EXPLICITLY per Specification 4.3.1.1, (see Note 2) and

c. Either, THERMAL POWER is restricted to less than or equal to 75%

of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours; or, the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 4 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 2.b channels one less than the when monitored Action 2 Total Number of Channels, parameter reaches Power Range STARTUP and/or POWER setpoint Neutron Flux - Low OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance NOT testing of other channels EXPLICITLY per Specification 4.3.1.1, (see Note 2) and

c. Either, THERMAL POWER is restricted to less than or equal to 75%

of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours; or, the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 4 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 3 channels one less than the when monitored Action 2 Total Number of Channels, parameter reaches Power Range STARTUP and/or POWER setpoint Neutron Flux Rate OPERATION may proceed - High Positive provided the following Rate I conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance NOT testing of other channels EXPLICITLY per Specification 4.3.1.1, (see Note 2) and

c. Either, THERMAL POWER is restricted to less than or equal to 75%

of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours; or, the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 7 channels one less than the when monitored Action 6 Total Number of Channels, parameter reaches Overtemperature STARTUP and/or POWER setpoint 7 I OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 8 channels one less than the when monitored Action 6 Total Number of Channels, parameter reaches 2YHUSRZHU7 STARTUP and/or POWER setpoint OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 10 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 9 channels one less than the when monitored Action 6 Total Number of Channels, parameter reaches Pressurizer STARTUP and/or POWER setpoint Pressure (Low) OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 10 channels one less than the when monitored Action 6 Total Number of Channels, parameter reaches Pressurizer STARTUP and/or POWER setpoint Pressure (High) OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 11 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit 11 channels one less than the when monitored Action 6 Total Number of Channels, parameter reaches Pressurizer Water STARTUP and/or POWER setpoint Level - High OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 3 channels per Initiate reactor trip 2 channels per loop in See Note 2 See Note 2. Functional Unit channels one less than the loop when monitored any operating loop 12.a Total Number of Channels, parameter reaches Action 6 STARTUP and/or POWER setpoint Reactor Coolant OPERATION may proceed Flow - Low Single provided the following Loop I conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 12 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 2 channels per Initiate reactor trip 2 channels per train See Note 2 See Note 2. Functional Unit 15 channels one less than the pump when monitored Action 6 Total Number of Channels, parameter reaches Undervoltage STARTUP and/or POWER setpoint RCPs I OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 2 channels per Initiate reactor trip 2 channels per train See Note 2 See Note 2. Functional Unit 16 channels one less than the pump when monitored Action 6 Total Number of Channels, parameter reaches Underfrequency STARTUP and/or POWER setpoint RCPs I OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 13 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 3 channels per Initiate reactor trip 2 channels per steam See Note 2 See Note 2. Functional Unit 13 channels one less than the steam generator when monitored generator in any Action 6 Total Number of Channels, parameter reaches operating steam Steam Generator STARTUP and/or POWER setpoint generator (SG) Water Level - OPERATION may proceed Low Low I provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 2 steam generator Initiate reactor trip 1 steam generator See Note 2 See Note 2. Functional Unit 14 channels one less than the level channels and when monitored level coincident with 1 Action 6 Total Number of Channels, 2 steam/feedwater parameter reaches steam/ feedwater flow SG Water Level - STARTUP and/or POWER flow mismatch setpoint mismatch in same Low Coincident w/ OPERATION may proceed channels per steam generator Steam/Feedwater provided the following steam generator Flow Mismatch conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 14 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With the number of OPERABLE x 3 channels Initiate reactor trip 2 channels See Note 2 See Note 2. Functional Unit channels one less than the when monitored 17.a Total Number of Channels, parameter reaches Action 6 STARTUP and/or POWER setpoint Turbine Trip (Low OPERATION may proceed Fluid Oil Pressure) provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see Note 2)

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

3.3.1 With the number of OPERABLE x 2 channels Initiate reactor trip 1 channel See Note 2 See Note 2. Functional Unit 18 channels one less than the when monitored Action 13 Minimum Channels OPERABLE parameter reaches Safety Injection requirement, restore the setpoint (SI) Input from inoperable channel to ESFAS OPERABLE status within 6 I NOT hours or be in at least HOT EXPLICITLY STANDBY within the next 6 (see Note 2) hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.1.1, provided the other channel is OPERABLE.

U.S. Nuclear Regulatory Commission Page 15 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.1 With one of the diverse trip x 2 channels Initiate reactor trip 1 channel See Note 2 See Note 2 Functional Unit 20 features (undervoltage or shunt when monitored Action 11 trip attachment) inoperable, parameter reaches Reactor Trip restore it to OPERABLE status setpoint Breakers (RTBs) within 48 hours or declare the (MODES 1 & 2) breaker inoperable and apply NOT ACTION 8. The breaker shall EXPLICITLY not be bypassed while one of (see Note 2) the diverse trip features is inoperable except for the time required for performing maintenance to restore the breaker to OPERABLE status. 3.3.1 With the number of OPERABLE x 2 channels Initiate reactor trip 1 channel See Note 2 See Note 2 Functional Unit 21 channels one less than the when monitored Action 13 Minimum Channels OPERABLE parameter reaches Automatic Trip and requirement, restore the setpoint Interlock Logic inoperable channel to (MODES 1 & 2) OPERABLE status within 6 NOT hours or be in at least HOT EXPLICITLY STANDBY within the next 6 (see Note 2) hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.1.1, provided the other channel is OPERABLE. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME; while manual The operator action Functional Unit 1.a channels one less than the action when monitored actuation circuitry is for failure to actuate a Action 18 Minimum Channels OPERABLE parameter reaches not explicitly manual SI will be Safety Injection requirement, restore the setpoint modeled, the used as a surrogate NOT (Manual Initiation) inoperable channel to bounding event of to conservatively EXPLICITLY OPERABLE status within 48 operators manually bound the risk (see hours or be in at least HOT actuating the system increase associated Comments) STANDBY within the next 6 is modeled. with this function as hours and in COLD permitted by NEI 06-SHUTDOWN within the 09. following 30 hours.

U.S. Nuclear Regulatory Commission Page 16 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME SSCs are modeled Functional Unit 1.b channels one less than the action when monitored consistently with the Action 14 Minimum Channels OPERABLE parameter reaches TS scope and can be Safety Injection requirement, restore the setpoint directly evaluated by (Automatic inoperable channel to the CRM tool. Actuation Logic OPERABLE status within 6 and Actuation hours or be in at least HOT The success criteria Relays) STANDBY within the next 6 in the PRA are I YES hours and in COLD consistent with the SHUTDOWN within the design basis criteria. following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE. 3.3.2 With the number of OPERABLE x 3 channels Initiate associated 2 channels SAME; while SSCs are not Functional Unit 1.c channels one less than the action when monitored individual modeled explicitly for Action 19 Total Number of Channels, parameter reaches instruments are not this function; they are Safety Injection operation may proceed setpoint modeled for this instead bounded (Containment provided the following particular functional conservatively, with Pressure - High 1) conditions are satisfied: unit, the SI signal logically limiting

a. The inoperable channel is circuitry is modeled events, as permitted placed in the tripped NOT and used to by NEI 06-09.

condition within 6 hours, EXPLICITLY conservatively and (see bound the risk.

b. The Minimum Channels Comments)

OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

U.S. Nuclear Regulatory Commission Page 17 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 3 channels Initiate associated 2 channels SAME SSCs are modeled Functional Unit 1.d channels one less than the action when monitored consistently with the Action 19 Total Number of Channels, parameter reaches TS scope and can be Safety Injection operation may proceed setpoint directly evaluated by (Pressurizer provided the following the CRM tool. Pressure - Low) conditions are satisfied:

a. The inoperable channel is The success criteria placed in the tripped in the PRA are condition within 6 hours, consistent with the YES And design basis criteria.

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

3.3.2 With the number of OPERABLE x 3 channels per Initiate associated 2 channels per steam SAME; while These instruments Functional Unit 1.e channels one less than the steam line action when monitored line in any steam line individual are not modeled Action 19 Total Number of Channels, parameter reaches instruments are not explicitly for this Safety Injection operation may proceed setpoint modeled for this function; they are (Steam Line provided the following particular functional instead bounded Pressure - Low) conditions are satisfied: unit, the SI signal conservatively, with

a. The inoperable channel is circuitry is modeled logically limiting placed in the tripped NOT and used to events modeling the condition within 6 hours, EXPLICITLY conservatively SI signal actuation, And (see bound the risk. as permitted by NEI

b. The Minimum Channels Comments) 06-09.

OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

U.S. Nuclear Regulatory Commission Page 18 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel with 2 SAME; while manual The operator action Functional Unit 2.a channels one less than the action when monitored coincident switches actuation circuitry is for failure to actuate a Action 18 Minimum Channels OPERABLE parameter reaches not explicitly manual CS actuation Containment Spray requirement, restore the setpoint modeled, the signal will be used as NOT (Manual Initiation) inoperable channel to bounding event of a surrogate to EXPLICITLY OPERABLE status within 48 operators manually conservatively bound (see hours or be in at least HOT actuating the system the risk increase Comments) STANDBY within the next 6 is modeled. associated with this hours and in COLD function as permitted SHUTDOWN within the by NEI 06-09. following 30 hours. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME SSCs are modeled Functional Unit 2.b channels one less than the action when monitored consistently with the Action 14 Minimum Channels OPERABLE parameter reaches TS scope and can be Containment Spray requirement, restore the setpoint directly evaluated by (Automatic inoperable channel to the CRM tool. Actuation Logic OPERABLE status within 6 and Actuation hours or be in at least HOT The success criteria Relays) STANDBY within the next 6 in the PRA are I YES hours and in COLD consistent with the SHUTDOWN within the design basis criteria. following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME; while manual The operator action Functional Unit channels one less than the action when monitored actuation circuitry is for failure to manually 3.a.(1) Minimum Channels OPERABLE parameter reaches not explicitly close Phase A valves Action 18 requirement, restore the setpoint modeled, the will be used as a NOT Containment inoperable channel to bounding event of surrogate to EXPLICITLY Isolation (Phase A OPERABLE status within 48 operators manually conservatively bound (see Isolation - Manual hours or be in at least HOT actuating the system the risk increase Comments) Initiation) I STANDBY within the next 6 is modeled. associated with this hours and in COLD function as permitted SHUTDOWN within the by NEI 06-09. following 30 hours.

U.S. Nuclear Regulatory Commission Page 19 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME SSCs are modeled Functional Unit channels one less than the action when monitored consistently with the 3.a.(2) Minimum Channels OPERABLE parameter reaches TS scope and can be Action 14 requirement, restore the setpoint directly evaluated by Containment inoperable channel to the CRM tool. Isolation (Phase A OPERABLE status within 6 Isolation - hours or be in at least HOT The success criteria Automatic STANDBY within the next 6 in the PRA are YES Actuation Logic hours and in COLD consistent with the and Actuation SHUTDOWN within the design basis criteria. Relays) I following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME; while SSCs are not Functional Unit channels one less than the action when monitored individual modeled explicitly for 3.b.(2) Minimum Channels OPERABLE parameter reaches instruments are not this function; they are Action 14 requirement, restore the setpoint modeled for this instead bounded Containment inoperable channel to particular functional conservatively, with Isolation (Phase B OPERABLE status within 6 unit, the logic for a SSCs modeling the Isolation - hours or be in at least HOT NOT Containment Spray containment Hi-3 Automatic STANDBY within the next 6 EXPLICITLY actuation signal, signal, which Actuation Logic hours and in COLD (see which leads to a generates the Phase and Actuation SHUTDOWN within the Comments) Phase B signal, is B signal, as permitted Relays) I following 30 hours; however, modeled. by NEI 06-09. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE.

U.S. Nuclear Regulatory Commission Page 20 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel N/A This function is Functional Unit channels one less than the action when monitored conservatively 4.a.(2) Total Number of Channels, parameter reaches bounded by failure of NOT Action 22 restore the inoperable channel setpoint an MSIV to isolate a EXPLICITLY Main Steam Line to OPERABLE status within 48 steam line. (see Isolation (Manual hours or be in at least HOT Comments Initiation) I STANDBY within 6 hours and in at least HOT SHUTDOWN within the following 6 hours. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel N/A This function is Functional Unit 4.b channels one less than the action when monitored conservatively Action 14 Minimum Channels OPERABLE parameter reaches bounded by failure of Main Steam Line requirement, restore the setpoint an MSIV to isolate a Isolation I inoperable channel to steam line. (Automatic OPERABLE status within 6 Actuation Logic hours or be in at least HOT NOT and Actuation STANDBY within the next 6 EXPLICITLY Relays) I hours and in COLD (see SHUTDOWN within the Comments) following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE.

U.S. Nuclear Regulatory Commission Page 21 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 3 channels Initiate associated 2 channels N/A This function is Functional Unit 4.c channels one less than the action when monitored represented by a Action 19 Total Number of Channels, parameter reaches bounding surrogate Main Steam Line operation may proceed setpoint for actuation of Isolation I provided the following Containment Spray. (Containment conditions are satisfied: Pressure - High 2) a. The inoperable channel is placed in the tripped NOT condition within 6 hours, EXPLICITLY and (see

b. The Minimum Channels Comments)

OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel N/A This function is Functional Unit 5.a channels one less than the action when monitored modeled through a Action 24 Minimum Channels OPERABLE parameter reaches logical equivalent in Turbine Trip and requirement, restore the setpoint the PRA model that is Feedwater inoperable channel to conservatively Isolation I OPERABLE status within 6 NOT bounding. (Automatic hours or be in at least HOT EXPLICITLY Specifically, the Actuation Logic STANDBY within the next 6 (see function is modeled and Actuation hours; however, one channel Comments) as the failure of the Relays) I may be bypassed for up to 4 ESFAS system to hours for surveillance testing actuate a turbine trip per Specification 4.3.2.1 and Auxiliary provided the other channel is Feedwater. OPERABLE.

U.S. Nuclear Regulatory Commission Page 22 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 4 channels per Initiate associated 2 channels per steam N/A This function is Functional Unit 5.b channels one less than the steam generator action when monitored generator in any modeled through a Action 19 Total Number of Channels, parameter reaches steam generator logical equivalent in Turbine Trip and operation may proceed setpoint the PRA model that is Feedwater provided the following conservatively Isolation (SG conditions are satisfied: bounding. Water Level - High a. The inoperable channel is Specifically, the High) I placed in the tripped NOT function is modeled condition within 6 hours, EXPLICITLY as the failure of the And (see ESFAS system to

b. The Minimum Channels Comments) actuate a turbine trip OPERABLE requirement and Auxiliary is met; however, the Feedwater.

inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1. 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME SSCs are modeled Functional Unit 6.b channels one less than the action when monitored consistently with the Action 21 Minimum Channels OPERABLE parameter reaches TS scope and can be Auxiliary I requirement, restore the setpoint directly evaluated by Feedwater inoperable channel to the CRM tool. (Automatic OPERABLE status within 6 Actuation Logic hours or be in at least HOT The success criteria and Actuation STANDBY within the next 6 in the PRA are YES Relays (Solid State hours and in at least HOT consistent with the Protection SHUTDOWN within the design basis criteria. System)) I following 6 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE.

U.S. Nuclear Regulatory Commission Page 23 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 3 channels per Initiate associated 2 channels per steam SAME SSCs are modeled Functional Units channels one less than the steam generator action when monitored generator in any consistently with the 6.c.(1) and 6.c.(2) Total Number of Channels, parameter reaches steam generator TS scope and can be Action 19 operation may proceed setpoint directly evaluated by Auxiliary I provided the following the CRM tool. Feedwater (SG conditions are satisfied: Water Level - Low a. The inoperable channel is The success criteria Low) I placed in the tripped in the PRA are condition within 6 hours, consistent with the YES And design basis criteria.

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

3.3.2 With the number of OPERABLE x 1 channel per Initiate associated 1 channel per pump SAME; while SSCs are not Functional Unit 6.f channels one less than the pump action when monitored individual modeled explicitly for Action 15 Total Number of Channels, parameter reaches instruments are not this function; they are Auxiliary operation may proceed until setpoint modeled for this instead bounded I NOT Feedwater (Trip of performance of the next particular functional conservatively, with EXPLICITLY all Main Feedwater required CHANNEL unit, the logic for an SSCs modeling the (see Pumps) OPERATIONAL TEST provided AFW actuation auto-start AFW logic I Comments) the inoperable channel is signal is modeled for S/G level, as placed in the tripped condition and used to permitted by NEI 06-within 1 hour. conservatively 09. bound risk.

U.S. Nuclear Regulatory Commission Page 24 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.3.2 With the number of OPERABLE x 2 channels Initiate associated 1 channel SAME SSCs are modeled Functional Units channels one less than the action when monitored consistently with the 7.a and 8.a Minimum Channels OPERABLE parameter reaches TS scope and can be Action 14 requirement, restore the setpoint directly evaluated by Automatic inoperable channel to the CRM tool. Switchover to OPERABLE status within 6 Containment Sump hours or be in at least HOT The success criteria (Automatic STANDBY within the next 6 in the PRA are YES Actuation Logic hours and in COLD consistent with the and Actuation SHUTDOWN within the design basis criteria. Relays) I following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE. 3.4.4 b. With one or more PORV(s) x 3 PORVs (2 safety 1. Maintain pressure 1. 3 of 3 PORVs or 1. SAME SSCs are modeled Action b.1 inoperable due to causes grade, 1 non-safety boundary associated block 2. SAME consistently with the Power Operated other than excessive seat grade) 2. Maintain control of valves closed 3. SAME TS scope and can be Relief Valves leakage, within 1 hour x 3 PORV block RCS pressure for SG 2. 1 of 2 safety grade 4. SAME directly evaluated by (PORVs) I either restore the PORV(s) valves tube rupture PORVs and 5. SAME the CRM tool. to OPERABLE status or mitigation associated block close the associated block 3. Isolate stuck open valve manually The success criteria valve(s) and remove power PORV opened in the PRA are from the block valve(s), and 4. Isolate PORV with 3. Associated block consistent with the

1. With only one safety excessive seat valve manually design basis criteria.

grade PORV leakage closed YES OPERABLE, restore 5. Open block valve to 4. Associated block at least a total of two unisolate PORV for valve manually safety grade PORVs SG tube rupture closed to OPERABLE status mitigation 5. Associated block within the following 72 valve manually hours or be in at least opened HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

U.S. Nuclear Regulatory Commission Page 25 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.5.2 a. With one ECCS subsystem x 2 Charging/Safety 1. Limit peak cladding 1. 1 of 2 Charging/ 1. Small LOCA: 1 of 2 SSCs are modeled Action a inoperable, restore the Injection pumps temperatures within Safety Injection Charging/ Safety consistently with the ECCS - Operating inoperable subsystem to x 2 Residual Heat acceptable limits in pumps and 1 of 2 Injection pumps; TS scope and can be OPERABLE status within Removal pumps the event of a LOCA RHR pumps from Medium or Large directly evaluated by 72 hours or be in at least x 2 Residual Heat 2. Long term core RWST LOCA: 1 of 2 RHR the CRM tool. HOT STANDBY within the Removal heat cooling in 2. 1 of 2 RHR pumps pumps next 6 hours and in HOT exchangers recirculation mode and associated heat 2. SAME The success criteria SHUTDOWN within the x Flow path capable exchanger from differ from the design following 6 hours. of taking suction containment sump to basis criteria in not from the Refueling Charging/ Safety requiring a high-Water Storage Injection pump YES pressure pump for Tank on a Safety suction and RCS LOCAs where the Injection signal low-pressure pump is and, upon being injecting. Success manually aligned, criteria in PRA are transferring suction based on plant-to the containment specific realistic sump during the analyses consistent recirculation phase with the PRA of operation. standards for capability category II. 3.6.1.3 c. One or more containment x 2 containment Maintain containment 2 of 2 airlocks SAME SSCs are modeled Action c.3 air locks inoperable for airlocks integrity and leakage consistently with the Containment Air reasons other than within limits TS scope and can be Locks I 3.6.1.3.a or 3.6.1.3.b. directly evaluated by

3. Within 24 hours, the CRM tool.

restore air lock to OPERABLE status The PRA model for containment airlocks YES includes an event to address unavailability of one or both airlocks for containment integrity; this would be bounding for risk of an inoperable airlock and can be used as a bounding surrogate

U.S. Nuclear Regulatory Commission Page 26 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.6.3 a. Restore the inoperable x 2 active or passive Isolate containment 1 of 2 isolation devices SAME for: CS SSCs for containment Actions a, b, c valve(s) to OPERABLE isolation devices atmosphere from per penetration isolate additive tank line; isolation valves not in Containment status within 4 hours, or on each fluid outside environment within required stroke reactor cavity the PRA model can Isolation Valves b. Isolate each affected penetration line time equipment drain line; be evaluated by a penetration within 4 hours reactor coolant bounding assessment by use of at least one pump (RCP) seal as permitted by NEI deactivated automatic water return line. 06-09. The PRA valve secured in the model includes an isolation position, or All other event which involves

c. Isolate each affected penetrations a large, pre-existing penetration within 4 hours evaluated as not containment leak; this by use of at least one significant sources of would be bounding closed manual valve or fission product on risk on an blind flange leakage and are inoperable isolation screened. valve and can be used as a bounding NOT surrogate.

EXPLICITLY (see Comments) The PRA does not explicitly model the impact of excessive stroke time. This condition can be addressed for the RICT Program by conservatively assuming the inoperable containment isolation valve is not closable if open. Otherwise, the success criteria in the PRA are consistent with the design basis criteria.

U.S. Nuclear Regulatory Commission Page 27 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.6.2.1 With one Containment Spray x 2 Containment 1. Containment 1. 1 of 2 CS trains 1. SAME The SSCs in the TS Action System inoperable, restore the Spray trains depressurization and 2. 1 of 2 CS trains 2. Not modeled scope are modeled in (undesignated) inoperable Spray System to consisting of cooling following a the PRA. The iodine Containment Spray OPERABLE status within 72 pumps and flow LOCA or steam line removal function of and Cooling hours or be in at least HOT paths break the CS trains is not Systems I STANDBY within the next 6 2. Iodine removal from required for mitigation hours; restore the inoperable containment YES of severe accidents Spray System to OPERABLE atmosphere and is not modeled. status within the next 48 hours or be in COLD SHUTDOWN within the following 30 hours. Refer also to Specification 3.6.2.3 Action. 3.6.2.3 a. With one train of the above x 4 containment fan Containment heat 1 of 2 trains in 1 of 4 fan coolers in SSCs are modeled Action a required containment fan coolers; one train removal following a conjunction with 1 of 2 conjunction with 1 of consistent with the Containment Spray coolers inoperable and is comprised of two LOCA CS trains 2 CS trains, or 3 of 4 TS scope and can be and Cooling both Containment Spray containment fan fan coolers directly evaluated Systems I Systems OPERABLE, coolers using the CRM tool. restore the inoperable train of fan coolers to The success criteria OPERABLE status within 7 in the PRA are based days or be in at least HOT YES on realistic STANDBY within the next containment heat 6 hours and in COLD removal capabilities SHUTDOWN within the of the containment following 30 hours. cooling system consistent with the PRA standards for capability category II.

U.S. Nuclear Regulatory Commission Page 28 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.6.2.3 b. With both trains of the x 4 containment fan Containment heat 1 of 2 trains in 1 of 4 fan coolers in SSCs are modeled Action b above required coolers; one train removal following a conjunction with 1 of 2 conjunction with 1 of consistent with the Containment Spray containment fan coolers is comprised of two LOCA CS trains 2 CS trains, or 3 of 4 TS scope and can be and Cooling inoperable and both containment fan fan coolers directly evaluated Systems I Containment Spray coolers using the CRM tool. Systems OPERABLE, restore at least one train of The success criteria fan coolers to OPERABLE in the PRA are based status within 72 hours or on realistic be in at least HOT containment heat STANDBY within the next removal capabilities 6 hours and in COLD YES of the containment SHUTDOWN within the cooling system following 30 hours. Restore consistent with the both above required trains PRA standards for of fan coolers to capability category II. OPERABLE status within 7 days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.

U.S. Nuclear Regulatory Commission Page 29 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.6.2.3 c. With one train of the above x 4 containment fan Containment heat 1 of 2 trains in 1 of 4 fan coolers in SSCs are modeled Action c required containment fan coolers; one train removal following a conjunction with 1 of 2 conjunction with 1 of consistent with the Containment Spray coolers inoperable and one is comprised of two LOCA CS trains 2 CS trains, or 3 of 4 TS scope and can be and Cooling Containment Spray System containment fan fan coolers directly evaluated Systems I inoperable, restore the coolers using the CRM tool. inoperable Spray System x 2 Containment to OPERABLE status Spray trains The success criteria within 72 hours or be in at consisting of in the PRA are based least HOT STANDBY pumps and flow on realistic within the next 6 hours and paths containment heat in COLD SHUTDOWN removal capabilities YES within the following 30 of the containment hours. Restore the cooling system inoperable train of consistent with the containment fan coolers to PRA standards for OPERABLE status within 7 capability category II. days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. 3.7.1.5 MODE 1: x 3 Main Steam Ensure no more than MSIV on affected 3 of 3 Main Steam MSIV failure to close Action for MODE 1 With one MSIV inoperable Isolation Valves one SG blows down for steam line closes, or Isolation Valves is directly modeled. Main Steam but open, POWER steam line rupture remaining 2 MSIVs on close to isolate a Isolation Valves OPERATION may continue unaffected steam lines faulted Steam (MSIVs) I provided the inoperable close Generator valve is restored to YES OPERABLE status within 4 hours; otherwise be in HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours.

U.S. Nuclear Regulatory Commission Page 30 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.7.1.2 a. With one auxiliary x Two motor-driven 1. Cool down RCS to 1. 1 of 3 pumps 1. SAME SSCs are modeled Action a feedwater pump pumps less than 350F 2. 1 turbine-driven 2. SAME consistently with the Auxiliary inoperable, restore the x One steam turbine- 2. Decay heat removal pump 3. SAME TS scope and can be I I Feedwater (AFW) required auxiliary driven pump immediately following 3. 1 of 3 pumps directly evaluated by System feedwater pumps to station blackout event the CRM tool. OPERABLE status within 3. Mitigate loss of YES 72 hours or be in at least normal feedwater and The success criteria HOT STANDBY within the feedwater line break in the PRA are next 6 hours and in HOT accidents consistent with the SHUTDOWN within the design basis criteria. following 6 hours. 3.7.3 With only one component x Two pumps Cooling for continued 1 of 2 pumps, heat SAME SSCs are modeled Action cooling water flow path x Two heat operation of safety- exchangers, and consistently with the (undesignated) OPERABLE, restore at least exchangers related equipment essential flow paths TS scope and can be Component two flow paths to OPERABLE x Two essential flow directly evaluated by Cooling Water status within 72 hours or be in paths the CRM tool. (CCW) System at least HOT STANDBY within YES the next 6 hours and in COLD The success criteria SHUTDOWN within the in the PRA are following 30 hours. consistent with the design basis criteria. 3.7.4 With only one emergency x Two loops, each Cooling for continued 1 of 2 loops SAME SSCs are modeled Action service water loop OPERABLE, comprised of a operation of safety- consistently with the (undesignated) restore at least two loops to pump, a booster related equipment TS scope and can be Emergency OPERABLE status within 72 pump, and flow directly evaluated by Service Water hours or be in at least HOT paths from the the CRM tool. System (SWS) STANDBY within the next 6 YES intake structure hours and in COLD through essential The success criteria SHUTDOWN within the loads to the service in the PRA are following 30 hours. water discharge consistent with the design basis criteria.

U.S. Nuclear Regulatory Commission Page 31 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.7.13 With only one Essential x Two loops, each Cooling for continued 1 of 2 loops The PRA is modeled SSCs are modeled Action Services Chilled Water System comprised of a operation of safety- such that ESCWS is consistently with the (undesignated) loop OPERABLE, restore at chiller, pumps, and related equipment only required to cool TS scope and can be Essential Services least two loops to OPERABLE corresponding flow the switchgear directly evaluated by Chilled Water status within 72 hours or be in paths rooms and CSIP the CRM tool. System (ESCWS) at least HOT STANDBY within YES rooms and includes the next 6 hours and in COLD operator actions for The success criteria SHUTDOWN within the success in the event in the PRA are following 30 hours. of system failure. consistent with the design basis criteria. 3.8.1.1 a. With one offsite circuit of x Two offsite circuits Source of power to 1 of 2 trains from SAME SSCs are modeled Action a.2 3.8.1.1.a inoperable: x Two emergency safety-related systems either offsite circuit or consistently with the AC Sources - 2. Restore the offsite diesel generators EDG TS scope and can be Operating circuit to OPERABLE (EDGs) directly evaluated by status within 72 hours x Two automatic the CRM tool. or be in at least HOT load sequencers YES STANDBY within the The success criteria next 6 hours and in in the PRA are COLD SHUTDOWN consistent with the within the following design basis criteria. 30 hours 3.8.1.1 b. With one diesel generator x Two offsite circuits Source of power to 1 of 2 trains from SAME SSCs are modeled Action b.3 of 3.8.1.1.b inoperable: x Two emergency safety-related systems either offsite circuit or consistently with the AC Sources - 3. Restore the diesel diesel generators EDG TS scope and can be Operating generator to (EDGs) directly evaluated by OPERABLE status x Two automatic the CRM tool. within 72 hours or be load sequencers YES in at least HOT The success criteria STANDBY within the in the PRA are next 6 hours and in consistent with the COLD SHUTDOWN design basis criteria. within the following 30 hours

U.S. Nuclear Regulatory Commission Page 32 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.8.1.1 d. With two of the required x Two offsite circuits Source of power to 1 of 2 trains from SAME SSCs are modeled Action d.1 offsite A.C. sources x Two emergency safety-related systems either offsite circuit or consistently with the AC Sources - inoperable: diesel generators EDG TS scope and can be Operating 1. Restore one offsite x Two automatic directly evaluated by circuit to OPERABLE load sequencers the CRM tool. status within 24 hours YES or be in at least HOT The success criteria STANDBY within the in the PRA are next 6 hours and in consistent with the COLD SHUTDOWN design basis criteria. within the following 30 hours: 3.8.1.1 c. With one offsite circuit and x Two offsite circuits Source of power to 1 of 2 trains from SAME SSCs are modeled Action c.1 one diesel generator of x Two emergency safety-related systems either offsite circuit or consistently with the AC Sources - 3.8.1.1 inoperable: diesel generators EDG TS scope and can be Operating 1. Restore one of the x Two automatic directly evaluated by inoperable A.C. load sequencers the CRM tool. sources to OPERABLE status The success criteria YES within 12 hours or be in the PRA are in at least HOT consistent with the STANDBY within the design basis criteria. next 6 hours and in COLD SHUTDOWN within the following 30 hours. 3.8.1.1 h. With one automatic load x Two offsite circuits Source of power to 1 of 2 trains from SAME SSCs are modeled Action h.1 sequencer inoperable: x Two emergency safety-related systems either offsite circuit or consistently with the AC Sources - 1. Restore the diesel generators EDG TS scope and can be Operating automatic load x Two automatic directly evaluated by sequencer to load sequencers the CRM tool. OPERABLE status within 24 hours or be YES The success criteria in at least HOT in the PRA are STANDBY within the consistent with the next 6 hours and design basis criteria. COLD SHUTDOWN within the following 30 hours.

U.S. Nuclear Regulatory Commission Page 33 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.8.2.1 With one of the required D.C. 2 trains, comprised of: Source of power to 1 of 2 trains SAME SSCs are modeled Action electrical sources inoperable, x Two emergency safety-related systems consistently with the (undesignated) restore the inoperable D.C. battery banks TS scope and can be DC Sources - electrical source to OPERABLE x Four full capacity directly evaluated by Operating status within 2 hours or be in at chargers the CRM tool. least HOT STANDBY within the YES next 6 hours and in COLD The success criteria SHUTDOWN within the in the PRA are following 30 hours. consistent with the design basis criteria. 3.8.3.1 c. With one 118-volt A.C. vital x Two divisions of Source of power to 1 of 2 trains SAME SSCs are modeled Action c bus not energized from its AC buses, each safety-related systems consistently with the Onsite Power associated inverter comprised of a TS scope and can be Distribution connected to its associated 6900V bus and two directly evaluated by Operating D.C. bus, re-energize the 480V buses the CRM tool. 118-volt A.C. vital bus x Four vital AC through its associated buses with The success criteria YES inverter connected to its associated in the PRA are associated D.C. bus within inverters consistent with the 24 hours or be in at least x Two DC buses and design basis criteria. HOT STANDBY within the associated next 6 hours and in COLD batteries SHUTDOWN within the following 30 hours. 3.8.3.1 a. With one of the required x Two divisions of Source of power to 1 of 2 trains SAME SSCs are modeled Action a divisions of A.C. ESF AC buses, each safety-related systems consistently with the Onsite Power buses not fully energized, comprised of a TS scope and can be Distribution reenergize the division 6900V bus and two directly evaluated by Operating within 8 hours or be in at 480V buses the CRM tool. least HOT STANDBY x Four vital AC within the next 6 hours and YES buses with The success criteria in COLD SHUTDOWN associated in the PRA are within the following 30 inverters consistent with the hours. x Two DC buses and design basis criteria. associated batteries

U.S. Nuclear Regulatory Commission Page 34 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCOS TO CORRESPONDING PRA FUNCTIONS SSCs Technical Function Covered by Design Success PRA Success Action Corresponding SSC(s) Modeled in Comments Specification LCO Criteria Criteria PRA 3.8.3.1 b. With one 118-volt A.C. vital x Two divisions of Source of power to 1 of 2 trains SAME SSCs are modeled Action b bus not energized from its AC buses, each safety-related systems consistently with the Onsite Power associated inverter, comprised of a TS scope and can be Distribution reenergize the 118-volt 6900V bus and two directly evaluated by Operating A.C. vital bus within 2 480V buses the CRM tool. hours or be in at least HOT x Four vital AC STANDBY within the next YES buses with The success criteria 6 hours and in COLD associated in the PRA are SHUTDOWN within the inverters consistent with the following 30 hours. x Two DC buses and design basis criteria. associated batteries 3.8.3.1 d. With either 125-volt D.C. x Two divisions of Source of power to 1 of 2 trains SAME SSCs are modeled Action d bus 1A-SA or 1B-SB not AC buses, each safety-related systems consistently with the Onsite Power energized from its comprised of a TS scope and can be Distribution associated Emergency 6900V bus and two directly evaluated by Operating Battery, reenergize the 480V buses the CRM tool. D.C. bus from its x Four vital AC associated Emergency buses with YES The success criteria Battery within 2 hours or be associated in the PRA are in at least HOT STANDBY inverters consistent with the within the next 6 hours and x Two DC buses and design basis criteria. in COLD SHUTDOWN associated within the following 30 batteries hours.

U.S. Nuclear Regulatory Commission Page 35 Serial: RA-19-0001 Table E1-1 Notes: Note 1: The reactor trip function is assumed successful in the fire PRA which is consistent with NUREG/CR-6850 and satisfies the PRA standard at capability category II. This is acceptable since implementation of a RICT requires that all RTS Functional Units and at least one SSPS train remain functional such that the reactor trip capability will be available, consistent with the assumption in the fire PRA. Note 2: Individual RTS instrumentation channels input to the automatic RTS functions will be evaluated using a bounding method as permitted by NEI 06-09. Two or more diverse signals are generated for any initiating event, and so the failure probability of the automatic RTS function is typically dominated by failure of the common non-instrumentation components in the RTS system. The PRA logic addresses failure of the automatic trip function when two of two generic RTS signals fail to actuate using a model based on NUREG/CR-5500 (Reference 2.3). This reference conservatively assumes any initiating event only results in two reactor trip signals. For the RICT Program, 1) any inoperability of one channel of any RTS functional unit will conservatively be assumed to result in unavailability of that signal as an input to the automatic RTS function; 2) the risk for one inoperable instrument channel for one RTS functional unit will be evaluated assuming that one of the two generic RTS signals is unavailable, and conservatively crediting only one remaining signal for automatic reactor trip for all initiating events; 3) if two or more RTS functional units have inoperable instrument channels, then no credit will be taken for the automatic RTS function by assuming unavailability of both generic RTS signal inputs. It is conservative because 1) inoperability of any single instrument channel for any RTS function is evaluated as causing the loss of that RTS function even if the remaining channels would actuate a reactor trip; 2) inoperability of any RTS signal is assumed to impact mitigation of all transient and accident conditions, even though only a subset of all initiating events would be impacted; and 3) no credit is taken for automatic RTS actuation for more than two RTS signals for any initiating event. Note 3: The HNP Fire PRA model does not credit containment sprays or containment fan coolers.

U.S. Nuclear Regulatory Commission Page 36 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 Flow Paths - Operating With only one of the above required boron injection flow paths to the RCS OPERABLE, restore at least two boron injection flow paths to 3.1.2.2 Action the RCS to OPERABLE status within 72 hours or be in at least HOT STANDBY and borated to a SHUTDOWN MARGIN as specified in 30.0 the CORE OPERATING LIMITS REPORT (COLR) at 200°F within the next 6 hours; restore at least two flow paths to OPERABLE status within the next 7 days or be in HOT SHUTDOWN within the next 6 hours. Charging Pumps - Operating With only one charging/safety injection pump OPERABLE, restore at least two charging/safety injection pumps to OPERABLE status 3.1.2.4 Action within 72 hours or be in at least HOT STANDBY and borated to a SHUTDOWN MARGIN as specified in the CORE OPERATING 30.0 LIMITS REPORT (COLR) at 200°F within the next 6 hours; restore at least two charging/safety injection pumps to OPERABLE status within the next 7 days or be in HOT SHUTDOWN within the next 6 hours. Manual Reactor Trip (MODES 1 and With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable

2) channel to OPERABLE status within 48 hours or be in HOT STANDBY within the next 6 hours. 30.0 I

3.3.1 Functional Unit 1 Action 1 Power Range Neutron Flux - High With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 2.a Action 2 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for 30.0 surveillance testing of other channels per Specification 4.3.1.1, and

c. Either, THERMAL POWER is restricted to less than or equal to 75% of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours, or. the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

Power Range Neutron Flux - Low With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 2.b Action 2 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however. the inoperable channel may be bypassed for up to 4 hours for 30.0 surveillance testing of other channels per Specification 4.3.1.1, and

c. Either, THERMAL POWER is restricted to less than or equal to 75% of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours; or, the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

Power Range Neutron Flux Rate - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may High Positive Rate proceed provided the following conditions are satisfied: 3.3.1 Functional Unit 3 Action 2 a. The inoperable channel is placed in the tripped condition within 6 hours,

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for 30.0 surveillance testing of other channels per Specification 4.3.1.1, and

c. Either, THERMAL POWER is restricted to less than or equal to 75% of RATED THERMAL POWER and the Power Range Neutron Flux Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours; or, the QUADRANT POWER TILT RATIO is monitored at least once per 12 hours per Specification 4.2.4.2.

2YHUWHPSHUDWXUH7 With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 7 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 37 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 2YHUSRZHU7 With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 8 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Pressurizer Pressure (Low) With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 9 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Pressurizer Pressure (High) With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 10 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Pressurizer Water Level - High With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 11 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Reactor Coolant Flow - Low Single With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may Loop proceed provided the following conditions are satisfied: I 3.3.1 Functional Unit 12.a Action 6 a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Undervoltage RCPs With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 15 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Underfrequency RCPs With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 16 Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Steam Generator (SG) Water Level - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may Low Low proceed provided the following conditions are satisfied: 3.3.1 Functional Unit 13 Action 6 a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

U.S. Nuclear Regulatory Commission Page 38 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 SG Water Level - Low Coincident w/ With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may Steam/ Feedwater Flow Mismatch proceed provided the following conditions are satisfied: 3.3.1 Functional Unit 14 Action 6 a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Turbine Trip (Low Fluid Oil Pressure) With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may 3.3.1 Functional Unit 17.a Action 6 proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.1.1.

Safety Injection (SI) Input from With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable ESFAS channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours; however, one channel may be 30.0 I 3.3.1 Functional Unit 18 Action 13 bypassed for up to 4 hours for surveillance testing per Specification 4.3.1.1, provided the other channel is OPERABLE. Reactor Trip Breakers Undervoltage With one of the diverse trip features (undervoltage or shunt trip attachment) inoperable, restore it to OPERABLE status within 48 hours and Shunt Trip or declare the breaker inoperable and apply ACTION 8. The breaker shall not be bypassed while one of the diverse trip features is Mechanisms (MODES inoperable except for the time required for performing maintenance to restore the breaker to OPERABLE status. 30.0 I 1 & 2) 3.3.1 Functional Unit 20 Action 11 Automatic Trip and Interlock Logic With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable (MODES 1 & 2) channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours; however, one channel may be 30.0 3.3.1 Functional Unit 21 Action 13 bypassed for up to 4 hours for surveillance testing per Specification 4.3.1.1, provided the other channel is OPERABLE. Safety Injection (Manual Initiation) With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable 3.3.2 Functional Unit 1.a Action 18 channel to OPERABLE status within 48 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 30.0 the following 30 hours. Safety Injection (Automatic Actuation With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable Logic and Actuation Relays) channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 30.0 3.3.2 Functional Unit 1.b Action 14 the following 30 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1. provided the other channel is OPERABLE. Safety Injection (Containment With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the following Pressure - High 1) conditions are satisfied: 3.3.2 Functional Unit 1.c Action 19 a. The inoperable channel is placed in the tripped condition within 6 hours, And 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

Safety Injection (Pressurizer Pressure With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the following

                - Low)                  conditions are satisfied:

I 3.3.2 Functional Unit 1.d Action 19 a. The inoperable channel is placed in the tripped condition within 6 hours, And 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

U.S. Nuclear Regulatory Commission Page 39 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 Safety Injection (Steam Line Pressure With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the following

                - Low)                   conditions are satisfied:

I 3.3.2 Functional Unit 1.e Action 19 a. The inoperable channel is placed in the tripped condition within 6 hours, And 30.0

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

Containment Spray (Manual Initiation) With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable 3.3.2 Functional Unit 2.a Action 18 channel to OPERABLE status within 48 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 30.0 the following 30 hours. Containment Spray (Automatic With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Actuation Logic and Actuation Relays) channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 30.0 3.3.2 Functional Unit 2.b Action 14 the following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE. Containment Isolation (Phase A With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Isolation - Manual Initiation) channel to OPERABLE status within 48 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 30.0 3.3.2 Functional Unit 3.a.(1) Action 18 the following 30 hours. Containment Isolation (Phase A With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Isolation - Automatic Actuation Logic channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, 30.0 and Actuation Relays) 3.3.2 Functional Unit 3.a.(2) Action 14 provided the other channel is OPERABLE. Containment Isolation (Phase B With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Isolation - Automatic Actuation Logic channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1, 30.0 and Actuation Relays) 3.3.2 Functional Unit 3.b.(2) Action 14 provided the other channel is OPERABLE. Main Steam Line Isolation (Manual With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE Initiation) status within 48 hours or be in at least HOT STANDBY within 6 hours and in at least HOT SHUTDOWN within the following 6 hours. 6.0 3.3.2 Functional Unit 4.a.(2) Action 22 Main Steam Line Isolation (Automatic With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Actuation Logic and Actuation Relays) channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within 6.0 3.3.2 Functional Unit 4.b Action 14 the following 30 hours; however, one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1. provided the other channel is OPERABLE. Main Steam Line Isolation With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the following (Containment conditions are satisfied: Pressure - High 2) a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0 3.3.2 Functional Unit 4.c Action 19 b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

U.S. Nuclear Regulatory Commission Page 40 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 Turbine Trip and Feedwater Isolation With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable (Automatic Actuation Logic and channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE. 30.0 Actuation Relays) 3.3.2 Functional Unit 5.a Action 24 Turbine Trip and Feedwater Isolation With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the following (SG Water Level - High High) conditions are satisfied: 3.3.2 Functional Unit 5.b Action 19 a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0

b. The Minimum Channels OPERABLE requirement is met; however. the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1.

Auxiliary Feedwater (Automatic With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable Actuation Logic and Actuation Relays channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in at least HOT SHUTDOWN within the following 6 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1 30.0 (Solid State Protection System)) 3.3.2 Functional Unit 6.b Action 21 provided the other channel is OPERABLE. Auxiliary Feedwater (SG Water Level With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed provided the following

                - Low Low)           conditions are satisfied:

3.3.2 Functional Units 6.c.(1) and a. The inoperable channel is placed in the tripped condition within 6 hours, and 30.0 6.c.(2) Action 19 b. The Minimum Channels OPERABLE requirement is met; however. the inoperable channel may be bypassed for up to 4 hours for surveillance testing of other channels per Specification 4.3.2.1. Auxiliary Feedwater (Trip of all Main With the number of OPERABLE channels one less than the Total Number of Channels. operation may proceed until performance of the Feedwater Pumps) next required CHANNEL OPERATIONAL TEST provided the inoperable channel is placed in the tripped condition within 1 hour. 30.0 3.3.2 Functional Unit 6.f Action 15 Automatic Switchover to Containment With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement. restore the inoperable Sump (Automatic Actuation Logic and channel to OPERABLE status within 6 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within Actuation Relays) the following 30 hours; however. one channel may be bypassed for up to 4 hours for surveillance testing per Specification 4.3.2.1. 30.0 3.3.2 Functional Units 7.a and 8.a provided the other channel is OPERABLE. Action 14 Power Operated Relief Valves b. With one or more PORV(s) inoperable due to causes other than excessive seat leakage. within 1 hour either restore the PORV(s) to (PORVs) OPERABLE status or close the associated block valve(s) and remove power from the block valve(s), and 3.4.4 Action b.1 1. With only one safety grade PORV OPERABLE. restore at least a total of two safety grade PORVs to OPERABLE status within 30.0 the following 72 hours or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. ECCS - Operating a. With one ECCS subsystem inoperable, restore the inoperable subsystem to OPERABLE status within 72 hours or be in at least 3.5.2 Action a, 3.1.2.2 Action, and HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. 30.0 3.1.2.4 Action Containment Air Locks c. One or more containment air locks inoperable for reasons other than 3.6.1.3.a or 3.6.1.3.b.

3. Within 24 hours, restore air lock to OPERABLE status 15.6 3.6.1.3 Action c.3

U.S. Nuclear Regulatory Commission Page 41 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 Containment Isolation Valves a. Restore the inoperable valve(s) to OPERABLE status within 4 hours, or 3.6.3 Actions a, b, c b. Isolate each affected penetration within 4 hours by use of at least one deactivated automatic valve secured in the isolation position, 15.6 or

c. Isolate each affected penetration within 4 hours by use of at least one closed manual valve or blind flange Containment Spray and Cooling With one Containment Spray System inoperable, restore the inoperable Spray System to OPERABLE status within 72 hours or be in at Systems least HOT STANDBY within the next 6 hours; restore the inoperable Spray System to OPERABLE status within the next 48 hours or be 30.0 3.6.2.1 Action in COLD SHUTDOWN within the following 30 hours. Refer also to Specification 3.6.2.3 Action.

Containment Spray and Cooling a. With one train of the above required containment fan coolers inoperable and both Containment Spray Systems OPERABLE, Systems restore the inoperable train of fan coolers to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 30.0 3.6.2.3 Action a hours and in COLD SHUTDOWN within the following 30 hours. Containment Spray and Cooling b. With both trains of the above required containment fan coolers inoperable and both Containment Spray Systems OPERABLE, Systems restore at least one train of fan coolers to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 3.6.2.3 Action b hours and in COLD SHUTDOWN within the following 30 hours. Restore both above required trains of fan coolers to OPERABLE 30.0 status within 7 days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. Containment Spray and Cooling c. With one train of the above required containment fan coolers inoperable and one Containment Spray System inoperable, restore Systems the inoperable Spray System to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in 3.6.2.3 Action c COLD SHUTDOWN within the following 30 hours. Restore the inoperable train of containment fan coolers to OPERABLE status 30.0 within 7 days of initial loss or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. Main Steam Isolation Valves (MSIVs) MODE 1: 3.7.1.5 Action for MODE 1 With one MSIV inoperable but open, POWER OPERATION may continue provided the inoperable valve is restored to OPERABLE 6.0 status within 4 hours; otherwise be in HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. Auxiliary Feedwater (AFW) System a. With one auxiliary feedwater pump inoperable, restore the required auxiliary feedwater pumps to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 6 hours. 24.8 3.7.1.2 Action a Component Cooling Water (CCW) With only one component cooling water flow path OPERABLE, restore at least two flow paths to OPERABLE status within 72 hours or System be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. 30.0 3.7.3 Action I Emergency Service Water System With only one emergency service water loop OPERABLE, restore at least two loops to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. 29.7 3.7.4 Action Essential Services Chilled Water With only one Essential Services Chilled Water System loop OPERABLE, restore at least two loops to OPERABLE status within 72 System (ESCWS) hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. 30.0 3.7.13 Action AC Sources - Operating a. With one offsite circuit of 3.8.1.1.a inoperable: 3.8.1.1 Action a.2 2. Restore the offsite circuit to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours and in 8.9 COLD SHUTDOWN within the following 30 hours

U.S. Nuclear Regulatory Commission Page 42 Serial: RA-19-0001 TABLE E1 IN-SCOPE TS LCO RICT ESTIMATES RICT Technical Specification Technical Specification Action Estimate (days)2 AC Sources - Operating b. With one diesel generator of 3.8.1.1.b inoperable: 3.8.1.1 Action b.3 3. Restore the diesel generator to OPERABLE status within 72 hours or be in at least HOT STANDBY within the next 6 hours 30.0 and in COLD SHUTDOWN within the following 30 hours AC Sources - Operating d. With two of the required offsite A.C. sources inoperable: 3.8.1.1 Action d.1 1. Restore one offsite circuit to OPERABLE status within 24 hours or be in at least HOT STANDBY within the next 6 hours and in 5.0 COLD SHUTDOWN within the following 30 hours: AC Sources - Operating c. With one offsite circuit and one diesel generator of 3.8.1.1 inoperable: 3.8.1.1 Action c.1 1. Restore one of the inoperable A.C. sources to OPERABLE status within 12 hours or be in at least HOT STANDBY within the N/A1 next 6 hours and in COLD SHUTDOWN within the following 30 hours. AC Sources - Operating h. With one automatic load sequencer inoperable: 3.8.1.1 Action h.1 1. Restore the automatic load sequencer to OPERABLE status within 24 hours or be in at least HOT STANDBY within the next 6 30.0 hours and COLD SHUTDOWN within the following 30 hours. DC Sources - Operating With one of the required D.C. electrical sources inoperable, restore the inoperable D.C. electrical source to OPERABLE status within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. N/A1, 3 3.8.2.1 Action Onsite Power Distribution Operating c. With one 118-volt A.C. vital bus not energized from its associated inverter connected to its associated D.C. bus, re-energize the 3.8.3.1 Action c 118-volt A.C. vital bus through its associated inverter connected to its associated D.C. bus within 24 hours or be in at least HOT 30.0 STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. Onsite Power Distribution Operating a. With one of the required divisions of A.C. ESF buses not fully energized, reenergize the division within 8 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. N/A1 3.8.3.1 Action a Onsite Power Distribution Operating b. With one 118-volt A.C. vital bus not energized from its associated inverter, reenergize the 118-volt A.C. vital bus within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. N/A1 3.8.3.1 Action b Onsite Power Distribution Operating d. With either 125-volt D.C. bus 1A-SA or 1B-SB not energized from its associated Emergency Battery, reenergize the D.C. bus from 3.8.3.1 Action d its associated Emergency Battery within 2 hours or be in at least HOT STANDBY within the next 6 hours and in COLD N/A1 SHUTDOWN within the following 30 hours. Note 1: By current calculation, the use of the RICT Program on this Action is precluded by the instantaneous CDF or LERF limits of 1E-03 or 1E-04, respectively. However, the Action remains within the scope of the license amendment request, and it is proposed that the RICT Program be used on this Action should plant risk estimates decrease in the future. Note 2: RICTs calculated to be greater than 30 days are capped at 30 days in accordance with NEI 06-09-A, Revision 0-A. Note 3: The DC RICT estimate in this table represents the most limiting RICT calculation based on the most limiting DC component. In accordance with NEI 06-09-A, depending upon the specific inoperable SSC which causes the TS LCO to be not met, the level of risk calculated varies, and a different RICT may be calculated for different inoperable SSCs (e.g., one battery inoperable) within the TS 3.8.2.1 Action.

U.S. Nuclear Regulatory Commission Page 43 Serial: RA-19-0001 4.0 ADDITIONAL JUSTIFICATION FOR SPECIFIC ACTIONS Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505, Revision 2 (Reference 4) contains a list of Required Actions that may be proposed for inclusion in a RICT Program, but which require additional technical justification to be provided by the licensee. The following table, Table E1-3, provides a cross-reference between Table 1 of TSTF-505, Revision 2 and the corresponding HNP TS. Note that the table only includes those items from Table 1 which are proposed to be included in the RICT Program as part of this license amendment request. TABLE E1 IDENTIFIED REQUIRED ACTIONS WHICH REQUIRE ADDITIONAL JUSTIFICATION FOR INCLUSION IN TSTF-505 APPLICATION NUREG-1431 Standard LCO Requirements and Suggested Information Corresponding HNP Technical Specification Condition Specification 3.3.1.D LCO: The RTS Licensee must justify that the Power Range Neutron Flux - High instrumentation for each condition does not represent 3.3.1 Functional Unit 2.a Action Function in Table 3.3.1-1 the inability to perform the 2.a shall be OPERABLE. safety function assumed in Condition: One Power Range the FSAR given the loss of Neutron Flux - High channel spacial distribution of the inoperable. remaining Power Range detectors. The justification can include that the Actions require periodic monitoring of spacial power distribution and imposition of compensatory limits and reduced power. 3.5.2.A LCO: Two ECCS trains shall Licensee must justify that one ECCS - Operating be OPERABLE. or more ECCS trains 3.5.2 Action a Condition: One or more inoperable is not a condition [ECCS] trains inoperable. in which all required trains or See also: subsystems of a TS required system are inoperable. Flow Paths - Operating Acceptable justification is TS 3.1.2.2 Action (undesignated) Condition requiring 100% flow equivalent to a single Charging Pumps - Operating ECCS train. 3.1.2.4 Action (undesignated) 3.6.2.C LCO: [Two] containment air Licensee must justify that an Containment Air Locks lock[s] shall be OPERABLE. inoperable containment air 3.6.1.3 Action c.3 Condition: One or more lock is not a condition in containment air locks which all required trains or inoperable for reasons other subsystems of a TS required than an inoperable door or system are inoperable. An inoperable interlock acceptable argument may be mechanism. that a note in TS 3.6.2 requires the condition to be assessed in accordance with TS 3.6.1, Containment Integrity, and excessive leakage would require an immediate plant shutdown under that TS.

U.S. Nuclear Regulatory Commission Page 44 Serial: RA-19-0001 TABLE E1 IDENTIFIED REQUIRED ACTIONS WHICH REQUIRE ADDITIONAL JUSTIFICATION FOR INCLUSION IN TSTF-505 APPLICATION NUREG-1431 Standard LCO Requirements and Suggested Information Corresponding HNP Technical Specification Condition Specification 3.6.6A LCO: Containment Spray and Licensee must justify the Containment Spray System Cooling Systems ability to calculate a RICT for 3.6.2.1 Action (undesignated) (Atmospheric and Dual) the condition, including how (Credit taken for iodine the system is modeled in the See also: removal by the Containment PRA, whether all functions of Spray System) the system are modeled, and, Containment Cooling Condition A: One if a surrogate is used, why 3.6.2.3 Actions a-c containment spray train that modeling is conservative. inoperable. Condition C: One [required] containment cooling train inoperable. Condition D: Two [required] containment cooling trains inoperable. 3.7.2.A LCO: [Four] MSIVs shall be Licensee must justify that the Main Steam Isolation Valves OPERABLE. condition would not prevent (MSIVs) Condition: One MSIV performance of the steam 3.7.1.5 Action for MODE 1 inoperable in MODE 1. line break isolation function assumed in the accident analysis. An acceptable method may be a second MSIV per steam line, another design feature, or an alternate method of preventing blowdown of more than one steam generator. Duke Energys justification for each of the HNP Specifications is provided below. LCO 3.3.1 Functional Unit 2.a, Action 2.a, Power Range Neutron Flux - High As described in Section 7.2.2.3.1, Neutron Flux, of the HNP UFSAR, Amendment 62 (Reference 5): Four power range neutron flux channels are provided for overpower protection. If any channel fails in such a way as to produce a low output, that channel is incapable of proper overpower protection. The reference power signal to automatic rod control is supplied as a high select of the four flux channels, and if one channel fails high, it could cause rod movement. Two out of four overpower trip logic will ensure an overpower trip occurs if needed, even with an independent failure in another channel. In addition, channel deviation signals in the control system will give an alarm if any neutron flux channel deviates significantly from the average of the flux signals. Also, the control system will respond only to rapid changes in indicated neutron flux; slow changes or drifts are compensated by the temperature control signals. Finally, an overpower signal from any nuclear power range channel will block manual and automatic rod withdrawal. The setpoint for this rod stop is below the reactor trip setpoint.

U.S. Nuclear Regulatory Commission Page 45 Serial: RA-19-0001 The alarms and actions described above signify periodic monitoring of spatial power distribution and imposition of compensatory limits and reduced power. Also, with one channel inoperable, the safety function assumed in the UFSAR to initiate a reactor trip when the monitored parameter (i.e., Power Range neutron flux) reaches the high setpoint is still maintained. Consistent with the UFSAR description above and Table 3.3-1 of the HNP TS, there are a total of four channels and only two channels are needed for a reactor trip to occur. Therefore, HNP LCO 3.3.1 Functional Unit 2.a, Action 2.a meets the listed requirements for inclusion in the RICT Program. LCO 3.5.2 Action a, ECCS Subsystems - Tavg Greater Than or Equal to 350°F; LCO 3.1.2.2 Action (undesignated), Flow Paths - Operating; and LCO 3.1.2.4 Action (undesignated), Charging Pumps - Operating The HNP TS Actions for ECCS are restricted to a single inoperable train. The proposed change will not alter the fact that the Actions are restricted to a single train. Specifically, HNP LCO 3.5.2 does not contain an Action for more than one ECCS subsystem inoperable, and Standard Technical Specifications (i.e., NUREG-1431) and TSTF-505 Specification 3.5.2.A one or more ECCS subsystems inoperable Condition does not apply. Therefore, HNP LCO 3.5.2 Action a meets the requirements for inclusion in the RICT Program. As previously discussed in the table in Attachment 3 of the LAR, HNP LCO 3.1.2.2 is a plant-specific LCO that addresses, in part, the safety injection/charging pumps, which are in the scope of TSTF-505, Revision 2 (LCO 3.5.2 with additional justification). Inclusion of plant-specific LCO 3.1.2.2 is necessary to permit application of the RICT Program for inoperability of one train of charging/safety injection pumps per HNP LCO 3.5.2, as well as avoid conflicts with application of the RICT Program for support systems of powered components of TS 3.1.2.2. Similarly, HNP LCO 3.1.2.4 is a plant-specific LCO which addresses charging/safety injection pumps that are in the scope of TSTF-505, Revision 2 (LCO 3.5.2 with additional justification). Inclusion of plant-specific LCO 3.1.2.4 is necessary to permit application of the RICT Program for TS 3.5.2 for inoperability of one train of charging/safety injection pumps. LCO 3.6.1.3 Action c.3, Containment Air Locks As indicated in Table E1-1 of this enclosure above, the containment air locks are modeled in the HNP PRA. The PRA success criteria is the same as the design success criteria (i.e., 2 of 2 air locks). Compliance with remaining portions of HNP LCO 3.6.1.3 Action c.3 ensure that there is a physical barrier (e.g., closed door) and an acceptable overall leakage from containment. Thus, the function is still maintained. Action c.1 of LCO 3.6.1.3 requires the condition to be assessed in accordance with LCO 3.6.1.2 (i.e., Immediately initiate action to evaluate overall containment leakage rate per LCO 3.6.1.2). Note 3 for LCO 3.6.1.3 applies to all the Specification 3.6.1.3 Action statements and directs entry into LCO 3.6.1.1 for Containment Integrity when the air lock leakage results exceed the overall containment leakage rate of Specification 3.6.1.2.a. And LCO 3.6.1.1 requires restoration of Containment Integrity within 1 hour or the unit must commence a shutdown. Therefore, HNP LCO 3.6.1.3 Action c.3 meets the listed requirements for inclusion in the RICT Program.

U.S. Nuclear Regulatory Commission Page 46 Serial: RA-19-0001 LCO 3.6.2.1 Action (undesignated), Containment Spray System; and LCO 3.6.2.3 Actions a-c, Containment Cooling System The SSCs associated with the containment depressurization and cooling function of HNP LCO 3.6.2.1 following a LOCA or steam line break are explicitly modeled in the HNP PRA. The iodine removal function of the containment spray trains is not required for mitigation of severe accidents and is thus not modeled in the HNP PRA. The PRA success criteria for containment spray is 1 of 2 trains, which is the same as the design success criteria for the system. The function covered by HNP LCO 3.6.2.3 is containment heat removal following a LOCA. The SSCs for containment cooling are modeled in the HNP PRA consistent with the TS scope and can be directly evaluated. The success criteria in the PRA for the containment fan coolers in LCO 3.6.2.3 (i.e., 1 of 4 fan coolers in conjunction with 1 of 2 containment spray trains, or 3 of 4 fan coolers) are based on realistic containment heat removal capabilities of the containment cooling system consistent with the PRA Standard for Capability Category II. Since the containment spray and containment cooling SSCs are adequately modeled in the HNP PRA and a RICT can be calculated for the conditions, HNP LCO 3.6.2.1 Action (undesignated) and LCO 3.6.2.3 Actions a through c meet the listed requirements for inclusion in the RICT Program. LCO 3.7.1.5 Action for MODE 1, Main Steam Isolation Valves (MSIVs) A portion of the HNP licensing basis, as stated in Section 15.1.5, Steam System Piping Failure of the UFSAR (Reference 5), is the following (emphasis in underline): Fast-acting isolation valves are provided in each main steam line; these valves will fully close within five seconds of actuation following a large break in the steam line. For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown even if one of the isolation valves fails to close. Even with one MSIV inoperable (but open) in accordance with HNP LCO 3.7.1.5 (Action for MODE 1), an uncontrolled blowdown of more than one steam generator would not occur following a steam line break. For example, when one MSIV is inoperable on one steam line and a postulated steam line break occurs on a separate steam line, the design function is still performed because the two remaining operable MSIVs will close. The steam line break isolation function assumed in the accident analysis is maintained with one MSIV inoperable (but open). Therefore, HNP LCO 3.7.1.5 (Action for MODE 1) meets the listed requirements for inclusion in the RICT Program. 5.0 MAINTAINING DEFENSE-IN-DEPTH TSTF-505 (Reference 4) sets forth the following as guidance for what is to be included in this

Enclosure:

The description of proposed changes to the protective instrumentation and control features in TS Section 3.3, "Instrumentation," should confirm that at least one redundant or diverse means (other automatic features or manual action) to accomplish the safety functions (for example, reactor trip, SI, containment isolation, etc.) remains available

U.S. Nuclear Regulatory Commission Page 47 Serial: RA-19-0001 during use of the RICT, consistent with the defense-in-depth philosophy as specified in RG 1.174. (Note that for each application, the staff may selectively audit the licensing basis of the most risk-significant functions with proposed RICTs to verify that such diverse means exist.) The following sections provide the justification that defense-in-depth, either through redundancy or through diversity, is maintained for the applicable functions throughout the application of the RICT Program. The tables in Sections 5.1 and 5.2 show that for each reactor trip system (RTS) function and each engineered safety features actuation system (ESFAS) instrument function in TS 3/4.3, Instrumentation, there is at least one diverse means for initiating the safety function. Table E1-4 shows the diverse means for initiating the safety function (i.e., reactor trip) for RTS instrumentation. Note that the diverse reactor trips are based on changes to the HNP FSAR to be implemented prior to startup of Cycle 23 in November 2019. Table E1-5 shows the diverse means for initiating the safety function (e.g., safety injection, containment isolation, containment spray, etc.) for each ESFAS instrument. 5.1 Reactor Trip System Instrumentation (TS 3.3.1) The RTS design creates defense-in-depth through the degree of redundancy for each of its channels for each Functional Unit. x Each Functional Unit has multiple channels, with a minimum of 2 channels for Functional Units proposed for the RICT Program. x Each Functional Unit proposed to be in the scope of the RICT Program will cause a reactor trip with 1/2, 2/3, or 2/4 tripped channels. x A bypassed channel does not trip. It reduces the total available channels by 1, for example from 2/4 to 2/3, or from 2/3 to 2/2. x When applicable, if 1 channel in the Functional Unit is out of service, then that channel may be placed in a tripped state, for example reducing the redundancy from 2/4 required tripped channels to 1/3 required tripped channels. The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS. x Manual Reactor Trip - 1/2 channels to trip x Power Range Neutron Flux (High) - 2/4 channels to trip x Power Range Neutron Flux (Low) - 2/4 channels to trip x Power Range Neutron Flux (High Positive Rate) - 2/4 channels to trip x 2YHUWHPSHUDWXUH7- 2/3 channels to trip x 2YHUSRZHU7- 2/3 channels to trip x Pressurizer Pressure (Low) - 2/3 channels to trip x Pressurizer Pressure (High) - 2/3 channels to trip x Pressurizer Water Level (High) - 2/3 channels to trip x Reactor Coolant Flow (Low) - 2/3 channels to trip x Steam Generator Water Level (Low Low) - 2/3 channels to trip

U.S. Nuclear Regulatory Commission Page 48 Serial: RA-19-0001 x Steam Generator Water Level (Low with Coincident Steam Flow/Feedwater Mismatch) - 1/2 level with 1/2 flow x Turbine Trip (Low Fluid Oil Pressure) - 2/3 channels to trip x Safety Injection Input from ESF - 1/2 channels to trip x Reactor Trip Breakers - 1/2 channels to trip x Automatic Trip and Interlock Logic - 1/2 channels to trip TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

a. Automatic actuation failed 1) Two manual reactor trip switches Manual Reactor Trip Reactor Trip 2) Train A and Train B trip breakers

3) Automatic reactor trips

a. Feedwater system malfunctions that result in 1) Automatic Protection an increase in feedwater flow a. High-High Steam UFSAR 15.1.2 Generator Level

2) Manual Trip

b. Excessive increase in secondary steam flow 1) Automatic Protection UFSAR 15.1.3 a. Overtemperature 7

b. Overpower 7

2) Manual Trip

c. Inadvertent opening of a SG relief or safety 1) Automatic Protection valve a. Low pressurizer UFSAR 15.1.4 pressure

b. Safety injection signal

c. Overpower 7

2) Manual Trip

d. Steam system piping failure 1) Automatic Protection UFSAR 15.1.5 a. Low pressurizer pressure Power Range, High b. Safety injection Reactor Trip Neutron Flux signal

c. Overpower 7

2) Manual Trip

e. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal from a subcritical or low a. High positive flux rate power startup condition b. Overpower 7 UFSAR 15.4.1 c. Overtemperature 7

2) Manual Trip

f. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal at power a. Overtemperature 7 UFSAR 15.4.2 b. High pressurizer pressure

c. High pressurizer level

d. Overpower 7

2) Manual Trip

g. Chemical & Volume Control System 1) Automatic Protection malfunction that results in a decrease in boron a. Overtemperature 7 concentration in the reactor coolant 2) Manual Trip UFSAR 15.4.6

U.S. Nuclear Regulatory Commission Page 49 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

h. Spectrum of rod cluster control assembly 1) Automatic Protection ejection accidents a. High positive flux rate UFSAR 15.4.8 b. Overpower 7

c. Overtemperature 7

d. Low pressurizer pressure

2) Manual Trip

a. Spectrum of rod cluster control assembly 1) Automatic Protection ejection accidents a. Power range high UFSAR 15.4.8 flux

b. Overpower 7

c. Overtemperature 7

d. Low pressurizer pressure High Positive Flux Rate Reactor Trip

2) Manual Trip

b. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal from a subcritical or low a. Power range high power startup condition flux UFSAR 15.4.1 b. Overpower 7

c. Overtemperature 7

2) Manual Trip

a. Excessive increase in secondary steam flow 1) Automatic Protection UFSAR 15.1.3 a. Power range high flux

b. Overpower 7

2) Manual Trip

b. Loss of external electrical load/turbine trip 1) Automatic Protection UFSAR 15.2.2/15.2.3 a. High pressurizer pressure

b. SG Low-Low level

c. High pressurizer water level

2) Manual Trip Overtemperature T Reactor Trip c. Loss of non-emergency AC power to station 1) Automatic Protection auxiliaries a. SG low-low level UFSAR 15.2.6 2) Manual Trip

d. Loss of normal feedwater flow 1) Automatic Protection UFSAR 15.2.7 a. SG low-low level

2) Manual Trip

e. Feedwater system pipe break 1) Automatic Protection UFSAR 15.2.8 a. SG low-low level

b. High pressurizer pressure

c. Safety injection signal

2) Manual Trip

U.S. Nuclear Regulatory Commission Page 50 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

f. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal at power a. Power range high UFSAR 15.4.2 flux

b. High pressurizer pressure

c. High pressurizer level

d. Overpower 7

2) Manual Trip

g. Rod cluster control assembly misoperation 1) Automatic Protection UFSAR 15.4.3 a. High pressurizer level

2) Manual Trip

h. Chemical & Volume Control System 1) Automatic Protection malfunction that results in a decrease in boron a. Power Range high concentration in the reactor coolant flux UFSAR 15.4.6 2) Manual Trip

i. Inadvertent opening of a pressurizer safety or 1) Automatic Protection relief valve a. Pressurizer low UFSAR 15.6.1 pressure

2) Manual Trip

j. Steam generator tube failure 1) Automatic Protection UFSAR 15.6.3 a. Low pressurizer pressure

k. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal from a subcritical or low a. Power range high power startup condition flux UFSAR 15.4.1 b. Overpower 7

c. High positive flux rate

2) Manual Trip

l. Spectrum of rod cluster control assembly 1) Automatic Protection ejection accidents a. High positive flux rate UFSAR 15.4.8 b. Overpower 7

c. Power range high flux

d. Low pressurizer pressure

2) Manual Trip

a. Excessive increase in secondary steam flow 1) Automatic Protection UFSAR 15.1.3 a. Power range high flux

b. Overtemperature 7

2) Manual Trip

b. Inadvertent opening of a SG relief or safety 1) Automatic Protection Overpower T Reactor Trip valve a. Low pressurizer UFSAR 15.1.4 pressure

b. Safety injection signal

c. Power range high flux

2) Manual Trip

U.S. Nuclear Regulatory Commission Page 51 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

c. Steam system piping failure 1) Automatic Protection UFSAR 15.1.5 a. Low pressurizer pressure

b. Safety injection signal

c. Power range high flux

2) Manual Trip

d. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal at power a. High pressurizer UFSAR 15.4.2 pressure

b. High pressurizer level

c. Power range high flux

d. Overtemperature 7

2) Manual Trip

e. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal from a subcritical or low a. Power range high power startup condition flux UFSAR 15.4.1 b. Overtemperature 7

c. High positive flux rate

2) Manual Trip

f. Spectrum of rod cluster control assembly 1) Automatic Protection ejection accidents a. High positive flux rate UFSAR 15.4.8 b. Overtemperature 7

c. Power range high flux

d. Low pressurizer pressure

2) Manual Trip

a. Inadvertent opening of a SG relief or safety 1) Automatic Protection valve a. Overpower 7 UFSAR 15.1.4 b. Safety injection signal

c. Power range high flux

2) Manual Trip

b. Steam system piping failure 1) Automatic Protection UFSAR 15.1.5 a. Overpower 7

b. Safety injection signal Pressurizer Pressure -

Reactor Trip c. Power range high Low flux

2) Manual Trip

c. Inadvertent operation of the ECCS during 1) Automatic Protection power operation a. Safety injection UFSAR 15.5.1 signal

2) Manual Trip

d. Inadvertent opening of a pressurizer safety or 1) Automatic Protection relief valve a. Overtemperature 7 UFSAR 15.6.1 2) Manual Trip

e. Steam generator tube failure 1) Automatic Protection UFSAR 15.6.3 a. Overtemperature 7

U.S. Nuclear Regulatory Commission Page 52 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

f. Spectrum of rod cluster control assembly 1) Automatic Protection ejection accidents a. High positive flux rate UFSAR 15.4.8 b. Overtemperature 7

c. Power range high flux G2YHUSRZHU7

2) Manual Trip

a. Loss of external electrical load/turbine trip 1) Automatic Protection UFSAR 15.2.2/15.2.3 a. Overtemperature 7

b. SG Low-Low level

c. High pressurizer water level

2) Manual Trip

b. Feedwater system pipe break 1) Automatic Protection UFSAR 15.2.8 a. SG low-low level

b. Overtemperature 7 Pressurizer Pressure -

Reactor Trip c. Safety injection High signal

2) Manual Trip

c. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal at power a. Overpower 7 UFSAR 15.4.2 b. High pressurizer level

c. Power range high flux

d. Overtemperature 7

2) Manual Trip

a. Loss of external electrical load/turbine trip 1) Automatic Protection UFSAR 15.2.2/15.2.3 a. Overtemperature 7

b. SG Low-Low level

c. High pressurizer pressure

2) Manual Trip

b. Uncontrolled rod cluster control assembly 1) Automatic Protection bank withdrawal at power a. Overpower 7 Pressurizer Water Level UFSAR 15.4.2 b. High pressurizer Reactor Trip

        - High                                                                             pressure

c. Power range high flux

d. Overtemperature 7

2) Manual Trip

c. Rod cluster control assembly misoperation 1) Automatic Protection UFSAR 15.4.3 D2YHUWHPSHUDWXUH7

2) Manual Trip

a. Partial & complete loss of forced reactor 1) Automatic Protection coolant flow a. RCP undervoltage Reactor Coolant Flow - UFSAR 15.3.1/15.3.2 b. RCP underfrequency Reactor Trip Low, Single Loop 2) Manual Trip

b. Reactor coolant pump shaft seizure 1) Manual Trip UFSAR 15.3.3

U.S. Nuclear Regulatory Commission Page 53 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

a. Loss of external electrical load/turbine trip 1) Automatic Protection UFSAR 15.2.2/15.2.3 a. Overtemperature 7

b. High pressurizer water level

c. High pressurizer pressure

2) Manual Trip

b. Loss of non-emergency AC power to station 1) Automatic Protection auxiliaries a. Overtemperature 7 SG Water Level - Low- UFSAR 15.2.6 2) Manual Trip Reactor Trip Low c. Loss of normal feedwater flow 1) Automatic Protection UFSAR 15.2.7 a. Overtemperature 7

2) Manual Trip

d. Feedwater system pipe break 1) Automatic Protection UFSAR 15.2.8 a. Overtemperature 7

b. High pressurizer pressure

c. Safety injection signal

2) Manual Trip SG Water Level - Low a. Complete loss of feedwater 1) Automatic Protection Coincident w/ UFSAR 7.2.2.3.5 a. SG Water Level -

Reactor Trip Steam/Feedwater Flow Low-Low Mismatch 2) Manual Trip

a. Partial & complete loss of forced reactor 1) Automatic Protection coolant flow a. Low reactor coolant Undervoltage - Reactor Reactor Trip UFSAR 15.3.1/15.3.2 flow Coolant Pumps

b. RCP underfrequency

2) Manual Trip

a. Partial & complete loss of forced reactor 1) Automatic Protection coolant flow a. Low reactor coolant Underfrequency -

Reactor Trip UFSAR 15.3.1/15.3.2 flow Reactor Coolant Pumps

b. RCP undervoltage

2) Manual Trip No credit taken in the safety analyses (Chapter 15) 1) Automatic Protection for this anticipatory trip. The reactor trip on turbine a. All RTS functions trip is included as part of good engineering practice 2) Manual Trip Turbine Trip Reactor Trip and prudent design, providing additional protection of the health and safety of the public.

UFSAR 7.2.1.1.2

a. Inadvertent opening of a SG relief or safety 1) Automatic Protection valve a. Overpower 7 UFSAR 15.1.4 b. Low pressurizer Safety Injection Input Reactor Trip pressure from ESF

c. Power range high flux

2) Manual Trip

U.S. Nuclear Regulatory Commission Page 54 Serial: RA-19-0001 TABLE E1 RTS INSTRUMENTATION DIVERSITY Function Safety Function Plant Condition/Accident Diverse Reactor Trips

b. Steam system piping failure 1) Automatic Protection UFSAR 15.1.5 a. Overpower 7

b. Low pressurizer pressure

c. Power range high flux

2) Manual Trip

c. Feedwater system pipe break 1) Automatic Protection UFSAR 15.2.8 a. Overtemperature 7

b. High pressurizer pressure

c. SG Low-Low level

2) Manual Trip

d. Inadvertent operation of the ECCS during 1) Automatic Protection power operation a. Low pressurizer UFSAR 15.5.1 pressure

2) Manual Trip 5.2 Engineered Safety Features Actuation System Instrumentation (TS 3.3.2)

The ESFAS design creates defense-in-depth through the degree of redundancy for each of its channels for each Functional Unit. x Each Functional Unit has multiple channels. x Each Functional Unit will actuate its associated equipment with 1/2, 2/3 or 2/4 tripped channels. x A bypassed channel does not trip. It reduces the total available channels by 1, for example from 2/4 to 2/3, or from 2/3 to 2/2. x When applicable, if 1 channel in the Functional Unit is out of service, then that channel may be placed in a tripped state, for example reducing the redundancy from 2/4 required tripped channels to 1/3 required tripped channels. ESFAS also employs diversity in the number and variety of different inputs which will actuate the associated equipment. x Safety Injection o Manual Initiation - 1/2 channels to actuate o Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Containment Pressure - High 1 - 2/3 channels to actuate o Pressurizer Pressure - Low - 2/3 channels to actuate o Steam Line Pressure - Low - 2/3 channels to actuate x Containment Spray o Manual Initiation - 1/2 channels to actuate o Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Containment Pressure - High 3 - 2/4 channels to actuate

U.S. Nuclear Regulatory Commission Page 55 Serial: RA-19-0001 x Containment Isolation o Phase A Isolation - Manual Initiation - 1/2 channels to actuate o Phase A Isolation - Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Phase B Isolation - Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Phase B Isolation on Containment Pressure - High 3 - 2/4 channels to actuate x Steam Line Isolation o Manual Initiation - 1/2 channels to actuate o Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Containment Pressure - High 2 - 2/3 channels to actuate o Steam Line Pressure - Low - 2/3 channels to actuate x Turbine Trip and Feedwater Isolation o Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Steam Generator Water Level - High High - 2/4 channels to actuate x Auxiliary Feedwater o Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate o Steam Generator Water Level - Low Low - 2/3 channels to actuate o Trip of All Main Feedwater Pumps Start Motor-Driven Pumps - 1/1 channel per pump (2 pumps) to actuate o Steam Line Differential Pressure - High - 2/3 channels to actuate x Automatic Switchover to Containment Sump o Safety Injection Switchover to Containment Sump Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate RWST Level - Low Low - 2/4 channels to actuate o Containment Spray Switchover to Containment Sump Automatic Actuation Logic and Actuation Relays - 1/2 channels to actuate RWST Level - Low Low - 2/4 channels to actuate TABLE E1 ESFAS INSTRUMENTATION DIVERSITY Accident ESFAS Instrument Safety Feature Diverse Protection Condition Inadvertent 1) Automatic SI opening of a a. Low pressurizer pressure steam b. Low steamline pressure generator relief 2) Manual SI or safety valve Containment Pressure - High-1 Safety Injection UFSAR 15.1.4 Steam system 1) Automatic SI piping failure a. Low pressurizer pressure UFSAR 15.1.5 b. Low steamline pressure

2) Manual SI

U.S. Nuclear Regulatory Commission Page 56 Serial: RA-19-0001 TABLE E1 ESFAS INSTRUMENTATION DIVERSITY Accident ESFAS Instrument Safety Feature Diverse Protection Condition Feedwater 1) Automatic SI system pipe a. Low pressurizer pressure break b. Low steamline pressure UFSAR 15.2.8 2) Manual SI Inadvertent 1) Automatic SI opening of a a. Containment Pressure - High-1 steam b. Low steamline pressure generator relief 2) Manual SI or safety valve UFSAR 15.1.4 Steam system 1) Automatic SI Pressurizer Pressure - Low Safety Injection piping failure a. Containment Pressure - High-1 UFSAR 15.1.5 b. Low steamline pressure

2) Manual SI Feedwater 1) Automatic SI system pipe a. Containment Pressure - High-1 break b. Low steamline pressure UFSAR 15.2.8 2) Manual SI Inadvertent 1) Automatic SI opening of a a. Containment Pressure - High-1 steam b. Low pressurizer pressure generator relief 2) Manual SI or safety valve UFSAR 15.1.4 Steam system 1) Automatic SI Safety Injection piping failure a. Containment Pressure - High-1 UFSAR 15.1.5 b. Low pressurizer pressure

2) Manual SI Feedwater 1) Automatic SI system pipe a. Containment Pressure - High-1 break b. Low pressurizer pressure Steamline Pressure - Low UFSAR 15.2.8 2) Manual SI Inadvertent 1) Automatic MSIS opening of a a. Containment Pressure - High-2 steam b. High negative steam pressure rate generator relief 2) Manual steam line isolation or safety valve UFSAR 15.1.4 Main Steam Line Steam system 1) Automatic MSIS Isolation piping failure a. Containment Pressure - High-2 UFSAR 15.1.5 b. High negative steam pressure rate

2) Manual steam line isolation Feedwater 1) Manual steam line isolation system pipe break UFSAR 15.2.8

U.S. Nuclear Regulatory Commission Page 57 Serial: RA-19-0001 Steam system 1) Manual Containment Spray actuation Containment Spray piping failure UFSAR 15.1.5 Containment Pressure - High-3 Steam system 1) Manual Containment Spray actuation will Containment Isolation piping failure initiate Phase B containment isolation (Phase B) UFSAR 15.1.5 Inadvertent 1) Automatic MSIS opening of a a. Low steam line pressure steam b. High negative steam pressure rate generator relief 2) Manual steam line isolation Main Steam Line or safety valve Containment Pressure - High-2 Isolation UFSAR 15.1.4 Steam system 1) Automatic MSIS piping failure a. Low steam line pressure UFSAR 15.1.5 b. High negative steam pressure rate

2) Manual steam line isolation Inadvertent 1) Automatic MSIS opening of a a. Low steam line pressure steam b. Containment Pressure - High-2 generator relief 2) Manual steam line isolation Negative Steam Line Pressure Main Steam Line or safety valve Rate - High Isolation UFSAR 15.1.4 Steam system 1) Automatic MSIS piping failure a. Low steam line pressure UFSAR 15.1.5 b. Containment Pressure - High-2

2) Manual steam line isolation Feedwater 1) Automatic MFIS system a. Safety injection signal malfunctions 2) Manual that result in an a. Feedwater System can be isolated Feedwater Isolation and SG Water Level - High-High increase in manually through SI manual actuation Turbine Trip feedwater flow control switch UFSAR 15.1.2 b. Manual isolation at the component level: trip main FW pumps or closing SG FW isolation valves Loss of non- 1) Automatic Start of Motor-Driven Pumps emergency AC on any of following:

power to the a. Trip of all main feedwater pumps station b. Safety injection signal auxiliaries c. Loss of offsite power UFSAR 15.2.6 2) Manual actuation of motor-driven pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power SG Water Level - Low-Low Auxiliary Feedwater 4) Manual actuation of turbine-driven pump (Start Motor-Driven Pumps Initiation Loss of normal 1) Automatic Start of Motor-Driven Pumps and/or Turbine Driven Pump) feedwater flow on any of following:

UFSAR 15.2.7 a. Trip of all main feedwater pumps

b. Safety injection signal

c. Loss of offsite power

2) Manual actuation of motor-driven pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power

4) Manual actuation of turbine-driven pump

U.S. Nuclear Regulatory Commission Page 58 Serial: RA-19-0001 Feedwater 1) Automatic Start of Motor-Driven Pumps system pipe on any of following: break a. Trip of all main feedwater pumps UFSAR 15.2.8 b. Safety injection signal

c. Loss of offsite power

2) Manual actuation of motor-driven pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power

4) Manual actuation of turbine-driven pump Loss of non- 1) Automatic Start of Motor-Driven Pumps emergency AC on any of following:

power to the a. SG Water Level - Low-Low station b. Safety injection signal auxiliaries c. Loss of offsite power UFSAR 15.2.6 2) Manual actuation of motor-driven pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power

4) Manual actuation of turbine-driven pump Loss of normal 1) Automatic Start of Motor-Driven Pumps feedwater flow on any of following:

UFSAR 15.2.7 a. SG Water Level - Low-Low

b. Safety injection signal Trip of All Main Feedwater Auxiliary Feedwater c. Loss of offsite power Pumps Start Motor-Driven Initiation 2) Manual actuation of motor-driven pumps Pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power

4) Manual actuation of turbine-driven pump Feedwater 1) Automatic Start of Motor-Driven Pumps system pipe on any of following:

break a. SG Water Level - Low-Low UFSAR 15.2.8 b. Safety injection signal

c. Loss of offsite power

2) Manual actuation of motor-driven pumps

3) Automatic Start of one turbine-driven pump:

a. Loss of offsite power

4) Manual actuation of turbine-driven pump Feedwater 1) Manual isolation by tripping the pumps or Steam Line Differential Auxiliary Feedwater system pipe isolating the auxiliary feedwater pump Pressure - High Isolation break discharge motor operated isolation UFSAR 15.2.8 valves

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 2 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE The purpose of this Enclosure is to document the technical adequacy of the Shearon Harris Nuclear Power Plant (HNP) probabilistic risk assessment (PRA) models in support of the license amendment request (LAR) to modify Technical Specification (TS) Requirements to allow the use of Risk- Informed Completion Times (RICT) in accordance with TSTF-505 (Reference 1). Specifically, this Enclosure provides a discussion of the results of the peer reviews and self-assessments of the PRA models supporting this application and documents Duke Energys dispositions for Open finding-level F&Os from those reviews for this application. These models include internal events, internal flood, and fire. This Enclosure also provides confirmation that the clarifications and qualifications found in RG 1.200 (Reference 4) to the relevant PRA standards against which the PRA models have been assessed are met.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B, November 21, 2018 (ADAMS Accession No. ML18253A085).

4. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, US Nuclear Regulatory Commission, March 2009.

5. Duke Energy Calculation, HNP-F/PSA-0069, HNP - PRA Model Peer Review Resolution, Revision 3.

6. NEI Letter to USNRC, Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os), February 21, 2017 (ADAMS Accession No. ML17086A431).

7. Letter from NRC to NEI, U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, And 12-13, Close-Out of Facts and Observations (F&Os), May 3, 2017 (ADAMS Accession No. ML17079A427).

8. ABS Consulting, R-3857458-2026, Harris Nuclear Plant PRA Finding Level Fact and Observation Technical Review, March 17, 2017.

9. Engineering Planning and Management, Inc. (EPM), R2919-002-001, Rev. 0, F&O Closeout by Independent Assessment of the Harris Nuclear Plant (HNP) Fire PRA Model, August 2017.

10. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME and the American Nuclear Society, February 2009.

11. NRC Letter to Shearon Harris Nuclear Power Plant, Unit 1, "Issuance of Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program," November 29, 2016 (ADAMS Accession No. ML16200A285).

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001

12. NRC Letter to Shearon Harris Nuclear Power Plant, Unit 1, "Issuance of Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, December 28, 2010 (ADAMS Accession No. ML101130535).

13. Duke Energy procedure, AD-NF-NGO-0502, Probabilistic Risk Assessment (PRA) Model Technical Adequacy, Rev. 2.

14. Jensen Hughes, 025085.003-RPT-01, Rev. 0, H.B Robinson and Shearon Harris Nuclear Power Plants: Technical Review of LE-D6, August 2017.

3.0 INTRODUCTION

Section 4.0, Item 3 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the LAR provide a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, including the resolution or disposition of any identified deficiencies (i.e., findings and observations from peer reviews). Specifically, this includes a comparison of the requirements of RG 1.200 using the elements of the PRA Standard for Capability Category II. 4.0 PRA QUALITY/TECHNICAL ADEQUACY The PRA models supporting this application have been assessed against RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 4) consistent with NRC RIS 2007-06. The HNP PRA models are sufficiently robust and suitable for use in risk-informed processes such as regulatory decision making. The peer reviews that have been conducted and the resolution of findings from those reviews demonstrate that the internal events, internal flooding and fire models of the PRA have been performed in a technically sound manner. The assumptions and approximations used in development of the PRA have also been reviewed and are appropriate for their application. Duke Energy procedures are in place for controlling and updating the models, when appropriate, and for assuring that the model represents the as-built, as-operated plant (Reference 13). The conclusion, therefore, is that the HNP PRA models are acceptable to be used as the basis for risk-informed applications including assessment of proposed TS amendments. The HNP PRA Models of Record (MORs) are maintained as controlled documents and are updated on a periodic basis to represent the as-built, as-operated plant. Duke Energy procedures provide the guidance, requirements, and processes for the maintenance, update, and upgrade of the PRA (Reference 13): x The process includes a review of plant changes, selected plant procedures, and plant operating data as required, through a chosen freeze date to assess the effect on the PRA model. x The PRA model and controlling documents are revised as necessary to incorporate those changes determined to impact the model. x The determination of the extent of model changes includes the following: o Accepted industry PRA practices, ground rules, and assumptions consistent with those employed in the ASME/ANS PRA Standard (Reference 10), o Current industry practices,

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 o NRC guidance (e.g., RG 1.174 and RG 1.177), o Advances in PRA technology and methodology, and o Changes in external hazard conditions. 4.1 PRA Review Process Results The HNP internal events PRA model was subject to a self-assessment and a full-scope peer review conducted in 2002 in accordance with guidance in NEI-00-02, Industry PRA Peer Review Process. In 2006, a self-assessment was conducted to identify supporting requirements that did not meet Category II of the ASME Standard RA-Sb-2005 and RG 1.200, Rev. 1. In 2007, a focused scope industry peer review against two elements was conducted as a follow-up to the self-assessment against AMSE Standard RA-Sb-2005 and RG 1.200, Rev. 1. In July 2017, a focused scope industry peer review was conducted against one supporting requirement (SR LE-D6) for a model change that was determined to be an upgrade. The review team concluded that the change met the technical requirements of SR LE-D6 at Capability Category II with no F&Os (Reference 14). The Internal Events PRA model was peer reviewed in 2002 by the PWR Owners Group (PWROG) prior to the issuance of Regulatory Guide 1.200. As a result, self-assessments have been conducted by Duke Energy of the Internal Events PRA model in accordance with Appendix B of RG 1.200 Revision 2 (Reference 4) to address the PRA technical adequacy requirements not considered in the 2002 peer review. The Internal Events PRA technical adequacy (including the 2002 peer review and self-assessment results) has previously been reviewed by the NRC in previous requests noted below: x License Amendment Regarding Risk-Informed Justifications for the Relocation of Specific Surveillance Frequency Requirements to a Licensee-Controlled Program, November 29, 2016 (ADAMS Accession No. ML16200A285), (Reference 11) x License Amendment Regarding Adoption of National Fire Protection Association Standard 805, June 28, 2010 (ADAMS Accession No. ML10750602), (Reference 12) Upgrades that have occurred since the PWROG peer review in 2002 have been reviewed in accordance with the peer review process. There are no unreviewed PRA upgrades as defined by the ASME PRA Standard RA-Sa-2009 (Reference 10) in the Internal Events PRA model. The HNP internal flood PRA model was subject to a self-assessment and a full-scope (covering all internal flood SRs) peer review conducted in August 2014 against RG 1.200 Revision 2. The HNP Fire PRA model was subject to a review conducted by the NRC during the NFPA 805 Pilot process and an additional focused scope industry peer review, both in 2008 in accordance with ANSI/ANS-58.23-2007. Since the reviews of the Fire PRA model were performed prior to the publication of RG 1.200 Rev 2, a self-assessment was conducted to assess the differences between ANSI/ANS-58.23-2007 and the current version of the PRA standard, ASME/ANS RA-Sa-2009. That assessment confirmed there were no technical differences between the two versions of the standard. The reports for the reviews of these models and disposition of the F&Os from the reviews are documented in Reference 5.

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 Closed findings were reviewed and closed in March 2017 for the Internal Events and Internal Flood models as a pilot for the process documented in the draft of Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os) published at the time of the review (Reference 8). NRC staff observed the pilot closure on-site event held January 31 through February 1, 2017. An assessment has been performed to determine the impact of changes to the guidance between the closure event and the final version found acceptable by the NRC staff. The main deltas identified are related to 1) utility and review teams documented determination and justification if each finding resolution is an upgrade versus maintenance update, and 2) the assessment teams confirmation that for the closed F&Os, the aspects of the underlying Supporting Requirements (SRs) in ASME/ANS RA-Sa-2009 that were previously not met, or met at Capability Category (CC)-I, are now met or met at CC-II. The utility portion of the upgrade versus maintenance assessment was completed globally and did not identify any resolutions as an upgrade. Additionally, the review team determined none of the resolutions were upgrades and this is documented in the final report (Reference 8). The assessment team confirmed resolution of the findings allowed re-categorization of capability categories to meet or met at CC-II, as applicable. The results of this review have been documented and are available for NRC audit. Closed findings were reviewed and closed in October 2017 for the Fire PRA model using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, Close-out of Facts and Observations (F&Os) (Reference 6) as accepted by NRC in the letter dated May 3, 2017 (Reference 7). The results of this review have been documented and are available for NRC audit (Reference 9). 4.2 Open Finding Level Facts and Observations 4.2.1 Internal Events All finding level F&O dispositions for the Internal Events PRA were determined to have been adequately addressed by an independent review (Reference 8) and are now considered closed. 4.2.2 Internal Flooding Per an independent review of the open Internal Flooding F&Os, 15 were closed, 8 were partially closed, and 2 remain open (Reference 8). The 10 open or partially open F&Os are shown in Table E2-1 along with their disposition for this application. 4.2.3 Fire Table E2-1 below provides a summary of the remaining open findings and their disposition for this application. In addition to the open F&Os, there are several SRs for Fire PRA that were assessed either as Capability Category I (CC-I) or Not Met, but have no associated F&O. These SRs are shown in Table E2-2 along with their disposition for this application.

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) 1-9 IFSN-A4 Not Met Finding: Flow through floor drains is calculated and The analysis of the floor drainage system was revised for the documented in internal flooding PRA. However, it appears that Reactor Auxiliary Building (RAB), and the supporting flow is incorrectly calculated for situations when multiple floor requirement was evaluated to be Met for the RAB by the F&O drains are connected to one drain line. Closure team. The RAB contains most of the IF-PRA risk. The calculations shown in HNP-F-PSA-0091 show a capacity Other buildings (such as the Turbine Building or Diesel per floor drain and the total capacity in each flood area is the Generator Building) were not assessed at the time, as inclusion average capacity per drain multiplied by the number of floor of the drain propagation analysis would not provide any drains. However, no discussion of how multiple drains are meaningful risk insights. The peer review team correctly noted connected to common drain line is provided. When multiple that a drain analysis for the Turbine Building would not be drains flow through a common drain line, the flow from each needed except for the Turbine Building basement. The HNP successive drain greatly reduces the flow from each drain in Turbine Building is an open-air structure at the non-basement the system. elevations that lacks walls or other barriers that would allow for water to accumulate to generate a significant hydrostatic driving From the F&O Closure team: Item is partially closed. Section force to allow for a large amount of water to propagate via drain 6.3.6 of and Attachment 4 to Calculation HNP-F/PSA-0091 backflow. Any depths of water in the Turbine Building would be document the revised analysis of the drainage system in RAB. limited by the lack of barriers that would allow for water to Based on this analysis for RAB, for spray events resulting in a accumulate and the large open floor space in the Turbine flow rate of less than 100 gpm, the resulting flood is within the Building. Propagation to the Turbine Building basement would capacity of the drain system and will not result in submergence originate from the open stairways and floor penetrations not of SSCs in the flood originating compartment. For scenarios from floor drains. Propagation to the basement from floor drains other than sprays, no credit is taken in the flood propagation would be a secondary pathway that would not be as significant analysis for beneficial removal of water from a flood as propagation from stairwells, floor penetrations, wall compartment through the floor drains. For buildings other than penetrations or door failures. The Turbine Building basement, RAB, however, drain analysis was not performed and no like the other elevations in the Turbine Building, is a large open qualitative evaluation was documented. In particular, upper area with a substantial amount of floor area available for water elevations in the Turbine Building (TB) could potentially flow to accumulate. Walkdowns performed found that the lowest downward to the basement and cause additional damage to PRA component on this elevation was at 41 inches above the PRA equipment in the TB basement (e.g., condensate pumps, Turbine Building basement floor though 36 inches will be used etc.). to be conservative. From the Turbine Building general arrangement drawing it was found to reach a depth of three feet approximately 250,000 gallons of water would need to accumulate. This calculation is further conservative as it did not consider the volume of condenser sump or condenser pit. These volumes are substantial (as identified via a walkdown) and found to be able to hold an additional volume of water

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) (though this volume is not credited). As this volume is substantial and the ability of the Turbine Building drains to provide a large flowrate via backflow is limited there will be no impact on the component importance measures. The floor drains in the emergency diesel generator (EDG) building were not evaluated to determine whether inter drain propagation could occur. These drains were subsequently re-evaluated and found to connect the EDG A and EDG B compartments. The worst-case scenario would be the dual loss of the EDGs. This loss would be limited to only the EDGs as the EDG Building is a separate structure that does not communicate directly with any other structures. In addition, since this scenario would not require an automatic or expedient manual shutdown, it is screened from further analysis. Based on the above, this item is not expected to impact the results of the IFPRA or of the calculation of RICTs 1-18 IFSN-B3 Not Met The assessment of door failure heights is evaluated in the Door failure assumptions based on a plant Civil calculation were internal flooding PRA. The analysis of doors is based entirely included, scenarios were reassessed, and documentation was on assumptions; however, these assumptions are not listed in updated. The F&O Closure team, however, stated that the the assumptions section of the documentation. analysis did not include all critical failure modes (specifically, did not include warping of the door resulting in failure to latch), and The standard requires that assumptions be listed and that the door failure criteria used may not be appropriate for all characterized. Civil Calculation HNP-C/RAB-1008, Rev. 0 door types. The team recommended that the specific criteria provides a Harris-specific analysis that indicates a standard used for door failure be re-examined to ensure that realistic 3X7 tornado door can withstand a sustained pressure of 1.5 criteria are being used. The plant Civil calculation examined the psig away from the doorframe with a safety factor of 4. Based potential load from water on a tornado rated door. While this on this pressure loading, it was estimated that the door failure door is representative of doors found in HNP it is not the only differential flood height is at least 6.5 feet (note that the door type found in HNP. However, the calculated door height is estimated door failure differential flood height at Fort Calhoun not unreasonable for the other subset of doors found and is was even higher). However, the critical failure modes generally considered a modeling assumption that is consistent evaluated in Civil Calculation HNP-C/RAB-1008, Rev. 0 only with the state of practice in the industry. The EPRI guidelines include failures of door frame, door latch, door hinge plate, and for performing an IFPRA do not specifically give a door height door hinge pin. The analysis did not consider warping of door failure (one is recommended though site specific values are resulting in failure to latch. For fire doors, the warping failure normally preferred). The HNP calculated value is near the value mode may be more vulnerable than the other failure modes,

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) based on the analysis of fire door manufacturer test data for calculated in the supporting appendix of the EPRI IFPRA another U.S. nuclear plant. guidelines Appendix D for a standard plant hollow metal door. Bending or warping of the door is not a catastrophic failure of Also, the evaluation performed in Civil Calculation HNP-the door and is normally akin to water flow underneath the door. C/RAB-1008, Rev. 0 is for tornado door which is considered to Catastrophic failure is preferred such that a conservative be stronger than the standard fire doors and non-fire rated propagation pathway can be assessed in a timeline that would normal egress doors. As such, the door failure criterion of 6.5 normally preclude operator isolation actions (again to increase feet of differential flood height should not be applied to the fire the number of components impacted). Therefore, the current doors and normal egress doors. treatment is appropriate for the HNP IFPRA and further It is not clear if this door failure differential flood height was examination is not expected to significantly change the timing or applied to the RAB doors. If yes, it is inappropriate. If no, the impacts of any flooding sequence (because of the very large use of the criteria of 1 foot/3 feet mentioned in the EPRI IFPRA rooms at HNP), and is not expected to affect calculation of guidance report appears to be too conservative for the RAB RICTs. fire doors. 1-7 IFSN-A2 CC-II Flood alarms are identified in the HRA analyses. However, the The specific alarms that might be available to indicate floods or alarms are not specifically identified, nor are the alarms leaks in a specific compartment have been added which results correlated to the flood source that causes the flooding event. in this Supporting Requirement being MET. Documentation was revised to list the alarms or indications of leaks or flooding per Table 7-2 of HNP-F/PSA-0094 lists alarms and indications that compartment as well as the specific alarms to aid in flood can be used to identify the flooding conditions in each of the identification in a particular area. flood compartments. However, the alarms and indications listed in Table 7-2 may not be always sufficient or clear (with The F&O closure team suggested, however, that the the exception of Fire Water system, Chilled Water System, documentation might not be sufficient or clear (for a subset of CCW, Circulating Water system, CVCS, SW, etc.) for use to systems) to identify the specific source that caused a flood. identify the specific flood sources that cause the flooding Duke Energy disagrees with the closure teams suggestion. conditions. SR IFSN-A2 requires the identification of flood HNPs Operations procedures are symptom based diagnostic alarms for each flood source and each flood area. procedures that are not tied to specific sources, and the indicators and alarms help the operator diagnose location and source of flood. Dominant sources have relevant alarms identified. There is no direct correlation between specific indications and alarms to specific flood sources. There will be no impact on the calculation of RICTs. 1-16 IFSO-A4 CC-II Flooding events caused by human induced actions such as Plant level pipe break data on floods caused by human-induced overfilling of tanks, flow diversion etc., are not addressed. maintenance errors and generic best estimates of associated Maintenance-induced flooding frequencies by system and by plant level flood frequencies are included per Revision 3 of the

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) flood compartment are evaluated in Section 6.8.3 of HNP- EPRI pipe failure rate report (EPRI TR 3002000079). This F/PSA-0093. It appears that the apportionment of the includes human errors such as overfilling of tanks and flow maintenance-induced flood frequencies by system to individual diversion that result in floods. Human errors resulting in flood compartment is not performed in a manner consistent pressure boundary failures are included in direct failures with the characteristics of the maintenance-induced flooding involving failure of the pressure boundary caused by since it was done by the fraction of the system pipe length degradation mechanisms, loading conditions, and human error. located in each flood compartment (although it follows exactly To complement the generic data, HNP Operating Experience the guidance provided in EPRI Report 3002000079). (OE) was reviewed for maintenance-induced flood events and documented in the IFPRA analysis. Maintenance-induced flooding scenarios are modeled in Sections 7.3.4 and 7.4.2 (as well as Attachment 9) of HNP- The F&O closure team recommended that Duke Energy contact F/PSA-0092 for CCW heat exchangers and ESCW chillers in the author of the EPRI document to verify that the maintenance Flood Compartments FLC17b (RAB Elevation 236) and induced flooding frequencies have been apportioned across FLC18a (RAB Elevation 261), respectively. Insufficient flood compartment correctly, and that an additional sensitivity description is provided for the screening process used to be performed on the potential impact of underestimating select the maintenance-induced flooding scenarios included in maintenance-induced flooding frequencies. Since maintenance-the HNP IFPRA model. induced flooding is not a significant contributor to CDF/LERF, and since HNP is a single unit site with no shared systems, it is With no proper justification, the maintenance-induced flooding expected that additional validation of the results will not impact frequencies apportioned to flood compartments other than the CDF/LERF or the calculation of RICTs. above two compartments were not accounted for in the IFPRA model. Since the frequency of maintenance induced flooding was derived from actual industry events, the frequencies apportioned to the flood compartments not selected for flood scenario modeling cannot be discarded unless it can be demonstrated that no open maintenance (including both PM and CM) can be performed on the subject fluid system during power operation. 1-19 IEQU-A5 CC-II SR HR-G4 requires that the analyses be based on realistic The HRA calculation has been revised to include the specific estimates of the time to receive cues. The analyses used an alarms that indicate floods in each flood area. Documentation of assumption of 5 minutes to receive cues and assumed that analysis of the RAB sump level alarms has been added, and service water low pressure alarms would be received. the expected time for floor drain alarms from spray events in Experience shows that only for extremely large breaks would each flood area is included. The new information was low pressure alarms be received and no analyses were seen incorporated into the HRA timing and scenario development per that justified use of low pressure alarms for the HNP flood the suggested resolution. A simulator exercises was performed scenarios. No evaluation of the time to receive drain and sump and observed to validate the assumptions, and performance

U.S. Nuclear Regulatory Commission Page 10 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) alarms was provided. The basis for timing of the events shaping factors were based on the observed operator actions analyzed was a scenario evaluated in the FSAR and that from the exercise. timing may not be applicable to the scenarios evaluated in the The F&O Closure team, however, disagreed with the analysis, HNP IF PRA. stating that the 5-minute time to recognize the cue and begin Analysis of RAB sump level alarms was documented in Table trouble shooting is not sufficient to support the identification of 7-4 of Calculation HNP-F/PSA-0094 for a spray event with a the specific flood source. They believe, despite the simulator leak rate of 100 gpm and a flood event with a break flow of exercise, that no basis is provided to justify the time allowed to 2,000 gpm. However, the timings of the low pressure and high diagnose and take initial action for any flood other than service flow alarms are not addressed (i.e., no evaluation was found). water break. Duke Energy performed a sensitivity where the The sump level alarms will support the identification of a time to recognize the cues and begin identification was flooding condition. However, it is not sufficient to support the increased by a factor of 3, and there was minimal impact on the identification of the specific flood source. No basis is provided flooding results. Contrary to the F&O closure teams comment, to justify that 5 minutes are sufficient to diagnose the flood Duke Energy contends that the 5-minute cognitive time is source and make decision on how to isolate the break. appropriate as the flood isolation HFEs are developed on a per system basis. 5 minutes is used to diagnose the break from indications observed from the control room (for example, low header pressure for ESW/NSW, fire header pressure decrease, fire pump activation). Given that the operators would likely get two cues that would strongly indicate an internal flood was occurring, the 5 minutes was deemed to be reasonable. The first cue operators would get in the control room would be a system-specific indication that a rupture has occurred in a system. The second indication that they would receive would likely be a high sump alarm or increase in the floor drain tank level. Given these two indications, 5 minutes is an appropriate and realistic value for the cognitive time portion of the human failure event. Increasing this value would drive the human error probability higher but would no longer be realistic. Had the human failures been created to cover multiple systems the cognition time would need to be increased to allow for operators to diagnose which system had the rupture. This supporting requirement is MET, and no impact on calculation of RICTs is expected due to this recommendation. 2-3 IFSN-A3 CC-II While the IFPRA documentation identifies the automatic and Documentation has been added to describe the automatic manual actions that have the ability to terminate or contain actions by the sump pumps as well as the manual operator

U.S. Nuclear Regulatory Commission Page 11 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) propagation for the four events requiring HRA, the actions to align the pumps to additional tanks. In addition, the documentation does not include similar actions for the manual operator actions that can be implemented to mitigate remaining sources and areas. the flooding condition and propagation in the affected flood compartments have been identified. Section 7.2 of Calculation HNP-F/PSA-0094 describes the automatic actions by the sump pumps as well as the manual The F&O closure team, however, stated that no manual action operator actions to align the pumps to additional tanks. In (e.g., break isolation) is identified for many of the flood addition, Table 7-2 of HNP-F/PSA-0094 identifies the manual compartments. Most of the manual actions identified are operator actions that can be implemented to mitigate the proceduralized opening doors to non-critical areas. No flooding condition and propagation in the affected flood considerations were given to isolation of the ruptured or leaking compartments. However, no manual action (e.g., break piping system by closing specific MOVs or manual valves. isolation) is identified for many of the flood compartments. Nevertheless, isolation actions are modeled for many of the Most of the manual actions identified are opening doors to flood scenarios but they are just not listed in the documentation. non-critical areas. In Table 7-2, no considerations were given This is a documentation issue only and will not affect calculation to isolation of the ruptured or leaking piping system by closing of RICTs. specific MOVs or manual valves. Nevertheless, isolation actions are modeled for many of the flood scenarios. They are just not listed in Table 7-2. 2-4 IFSN-A6 CC-I/II/III Not all flood failure mechanisms are considered in the An analysis of high energy line breaks (HELBs) has been susceptibility of components to flood-induced failures. HELBs performed, and a new appendix describing the analysis has IFEV-A5 Partially alone can result in high humidity and temperature which in turn been added to the IFPRA documentation. The accident Closed will result in fire sprinkler discharge. scenarios have been updated to include HELBs and the resulting effects. Jet impingement, pipe whip, high temperature Attachment 10 to Calculation HNP-F/PSA-0091, Revision 1 and high humidity effects have been considered. provides the evaluation of such flood failure mechanisms as jet impingement, pipe whip, high temperature, high humidity, The F&O closure team stated, however, that additional analysis compartment pressurization, etc. that may result from the high needs to be performed to demonstrate that the effects of high energy line breaks (HELB). A criterion of 20 feet (for pipes with temperature and high humidity beyond the zone of influence inner diameter less than 24) or 10D (for pipes with inner (ZOI) for the HELB (i.e., 20 feet or 10X the pipe ID, whichever is diameter greater than 24) was used to determine whether an larger) would not cause additional PRA component damage in SSC or fire protection sprinkler would be impacted by the the large rooms at HNP. The ZOI calculation is based on effects of HELB. While the criteria of 20 feet/10D is adequate NUREG/CR-2913 Two-phase Jet Loads developed by Sandia for the analysis of jet impingement and pipe whip, there is no National Laboratory in 1983. This is a generally accepted analysis documented to demonstrate that the effects of high industry methodology for assessment of HELB scenarios. humidity and high temperature resulting from failure of high Specifically, the use of jet impingement evaluations has been energy piping would not propagate beyond 20 feet/10D previously reviewed and approved by the NRC, and a 10D

U.S. Nuclear Regulatory Commission Page 12 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) causing SSCs failures. value has been assumed for the limit of jet damage Consistent with the methodology. According to the HNP PRA staff, the only flood compartment in which not all PRA equipment is failed by a HELB scenario is a Additionally, detailed GOTHIC analysis performed for a main large room in the RAB, in which the 20 feet/10D zone of steamline break in the steam tunnel with the tunnel door to the influence (ZOI) was applied. The temperature as a function of RAB open shows that the temperature and the humidity for time in RAB at Elevation 261 after a MSLB in the steam tunnel much of the elevation staying below typical failure setpoints of (with door D10 to RAB open) was analyzed. The results equipment. Temperatures never approach 200 F and humidity, indicate that, near the sprinkler header, the ceiling temperature while elevated, does not reach severely abnormal values that reached is unlikely to activate the sprinklers. And, the peak would challenge equipment performance. This analysis temperature in the immediate proximity of Instrument Racks supports the conclusion of using the 10 diameter ZOI is A1-R33 and A1-R22 (located directly outside of Door D10) appropriate at determining HELB impacts. would experience the direct effects of the steam plume coming Additional analysis is beyond the requirements of the Standard through Door D10. Relative humidity in the area near and will have no impact on the calculation of RICTs. Instrument Rack A1-R33 (El. 263.25), which is bounding, reaches 100% for more than 20 minutes. Relative humidity values near the chillers and HVAC equipment peak at 100%. The high energy lines in the RAB includes the steam supply line to the TDAFW pump and the charging lines. Although the steam lines for the TDAFW pump pass through RAB 236 elevation, the steam isolation valves located in the steam tunnel are normally closed during power operation, except during the TDAFW pump test. As such, this area is only exposed to the potential of a high energy line break during the TDAFW pump test. The HNP IFPRA needs to verify that no PRA equipment would be impacted by high humidity or high temperature beyond the 20 feet / 10D ZOI, even for the rupture of the TDAFW pump steam supply line. 2-8 IFEV-A7 CC-I/II While a great number of maintenance induced flooding In communications with Operations personnel, it was frequencies were calculated, no evidence could be found that determined that the only maintenance-induced flooding events they were ever included in the model. that could occur in Mode 1 are the CCW heat exchangers and the ESCW chillers. These two flood compartments decision Maintenance-induced flooding scenarios are modeled in trees were modified to include Maintenance-Induced flooding as Sections 7.3.4 and 7.4.2 (as well as Attachment 9) for CCW

U.S. Nuclear Regulatory Commission Page 13 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) heat exchangers and ESCW chillers in Flood Compartments a failure mechanism, and scenarios were developed. FLC17b (RAB Elevation 236) and FLC18a (RAB Elevation The F&O Closure Panel stated, however, that while these 261), respectively. Insufficient detailed description is provided scenarios are indeed modeled, insufficient detailed description for the screening process used to select the maintenance-is provided for the screening process used to select the induced flooding scenarios included in the IFPRA model. maintenance-induced flooding scenarios. They further stated During the onsite resolution review, it was indicated by the that since the frequency of maintenance induced flooding is HNP Operations that open PM will not be performed on the derived from actual industry events, the frequencies CCW heat exchangers and ESCW chillers during power apportioned to the flood compartments not selected for flood operation. scenario modeling cannot be discarded unless it can be demonstrated that no open maintenance (including both PM Since the frequency of maintenance induced flooding is and CM) can be performed on the subject fluid system during derived from actual industry events, the frequencies power operation. Additional documentation needs to be added apportioned to the flood compartments not selected for flood on how maintenance-induced flooding scenarios were selected, scenario modeling cannot be discarded unless it can be and there is a need to assess whether or not the maintenance demonstrated that no open maintenance (including both PM induced flooding frequency was apportioned properly. This is a and CM) can be performed on the subject fluid system during documentation issue and will have no impact on the calculation power operation. of RICTs. 2-11 IFQU-A7 CC-II The FRANX software was used to quantify the HNP internal Top CDF/LERF cutsets are presented, and the top contributing flooding model which utilizes the fault tree linking approach. flooding scenarios have been included in the documentation. A SR QU-A2 of Section 2.2-7 states that the frequencies of complete listing of the quantified CDF/LERF results for flooding individual sequences need to be estimated for CDF and this scenarios are provided in Attachments to the documentation. was not done for internal flooding. The F&O Closure team, however, indicated that documentation Top CDF/LERF cutsets are presented in Table 5.1-1/5.2-1 and of quantified sequences for flooding scenarios are not provided. Attachments L/M of Calculation HNP-F/PSA-0095. The This is a documentation issue only, and there is no impact on quantified CDF/LERF results of the top contributing flooding calculation of RICTs. scenarios are given in Tables 5.1-2/5.2-2. Complete listing of the quantified CDF/LERF results for flooding scenarios are provided in Attachments J/K to Calculation HNP-F/PSA-0095. Based on Duke PRA staff, FRANX includes calculation for accident sequences for LERF, but not for CDF. Figures 5.6.1 and 5.6.2 show CDF by what is labeled as the sequence type, which are actually by IE, not sequence. In any event, estimates of the accident sequences are not included in

U.S. Nuclear Regulatory Commission Page 14 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) the documentation. 2-12 IFQU-A7 CC-II The FRANX software was used to quantify the HNP internal The HNP dependency analysis has been included in the IFPRA flooding model which utilizes the fault tree linking approach. documentation. The documentation states that there is no The FRANX model is configured to apply recovery actions. A dependency between the flood mitigation actions and the truncation of 1E-08 was applied for the CCDP which is subsequent operator actions carried over from the internal considered sufficiently low to capture an appropriate number of events PRA since the time between these actions are cutsets to calculate an accurate CDF. The flooding model was sufficiently long (essentially hours). quantified similarly to the internal events model which included The F&O Closure panel recommended that a specific, the removal of cutsets with mutually exclusive events. The combination-by-combination evaluation of the dependency documentation states that the new HEPs associated with should be provided to demonstrate that indeed there is flooding were assumed to be independent of any other HEP in insufficient dependency between these two groups of operator a scenario, however QU-C2 in Section 2.27 states that actions. This is a documentation issue only, and there is no dependency between HEPs in a cutset or sequence must be impact on calculation of RICTs assessed. Section 7.7 of HNP-F/PSA-0094 indicates that there is no dependency between the flood mitigation actions and the subsequent operator actions carried over from the internal events PRA since the time between these actions are sufficiently long (essentially hours). However, a specific combination-by-combination evaluation of the dependency should be provided to demonstrate that indeed there is insufficient dependency between these two groups of operator actions. HRA-C1- HRA-C1 I/II/III HR-G1 was incorporated by reference. The approach to Supporting Requirements HRA-C1 and HR-G1 remained largely 3 determining which HEPs are developed using a detailed unchanged from ASME/ANS RA-S-2007 (draft) for which ASME/ANS RA- ANSI/ANS-analysis does not conform to the standard definition of Finding HRA-C1-3 was initiated to ANSI/ANS-58.23-2007 for S-2007 (draft) 58.23-2007 significant for capability category II. Given the fact that the which the Capability Category I/II/III was determined. For model is still in development, this is understandable. ASME/ANS RA-Sa-2009, Supporting Requirement HRA-C1 was assigned Capability Categories of I, II, and III, but Support Requirement HR-G1 remained largely unchanged. Capability Category II was determined for HRA-C1. Tables 61 and 62 of HNP-F/PSA-0079, Rev. 3, list significant operator actions having a FV greater than 0.005 or RAW greater than 2, respectively. Section 7.1.3 of HNP-F/PSA-0075,

U.S. Nuclear Regulatory Commission Page 15 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) Rev. 2, describes the selection of HFEs for detailed analysis. Based on established criteria (e.g., inadequate instrumentation or short time window), four significant HFEs were not selected for detailed analysis and were instead conservatively assumed to be failed or left at a screening value. Duke Energy will resolve F&O HRA-C1-3 by performing detailed analyses for these four HFEs and incorporating the results into the FPRA model prior to implementation of TSTF-505. HRA-C1- HRA-C1 I/II/III HR-G6 was incorporated by reference. It is too early in the Supporting Requirements HRA-C1 and HR-G6 remained largely 6 process for this supporting requirement to have been achieved unchanged from ASME/ANS RA-S-2007 (draft) for which ASME/ANS RA- ANSI/ANS-satisfactorily, since only a few HFEs have been developed in Finding HRA-C1-6 was initiated to ANSI/ANS-58.23-2007 for S-2007 (draft) 58.23-2007 detail. which the Capability Category I/II/III was determined. For ASME/ANS RA-Sa-2009, Supporting Requirement HRA-C1 was assigned Capability Categories of I, II, and III, but Support Requirement HR-G6 remained largely unchanged. Capability Category II was determined for HRA-C1. Plant-specific and scenario-specific influences on human performance were addressed by a well-defined and self-consistent process, as described in Section 7.1.3 of HNP-F/PSA-0075, Rev. 2. This ensured the results were logical and consistent with inputs and method of analysis. There is no impact to this application. FQ-E1-2 FQ-E1 NOT MET The definition of significant contributor in the PRA standard Supporting Requirement FQ-E1 and the Supporting includes the idea of summing, in rank order, the fire sequences Requirements for HLR-QU-D and HLR-LE-F remained largely ASME/ANS RA- ANSI/ANS-and considering any in the top 95%, or any that individually unchanged from ASME/ANS RA-S-2007 (draft), for which S-2007 (draft) 58.23-2007 contribute 1% or more, as significant. This determination has Finding FQ-E1-2 was initiated, to ANSI/ANS-58.23-2007, for not been made for fire CDF or LERF. Harris does not appear which the NOT MET was determined, to ASME/ANS RA-Sa-to use the definition as provided in the PRA standard. 2009. This SR continues to be NOT MET. This is a documentation-only issue and does not affect quantification of risk. There is no impact to this application.

U.S. Nuclear Regulatory Commission Page 16 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) FQ-F1-1 FQ-F1 I/II/III QU-F2 - Several of the recommended documentation Supporting Requirement FQ-F1 and the Supporting requirements are not in place, specifically items b, e, f, g, i, j, Requirements for HLR-QU-F and HLR-LE-G remained largely ASME/ANS RA- ASME/ANS

m. unchanged from ASME/ANS RA-S-2007 (draft), for which S-2007 (draft) RA-Sa-2009 Finding FQ-F1-1 was initiated, to ASME/ANS RA-Sa-2009, for which the Capability Category I/II/III was determined.

HNP-F/PSA-0079, Rev. 3, documents the majority of the typical documentation requirements: b) Attachment 32 documents records of the cutset review process. e) Section 6.0 documents the total plant CDF and contribution from the different initiating events, however accident sequences were not individually documented. f) Accident sequences were not individually documented. g) Table 62 documents equipment and human actions with RAW > 2.0. In addition, Section 6.4 includes insights which make note of particular credit taken to mitigate potentially-dominant accidents. i) Section 7.0 documents the uncertainty distribution for the total CDF. j) Tables 61 and 62 documents importance measure results. m) Section 3.0 documents the use of qualified software and controlled electronic input files. Section 5.5 documents the process the development of the FRANX input files an operation of FRANX. Section 10.0 documents the controlled electronic output files. This is a documentation-only issue. There is no impact to this application. FQ-F1-2 FQ-F1 I/II/III QU-F3 - There is currently no record of significant contributors Supporting Requirement FQ-F1 and the Supporting to fire CDF. Requirements for HLR-QU-F and HLR-LE-G remained largely ASME/ANS RA- ASME/ANS unchanged from ASME/ANS RA-S-2007 (draft), for which

U.S. Nuclear Regulatory Commission Page 17 Serial: RA-19-0001 TABLE E2 DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS Capability Finding Supporting Category Description Disposition for TSTF-505 Number Requirements (CC) S-2007 (draft) RA-Sa-2009 Finding FQ-F1-2 was initiated, to ASME/ANS RA-Sa-2009, for which the Capability Category I/II/III was determined. Section 6.0 of HNP-F/PSA-0079, Rev. 3, documents the significant contributors to CDF, however accident sequences were not individually documented. This is a documentation-only issue. There is no impact to this application. TABLE E2 SRS ASSESSED AT CC-I OR NOT MET WITH NO ASSOCIATED F&O Supporting Capability Disposition for TSTF-505 Requirement(s) Category (CC) SR FSS-D7 at Capability Category II requires that, when crediting fire detection and suppression systems, generic estimates of total system unavailability should be used when these systems have not experienced outlier behavior with regards to unavailability. While a review of plant experience has not been explicitly compared to generic data, reliability and unavailability of fire detection and suppression systems is monitored. The monitoring program ensures that any adverse trends in reliability or unavailability are recognized and FSS-D7 I corrected. Considering that HNP fire protection and detection systems are installed and maintained in accordance with applicable NFPA codes and standards via code compliance calculations (e.g. HNP-M/BMRK-0001, Code Compliance Evaluation NFPA 72E, Automatic Fire Detectors and HNP-M/BMRK-0009, Code Compliance Evaluation NFPA 13, Sprinkler Systems), the aforementioned program ensures that the credited fire detection and suppression systems do not experience outlier behavior, such that use of generic data is acceptable. Therefore, there is no impact to the application.

U.S. Nuclear Regulatory Commission Page 18 Serial: RA-19-0001 TABLE E2 SRS ASSESSED AT CC-I OR NOT MET WITH NO ASSOCIATED F&O Supporting Capability Disposition for TSTF-505 Requirement(s) Category (CC) SR FSS-D9 at Capability Category II/III requires a qualitative evaluation of the potential for smoke damage to the fire PRA equipment, and incorporation of the evaluation into the definition of fire scenario target sets. Smoke damage does not impact this application because the effects of smoke damage are adequately captured in the model. Appendix T of NUREG/CR-6850 states that of the four modes of smoke damage identified, only circuit bridging has the potential to introduce new risk-significant fire scenarios and that this mode of failure only impacts two classes of equipment; namely, printed circuit based components (including digital control and instrumentation circuits), and high-voltage power distribution devices (such as switchgear, motor control centers (MCCs), transformers, and breakers). Appendix T goes on to state that substantial smoke exposure densities are required to induce circuit bridging, such that a moderate fire in a large room may not approach damaging exposure levels. However, a small fire within a single confined space, such as an electrical panel or bank of connected panels, might cause damage. The practical implications of the guidance contained in Appendix T of NUREG/CR-6850 is that short-term smoke damage (smoke damage during a fire event or shortly after suppression) is limited to electrical enclosures with high smoke concentration. In most cases, these high concentrations of smoke will occur within the electrical panels physically connected to the fire origin, such as breaker cubicles within the same MCC where the fire started. Essentially, smoke damage is not postulated outside the interconnected panels adjacent to FSS-D9 I the cabinet of fire origin. Appendix T of NUREG/CR-6850 further limits the vulnerable equipment to medium and high voltage switching or transmission equipment, and lower voltage instrumentation and control devices. The HNP fire PRA currently fails the entire electrical panel or bank of connected panels where a fire is postulated. This method encompasses the guidance for evaluating smoke damage provided in Appendix T for electrical panels. Appendix T further states guidance to assume that substantial quantities of smoke (e.g. from a large forest fire or large oil fire) will cause very high-voltage transmission equipment to trip off-line. The risk associated with a large forest fire is already captured in the internal events PRA by the loss of offsite power initiator, and would not need to be included in the fire PRA. Regarding large oil fires, based on the siting generally allowing smoke to disperse to atmosphere rather than collect to damaging concentrations, outside oil sources were screened. The only remaining oil source which was judged capable of producing smoke comparable to a large forest fire is the turbine oil system, which has a capacity of approximately 10,000 gallons. The large oil fire scenario associated with the turbine oil system fails all equipment within the turbine generator building, and any smoke damage effects on nearby high voltage transmission equipment of consequence are captured within that damage set. Therefore, there is no impact on the application because the Harris fire PRA currently encompasses the effects of smoke damage. SR FSS-H6 at Capability Category I/II/II requires documenting a technical basis for any statistical models applied in the model, a FSS-H6 I technical basis for any plant-specific updates applied to generic statistical models, and any plant specific data applied. This SR addresses documentation only and has no quantitative impact on risk. Therefore, there is no impact on the application. SR IGN-A4 at Capability Category II requires a review of plant-specific experience for fire event outlier experience, and an update of fire frequencies if outliers are found. Section 4.2.1 of HNP-F/PSA-0071 documents that a review of plant specific fire event experience was IGN-A4 I performed and no outliers were identified. Therefore, this SR is considered MET at Capability Category II and there is no impact on the application.

U.S. Nuclear Regulatory Commission Page 19 Serial: RA-19-0001 4.3 SRs Previously Reviewed During Focused Scope Peer Review At the pre-submittal meeting between Duke Energy and the NRC staff on August 22, 2019, the NRC staff requested that the SRs previously reviewed during a focused scope peer review be provided in the license amendment request to adopt a RICT Program. Those SRs, along with the peer review dates and standards reviewed against, are provided in Table E2-3 below. Table E2 SRs Previously Reviewed During a Focused Scope Peer Review Peer Review PRA Technical Elements Reviewed Standards reviewed to: Documented in Calculation: Internal Events HRA, DA and Uncertainty RA-Sb-2005, Addenda to ASME RA-S-2002 Standard HNP-F/PSA-0069, Appx. D (Reference 5) Focus Scope for Probabilistic Risk Assessment for Nuclear Power Peer Review; Plant Applications, American Society of Jan 2008 Mechanical Engineers, New York, NY, December 2005. Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities USNRC, January 2007. Internal Events LE-D6 ASME/ANS RA-Sa-2009 HNP-F/PSA-0069, Appx. V Focus Scope RG 1.200 Rev. 2 Peer Review; June 2019 Fire; 2008 All ANSI/ANS fire PRA standard HNP-F/PSA-0069, Appx. G NEI Fire PRA standard ASME/ANS PRA standard fire Level 1 PRA Flooding, 2014 All RG 1.200 Rev. 2 HNP-F/PSA-0069, Appx. L Fire; June 2019 FSS-A4, -A5, -C4, -C6, -D1, -D2, -D3, - ASME/ANS RA-Sa-2009, Addenda A to ASME/ANS HNP-F/PSA-0069, Appx. W D4, -D6, -D8, -D10, -G1, -G6, -F1, -F2, - RA-S-2008 F3, & FSS-H5.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 3 Information Supporting Technical Adequacy of PRA Models Without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 This enclosure is not applicable to the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) submittal. Duke Energy is not proposing to use any PRA models in the HNP Risk-Informed Completion Time Program for which a PRA standard, as endorsed by the NRC in RG 1.200, Revision 2, does not exist.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 4 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE The purpose of this enclosure is to document the justification for the exclusion of sources of risk which are not in the scope of the Probabilistic Risk Assessment (PRA) models applied to the Shearon Harris Nuclear Power Plant (HNP) Risk-Informed Completion Time (RICT) Program.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007, (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012, (ADAMS Accession No. ML12286A322).

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1, March 2017.

4. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975.

5. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991.

6. NRC Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4, June 1991.

7. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME and the American Nuclear Society, February 2009.

8. Duke Energy Letter, Shearon Harris Nuclear Power Plant, Unit 1 - Seismic Hazard and Screening Report (CEUS Sites), Response to NRC 10 CFR 50.54(f) Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, March 27, 2014, (ADAMS Accession No. ML14090A441).

9. Electric Power Research Institute (EPRI) Final Report 1025287, Seismic Evaluation Guidance: Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic, February 2013.

10. NRC Generic Issue 199 (GI-199), Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants Safety Risk Assessment, (ADAMS Accession No. ML11356A034), August 2010.

11. Carolina Power & Light (CP&L) Serial Letter HNP-95-061 to USNRC, Shearon Harris Nuclear Power Plant, Docket No. 50-44/License No. NPF-63, Response to Generic Letter 88-20 Supplement 4 - Individual Plant Examination for External Events (IPEEE),

June 30, 1995.

12. Electric Power Research Institute (EPRI) Letter RSM-031114-077 to Nuclear Energy Institute (NEI), Fleet Seismic Core Damage Frequency Estimates for Central and Eastern U.S. Nuclear Power Plants Using New Site-Specific Hazard Estimates, March 11, 2014, (ADAMS Accession No. ML14083A586).

13. Duke Energy Letter, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis, October 19, 2017, (ADAMS Accession No. ML17292B648).

14. Duke Energy Letter, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement Regarding De Minimis Penetrations (EPID L-2017-LLA-0355), January 11, 2018, (ADAMS Accession No. ML18011A911).

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001

15. Duke Energy Letter, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement and Request for Additional Information Response (EPID L-2017-LLA-0355), September 19, 2018, (ADAMS Accession No. ML18262A328).

16. NRC, Safety Evaluation, Shearon Harris Nuclear Power Plant, Unit 1 - Issuance of Amendment to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Nonconformances (EPID L-2017-LLA-0355), March 29, 2019, (ADAMS Accession No. ML18347A385).

3.0 INTRODUCTION

Section 4.0, Item 5 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a justification for excluding any risk sources determined to be insignificant to the calculation of configuration-specific risk. It also requires that the LAR provide a discussion of any conservative or bounding analyses to be applied to the calculation of RICTs for sources of risk not addressed by the PRA models. 4.0 SCOPE Topical Report NEI 06-09-A (Reference 2) does not provide a specific list of hazards to be considered in a RICT Program. Non-mandatory Appendix 6-A of the ASME/ANS PRA Standard (Reference 7) provides a guide for identification of most of the possible external events for a plant site. This information was reviewed for the HNP site and augmented with a review of information on the site region and plant design to identify the set of external events to be considered. The information in the UFSAR regarding the geologic, seismologic, hydrologic, and meteorological characteristics of the site region as well as present and projected industrial activities in the vicinity of the plant were also reviewed for this purpose. The results of the review are summarized in Table E4-1. No new site-specific and plant-unique external hazards were identified through this review. 5.0 TECHNICAL APPROACH The guidance contained in NEI 06-09-A (Reference 2) states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCOs) proposed to be included in the RICT Program scope. Consistent with NUREG-1855 (Reference 3), external hazards may be addressed by:

1. Screening the hazard based on a low frequency of occurrence,

2. Bounding the potential impact and including it in the decision-making, or

3. Developing a PRA model to be used in the RMAT/RICT calculation The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 x The first is the contribution from the occurrence of beyond design basis conditions (e.g., winds greater than design, seismic events greater than the design-basis earthquake (DBE), etc.). These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant. x The second aspect addressed is the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (e.g., high winds or seismic events causing loss of offsite power, etc.). While the plant design basis assures that the safety-related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems that presents a risk. 5.1 Hazard Screening The first step in the evaluation of an external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the 1975 Standard Review Plan (SRP, Reference 4), which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance (Reference 5) as assuring a bounding CDF of less than 1E-06/yr for each hazard. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability (CCDP) for those conditions. If the bounding CDF for the hazard can be shown to be less than 1E-06/yr, then beyond design basis challenges from that hazard can be screened out and do not need to be addressed quantitatively in the RICT Program. The basis for this is as follows: x The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-05. x The maximum time interval allowed for a RICT is 30 days. x If the maximum CDF contribution from a hazard is <1E-06/yr, then the maximum ICDP from the hazard is <1E-07 (1E-06/yr

30 days/365 days/yr).

x Thus, the bounding ICDP contribution from the hazard is shown to be less than 1% of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT. While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using this approach, some external hazards can cause a plant challenge, even for hazard severities that are less than the design basis limit. These considerations are addressed in the following sections. 5.2 Hazard Analysis - CDF There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-06/yr. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution for the hazard. The approach used for seismic CDF is described in Section 6.1 of this enclosure.

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 5.3 Hazard Analysis - LERF The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the Large Early Release Frequency (LERF) considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as follows:

The approach used for seismic LERF is described in Section 6.1. 5.4 Risks from Hazard Challenges Given the selection of an estimated bounding CDF/LERF, the approach considered must assure that the RICT Program calculations reflect the change in CDF/LERF caused by the out-of-service equipment. For HNP, as discussed later in this Enclosure, the only beyond design basis hazard that could not be screened out is the seismic hazard, and the approach used considers that the change in risk with equipment out of service will not be higher than the bounding seismic CDF. The above steps address the direct risks from damage to the facility from external hazards. While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using these steps without a full PRA, there are risks that may be unaccounted for. These risks are related to the fact that some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events can cause extended loss of offsite power conditions below design basis levels. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms. The approach taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or are otherwise not significant to risk. Section 6.1 of this Enclosure provides the analysis for the HNP site with respect to the beyond design basis seismic hazard. Section 6.2 provides an analysis for the high winds hazard. Section 6.3 of this Enclosure provides an analysis of the other representative external hazards for the HNP site. 6.0 TREATMENT OF EXTERNAL HAZARDS The following external hazards were screened from applicability to HNP per a plant-specific evaluation in accordance with GL 88-20 (Reference 6) and updated to use the criteria in ASME PRA Standard RA-Sa-2009 (Reference 7).

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 6.1 Seismic Activity Following the accident at the Fukushima Daiichi Nuclear Power Plant resulting from the March 11, 2011 Great Tohoku Earthquake, the US Nuclear Regulatory Commission (USNRC) Near Term Task Force (NTTF) developed a set of recommendations intended to clarify and strengthen the regulatory framework for protection against natural phenomena such as earthquakes. Subsequently, the USNRC issued a 50.54(f) letter that requested licensees to reevaluate the seismic hazards at their sites against present-day USNRC requirements and guidance. In response to the 50.54(f) letter, a HNP site-specific seismic hazard estimate was developed (Reference 8) using Electric Power Research Institute (EPRI) guidance (Reference 9). The USNRC further requested that interim actions be taken for plants whose updated ground motion response spectrum (GMRS) exceeds the design basis safe shutdown earthquake (SSE) of 0.15g in the spectral frequency range from 1 to 10 Hz. Since the HNP SSE significantly exceeds the updated GMRS in the 1 to 10 Hz range (see Figure E4-1 below), HNP screens from further seismic evaluation and a full seismic PRA is not required (Reference 9). However, the GMRS does not explicitly account for the capability of a nuclear power plant to maintain a safe condition during an earthquake, so the GMRS provides an incomplete perspective regarding overall seismic safety. Development of an estimate of Seismic CDF (SCDF) and Seismic LERF (SLERF), therefore, is required. SSE-GMRS comparison, Harris 0 .7

0.6

Ir \ 1111 0 .5 c r--... i""'-

      .i0                                                            ......
                                          /J
       ,_   0 .4
                                                                                \

a,

ai u u - SSE CII 1/

      °j! 0.3
                                                                                                               - GMRS
                                                                                   ~

t, a, D. - IPEEE 0 .2 ""' I -~ Ill

                                                                /,,.
                                  ~~ ,                                                ~ L',..,..
                                 +
                                                        ~
                               ~~                                                                "'I' 0.1            ';I"'
                     ~ ~   i-0 0.1                     1                                      10                         100 Spectral frequency, Hz FIGURE E4 COMPARISON OF GROUND MOTION RESPONSE SPECTRA (GMRS) FOR HNP

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 6.1.1 Seismic Hazard In accordance with the 50.54(f) letter and following the guidance in the SPID (Reference 9), a probabilistic seismic hazard analysis (PSHA) was completed for HNP. The detailed analysis is described in Reference 8. The mean seismic hazard curve plots at frequencies of Peak Ground Acceleration (PGA), 10Hz, 5Hz, and 1Hz are provided below in Figure E4-2. 1.0E+00 Mean Annual Frequency of Exceedance (per year)

                                                                         ~
                                                                                       -"'~

1.0E-02 ~

r--.. ""

                                                                                                        --"'      ~

N~~ ~ I 1.0E-04 ~ i\ PGA 1.0E-06 'l'il ... 10Hz

1.0E-08

                                                                                                                           \       ~   ~ ~ ~"-

r-..: 5Hz 1Hz

                                                                                                                                                     'If
                                                                                                                                       ~               ftll       ~
                                                                                                                                             ~
                                                                                                                                                                  ~

1.0E-10 I'l ! ~

1.0E-12 1.0E-04 1.0E-03 1.0E-02 1.0E-01 1.0E+00 1.0E+01 Ground Acceleration (g) FIGURE E4 HNP MEAN SEISMIC HAZARD CURVES 6.1.2 Plant-Level Fragility The plant-level seismic fragility is the conditional probability of plant damage at a given seismic hazard input level. The HNP plant-level fragility curve was developed by the USNRC as part of the 2010 Safety/Risk Assessment (Reference 10) based on information provided in the HNP Individual Plant Evaluation of External Events (IPEEE) submittal (Reference 11). Appendix C of the USNRC GI-199 report defines the methods the USNRC used to estimate a plant-level fragility from information reported in the IPEEE. Since HNP conducted a focused scope seismic margins analysis (SMA) for the 0.3g review level earthquake (RLE) as part of the IPEEE, the USNRC estimated the plant-level fragility based on the reported plant-level high confidence of low probability of failure (HCLPF) values of assessed components, and an estimate of the composite variability from the SMA components. The expression for mean plant-level fragility at any given acceleration is derived from Appendix C of USNRC GI-199 and is plotted in Figure E4-3:

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 () = where: Pf(a) is the probability of failure for a given acceleration, a,

        LVWKHFXPXODWLYHQRUPDOGLVWULEXWLRQIXQFWLRQ

a is the plant-level acceleration capacity at the acceleration of interest (g), am is the median (50th percentile) plant-level acceleration capacity (g), and c is the composite variability in the plant-level acceleration capacity. Cumulative Probability of Failure 1.0 0.8 0.6 0.4 0.2 0.0 0.01 0.1 1 10 Ground Acceleration (g) FIGURE E4 HNP PLANT-LEVEL FRAGILITY 6.1.3 Seismic Bounding Analysis The purpose of this section is to present the analysis that bounds the potential seismic impact and include it in the decision-making process, as a seismic PRA is not available for HNP. The process for analyzing an unscreened external hazard without the use of a full PRA involves the following three steps:

1. Estimate Bounding Seismic CDF Contribution

2. Evaluate Bounding Seismic LERF Contribution

3. Evaluate Potential Risk Increases Due to Out of Service Equipment 6.1.4 Estimating Bounding Seismic Core Damage Frequency The USNRC used approximate methods to estimate the SCDF for each operating nuclear plant as part of their 2010 study. These SCDF estimates were developed using a method that involved integrating the mean seismic hazard curve and the mean plant-level fragility curve for each plant. This method is discussed in Non-Mandatory Appendix 10-B.9 of the ASME/ANS RA-Sa-2009 Standard (Reference 7), as well as Appendix D of the SPID (Reference 9). This

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 method has previously been used by the Staff in the resolution of GI-194, Implications of Updated Probabilistic Seismic Hazard Estimates, and during reviews of various risk-informed license amendments (Reference 8). This same approach was judged by EPRI (Reference 12) to be the most appropriate method to assess this latest set of new site-specific seismic hazard estimates developed in accordance with the USNRCs 50.54(f) letter. Past Seismic PRAs have demonstrated that the plant risk is a function of the seismic response at a variety of spectral frequencies. The plant risk is very site-specific and is a function of: x Failure modes governing the lower capacity structures, systems and components x Soil frequencies for those structures founded on soil columns x Structure fundamental frequencies x Equipment fundamental frequencies The frequency ranges that drive the plant seismic risk are typically very broad, including contributions from 1 Hz to PGA. One of the methods to account for the spectral frequency contribution to the SCDF used in the GI-199 Safety/Risk Assessment considered each of the four frequencies (1, 5, 10 Hz and PGA) to contribute equally to the overall SCDF. The resulting derived SCDF estimate associated with this spectral weighting is shown mathematically in the following expression:

                           =   +   +   +   =2.14E-06 This averaging of the four frequencies approach was judged by EPRI to be appropriate, as past SPRAs have demonstrated that typically there are risk contributions from all these frequencies due to the variety of equipment, systems, and structures that end up contributing to the risk. In addition, EPRI has conducted some limited additional sensitivity studies related to this frequency weighting (expanding the number of frequencies from 4 to 6 and considering an alternate approach in the GI-199 Safety/Risk Assessment referred to as the IPEEE weighted average SCDF approach). Overall results and conclusions are relatively insensitive to the approach taken. EPRI does not recommend using very conservative approaches to estimate the SCDF such as use of maximum SCDFs calculated at any one frequency. This type of bounding approach is overly conservative and judged to not provide realistic risk estimates consistent with SCDFs calculated in SPRAs.

6.1.5 Estimating Bounding Seismic Large Early Release Frequency For Internal Events, LERF is typically associated with the Interfacing System Loss of Coolant Accidents (ISLOCAs), Steam Generator Tube Ruptures (SGTRs), and failures of containment isolation. Each of these is considered in developing a SLERF estimate. Analyses of the HNP Seismic Category I structures were performed as part of the SMA for the HNP IPEEE (Reference 11). The HNP containment analysis was performed to identify vulnerabilities that involve early failure of containment functions. This included consideration of containment integrity, containment isolation, and other containment functions. Concerns such as falling and differential building displacements were considered. Displacement concerns between the containment shell and internal structure were reviewed. Containment isolation valves and penetrations were reviewed to identify anomalies that might affect containment performance. A containment walkdown was conducted by a seismic review team to identify/evaluate any potential unusual conditions/configurations (e.g., spatial interactions,

U.S. Nuclear Regulatory Commission Page 10 Serial: RA-19-0001 unique penetrations, piping hard spots, items/components bridging the seismic gap between the containment liner and interior structure, etc.). Seismic capacities for containment were determined to be greater than the 0.3g RLE, and no vulnerabilities or unusual conditions that would be detrimental to the containment integrity were identified. All HNP civil structures, therefore, were screened from further review based on the EPRI NP-6041, Table 2-3, screening criteria and Section 3.8 of the HNP FSAR. The SGTR and ISLOCA contributions to Internal Events LERF results for HNP are provided in Table E4-1, below. TABLE E4 DOMINANT CONTRIBUTORS TO INTERNAL EVENTS LERF RESULTS IE Event IE Description CDF LERF Contribution Contribution SGTR STEAM GENERATOR TUBE RUPTURE 29.4% 79.3% (SGTR) ISLOCA INTERFACING SYSTEM LOCA (ISLOCA) 4.2% 14.4% Recent Seismic PRAs, however, have shown that seismically-induced SGTR and ISLOCA accident sequences are not important contributors to seismic risk. An estimate of the SLERF, therefore, is calculated by removing the SGTR/ISLOCA sequences from the baseline LERF results and multiplying the calculated SCDF by the Conditional Large Early Release Probability (CLERP) for the Internal Events model. For HNP, the baseline CDF & LERF values (see ) are: Baseline CDF (Internal Events): 2.89E-06 per year Modified CDF (SGTR/ISLOCA removed): 1.92E-06 per year Baseline LERF (Internal Events): 1.07E-06 per year Modified LERF (SGTR/ISLOCA removed): 6.74E-08 per year The Conditional Large Early Release Probability, therefore, is:

                                   = () /() = 0.035 and
                   =    = 2.14  06  0.035 = 7.51  08 per year This estimate of SLERF falls below the 1.0E-07 (per year) RG 1.174 screening criteria, and thus no SLERF penalty is recommended for the RICT Program.

6.1.6 Evaluate Potential Risk Increases Due to Out of Service Equipment The approach taken in the computation of SCDF above assumes that the SCDF can be based on the likelihood that a single seismic-induced failure leads to core damage. This approach is bounding and implicitly relies on the assumption that seismic-induced failures of equipment show a high degree of correlation (i.e., if one SSC fails, all similar SSCs will also fail). This assumption is conservative, but direct use of this assumption in evaluating the risk increase from out of service equipment could lead to an underestimation of the change in risk. However, if one were to assume no correlation at all in the seismic failures, then the seismic risk would be lower than the risk predicted by a fully correlated model, but the change in risk using the un-

U.S. Nuclear Regulatory Commission Page 11 Serial: RA-19-0001 correlated model with a redundant piece of important equipment out of service would be equivalent to the level predicted by the correlated model. If the industry accepted approach of correlation is assumed, the conditional core damage frequency given a seismic event will remain unaltered whether equipment is out of service or not. Thus, the risk increase due to out of service equipment cannot be greater than the total SCDF estimated by the bounding method used in Reference 10. That is, for the HNP site, the delta SCDF from equipment out of service cannot be greater than 2.14E-6/yr. 6.1.7 Seismic Conclusion Based on the above methodology and results, it is proposed that a Seismic CDF penalty factor of 2.14E-06 be applied to all RICT calculations. It is proposed that no Seismic LERF penalty factor be applied to RICT Program calculations. 6.2 High Wind The High Wind High winds are not considered a significant hazard for HNP and have been screened as a negligible contributor for HNP as discussed below, in lieu of providing updated results that incorporate the 2017 and 2018 internal events PRA updates. The HNP High Winds treatment is divided into three distinct categories, as follows: x Hurricanes x Straight Line Winds x Tornadoes The end goal for high winds treatment for the application is to screen the hazard in accordance with Section 6-2 of the ASME/ANS RA-Sa 2009 PRA standard (Reference 2.7). Specifically, Section 6-2.3 states that an event can be screened out: (a) If it meets the criteria in the NRCs 1975 Standard Review Plan (SRP) or a later revision; or (b) If it can be shown using a demonstrably conservative analysis that the mean value of the frequency of the design-basis hazard used in the plant design is less than ~10-5/yr and that the conditional core damage probability is <10-1, given the occurrence of the design-basis hazard event; or (c) If it can be shown using a demonstrably conservative analysis that the CDF is <10-6 /yr. The following sections provide justification for screening high winds from inclusion in the subject license amendment request in accordance with the criteria above. 6.2.1 Hurricanes The RICT Program is proposed to be applied to at-power operations (i.e., Modes 1 and 2) and not for shutdown conditions. Additionally, site procedure for response to severe weather directs

U.S. Nuclear Regulatory Commission Page 12 Serial: RA-19-0001 Operations to place the plant in Mode 3 at least two hours prior to the anticipated arrival of sustained winds in excess of 74 mph at the site. Hurricanes therefore do not apply to the RICT Program and are screened from inclusion in RICT Program calculations. 6.2.2 Straight Line Winds The straight-line wind hazard includes winds primarily from thunderstorms and extratropical storms. Since these events involve a lower wind speed, the primary consideration is a loss of offsite power (LOOP). Industry operating experience exists wherein building siding becomes a windborne missile. While the HNP Turbine Building is an open design, without siding, other nearby buildings have siding which may become a missile. These lightweight missiles, however, generally do not damage safety-related SSCs or other engineered structures (e.g., tanks). Additionally, the tanks themselves (i.e., Condensate Storage Tank and Refueling Water Storage Tank) are protected within concrete enclosures which limit missile vulnerability as well as incident angle of missiles. Thus, the primary concern for straight-line wind events is a LOOP. Since LOOP events are considered and modeled in the Internal Events PRA model, the hazard associated with straight-line winds is considered in the RICT calculations and need not be calculated separately. This would effectively constitute double counting. 6.2.3 Tornadoes Per the assessment of high winds in Section 3.3 of the HNP Final Safety Analysis Report (FSAR), structures, systems, or components (SSCs) whose failure (due to design wind loading, tornado wind loading, or associated missiles) could prevent safe shutdown of the reactor, or result in significant uncontrolled release of radioactivity from the unit, are protected from such failure by one of the following methods: a) the structure or component is designed to withstand design wind, tornado wind and tornado generated missiles, or b) the system or components are housed within a structure which is designed to withstand the design wind, tornado wind and tornado generated missiles. As such, the design basis for this event meets the criteria in the 1975 SRP and can be screened from inclusion in the calculations. Additionally, the most likely damage would be from a LOOP, which is already included in the internal events PRA model. 6.2.4 High Winds Conclusion Given the justification presented in Sections 6.2.1, 6.2.2 and 6.2.3 above, the High Winds hazard is being screened from the RICT Program application.

U.S. Nuclear Regulatory Commission Page 13 Serial: RA-19-0001 6.3 Other Hazards Table E4-2 provides a summary of the other external hazards screening results. Table E4-3 provides a summary of the progressive screening approach for external hazards. TABLE E4 SCREENING OF EXTERNAL HAZARDS Screening Result Screening External Hazard Screened? Criterion Comment (Y/N) (see Table E4-3) Aircraft impact analysis is discussed in the HNP UFSAR section 3.5.1.6 and the HNP IPEEE section 5.5.1. HNP is remote from federal airways, airports, airport approaches, military installation or airspace usage and, therefore, an Aircraft Impact Y PS2 aircraft hazard analysis is not required. The acceptance criteria from the SRP section 3.5.1.6 are met, thus no further screening is required. Changes since the IPEEE were analyzed in conjunction with industry assessments of other forms of sabotage. Avalanche Y C3 Not applicable to the site topography. Sudden influxes not applicable to the plant design. Slowly developing growth Biological Event Y C3, C5 can be detected and mitigated by surveillance. Coastal Erosion Y C3 Not applicable to the site because of location. Drought Y C2, C5 Plant design eliminates drought as a concern; and event is slowly developing. External flooding and local intense precipitation analysis are discussed in the HNP UFSAR section 3.4.1.1 and the HNP IPEEE section 5.4. The design basis for this event meets the criteria in the1975 Standard Review Plan (SRP) such that no safety-related structures will be jeopardized because of External Flooding Y PS2 the maximum still water level or wave run-up resulting from a probable maximum flood (PMF), or storm water accumulated at the plant site due to a probable maximum precipitation (PMP). Thus, external floods are not a significant hazard. Assessment of high winds is discussed in the HNP UFSAR section 3.3 and IPEEE section 5.3. The plant structures are designed to withstand the design Extreme Wind or wind load and the effects of tornado missiles. Thus, design basis for this Y PS2, C2 Tornado event meets the criteria in the1975 Standard Review Plan (SRP). Additionally, the most likely damage would be a loss of offsite power that is already included in the internal events model. See discussion in Section 6.2. Fog Y C1 Negligible impact on the plant. Forest or Range Y C3 Event cannot occur close enough to the plant. Fire Frost Y C1 Damage potential is lower than for events for which the plant is designed. Damage potential is lower than other events for which the plant is designed. Hail Y C1, C4 Potential flooding is addressed in the external flooding assessment. High Summer Damage potential is lower than for events for which the plant is designed. Y C1, C5 Temperature Impacts are slow to develop. High Tide, Lake Level, or River Y C3 Not applicable to the site because of location. Stage Hurricane Y C4 Addressed under Extreme Wind, Tornado, and External Flooding. Not applicable to the site because of location. Plant is designed for freezing Ice Cover Y C3, C4, C5 temperatures which are infrequent and short in duration. Impacts are slow to develop. External Flooding impact has already been addressed. Industrial or Nearby facility accidents are discussed in the HNP UFSAR section 2.2 and Y PS2 Military Facility the HNP IPEEE section 5.5.3. The industrial facilities and their products are

U.S. Nuclear Regulatory Commission Page 14 Serial: RA-19-0001 TABLE E4 SCREENING OF EXTERNAL HAZARDS Screening Result Screening External Hazard Screened? Criterion Comment (Y/N) (see Table E4-3) Accident located such distances from the plant site that they will pose no safety hazard to the plant site. Significant military facilities (support base for Army training operations) are located beyond 30 miles from the plant site, and therefore they will not pose any safety hazard to the plant site. Thus, the design basis for this event meets the criteria in the1975 SRP (RGs 1.91 and 1.78) Detailed An internal flooding PRA that meets the requirements of ASME/ANS RA-Sa-Internal Flooding N PRA 2009 has been developed and will be used for calculation of RICTs. The HNP fire PRA developed for the NFPA 805 amendment and that meets Detailed Internal Fire N the requirements of ASME/ANS RA-Sa-2009 will be used for calculation of PRA RICTs. Landslide Y C3 Not applicable to the site because of topography. Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events. However, other causes Lightning Y C4 are also included. The impacts are no greater than already modeled in the internal events PRA. Low Lake Level or Plant design eliminates low reservoir levels as a concern. Slowly developing Y C2, C5 River Stage event that can be easily mitigated. Low Winter Extended freezing temperatures are rare, the plant is designed for such Y C1, C5 Temperature events, and their impacts are slow to develop. Meteorite or Y C2 Negligible impact to the site. Satellite Impact Pipeline accidents are discussed in the HNP UFSAR section 2.2.3.2 and the HNP IPEE section 5.5.3.3. The effects of a pipeline accident generating missiles, fire, and seismic impacts are analyzed and determined to pose no hazard to the plant. HNP structures are design to withstand missiles at higher energy than missiles generated from this event. The potential fire from the migrating cloud of flammable or detonable propane was evaluated and Pipeline Accident Y PS2 due to distance from the plant and site geography poses no hazard to the plant. Critical plant structures are designed so that they can withstand the overpressures and ground motions generated from a pipeline accident, hence it is concluded that a detonation of propane from the nearby pipeline will not result in unacceptable consequences. Thus, the design basis for this event meets the criteria in the 1975 SRP Release of Analyses of on-site chemicals has concluded that there is no credible impact Chemicals in Y C1 on toxic gas or chemical hazards. Onsite Storage River Diversion Y C3 Not applicable to the site because of location and plant design. Sand or Dust Y C3 Not applicable to the site because of location Storm Seiche Y C3 Not applicable to the site because of location. The event damage potential is less than other events for which the plant is Snow Y C1 designed. Potential flooding impacts covered under external flooding. Soil Shrink-Swell The potential for this hazard is low at the site, the plant design considers this Y C1, C5 Consolidation hazard, and the hazard is slowly developing and can be mitigated. Storm Surge Y C1 Not applicable to the site because of location. Toxic gas covered under release of chemicals in onsite storage, industrial or Toxic Gas Y C2, C4 military facility accident, and transportation accident. Transportation PS2, C3, Analyses of road and rail accidents are assessed in UFSAR section 2.2.3 and Y Accident C4 IPEEE Section 5.5.2. Release of toxic chemicals causing a control room

U.S. Nuclear Regulatory Commission Page 15 Serial: RA-19-0001 TABLE E4 SCREENING OF EXTERNAL HAZARDS Screening Result Screening External Hazard Screened? Criterion Comment (Y/N) (see Table E4-3) habitability concern due to an accident near the site is negligible. Marine accident not applicable to the site because of location. Aviation and pipeline accidents are covered under those specific categories. The plant is designed to withstand the blast loading and associated missiles from a nearby transportation of explosives event. Thus, transportation accidents pose no hazard to HNP or are evaluated by other events. Thus, potential transportation accidents meet the 1975 SRP requirements. Tsunami Y C3 Not applicable to the site because of location. The probability of turbine generated missiles impacting HNP buildings and Turbine-equipment is determined in UFSAR Section 3.5.1.3.4 to be less than 1E-6/yr. Generated Y C2 Potential accidents meet the 1975 SRP requirements for the design of the Missiles turbine and other potentially impacted buildings and equipment. Volcanic Activity Y C3 Not applicable to the site because of location. Waves Y C3 Not applicable to the site because of location. 6.3.1 External Flooding Screening HNP is a dry site with a nominal plant elevation of 260 feet (ft) mean sea level (MSL) and a maximum water level, due to the probable maximum flood event, of 257.7 ft. MSL. Therefore, the external flood hazard is not applicable for HNP (UFSAR, Section 3.4.1.1 and NEI 12-06, Section 6.2.1). The Harris external flood hazard was evaluated as part of the Fukushima response orders. The NRC staff reviewed the information regarding the HNP reevaluation of flood-causing mechanisms and documented its staff assessment by letter dated April 29, 2015 (ADAMS Accession No. ML15104A370). The NRC staff assessment was supplemented by letter dated November 2, 2015 (ADAMS Accession No. ML15301A557). Some flood hazards described in the staff assessment exceed the current licensing and/or design basis. These hazards were further evaluated in the Focused Evaluation (FE) that was submitted by Duke Energy to the NRC by letter dated September 13, 2017 (ADAMS Accession No. ML17257A043). The FE provided conclusions on three flooding hazards. For flooding in streams and rivers and storm surge, site topography provides the needed flood protection. For local intense precipitation (LIP) flood protection is provided by site topography and plant structures (i.e. doors and structural barriers). Further, for LIP the potential flow paths where external flood water can enter the Waste Processing Building (WPB) have been evaluated and it has been determined that Key Safety Functions (KSFs) will not be affected by this event. The NRC staff concluded by letter dated December 15, 2017 (ADAMS Accession No. ML17335A121) that the HNP FE was performed consistent with the guidance described in Nuclear Energy Institute (NEI) 16-05, Revision 1, External Flooding Assessment Guidelines and that effective flood protection exists for the unbounded flooding mechanisms during a beyond-design-basis external flooding event at HNP. Based on the above evaluation and the information in Tables E4-2 and E4-3, the external flood hazard is being screened regarding the RICT Program application.

U.S. Nuclear Regulatory Commission Page 16 Serial: RA-19-0001 TABLE E4 PROGRESSIVE SCREENING APPROACH FOR ADDRESSING EXTERNAL HAZARDS Event Analysis Criterion Source Comments C1. Event damage potential NUREG/CR-2300 and is < that of events for which ASME/ANS Standard RA-Sa-plant is designed. 2009 C2. Event has lower mean NUREG/CR-2300 and frequency and no worse ASME/ANS Standard RA-Sa-consequences than other 2009 events analyzed. C3. Event cannot occur close NUREG/CR-2300 and Initial Preliminary Screening enough to the plant to affect ASME/ANS Standard RA-Sa-it. 2009 C4. Event is included in the NUREG/CR-2300 and Not used to screen. Used definition of another event. ASME/ANS Standard RA-Sa- only to include within another 2009 event. C5. Event develops slowly, allowing adequate time to ASME/ANS Standard eliminate or mitigate the threat. PS1. Design basis hazard ASME/ANS Standard RA-Sa-cannot cause a core damage 2009 accident. PS2. Design basis for the NUREG-1407 and event meets the criteria in the ASME/ANS Standard RA-Sa-NRC 1975 Standard Review 2009 Plan (SRP). Progressive Screening PS3. Design basis event mean frequency is < 1E-5/y NUREG-1407 as modified in and the mean conditional ASME/ANS Standard RA-Sa-core damage probability is < 2009 0.1. PS4. Bounding mean CDF is NUREG-1407 and

                             < 1E-6/y.                       ASME/ANS Standard RA-Sa-2009 Screening not successful.

NUREG-1407 and PRA needs to meet Detailed PRA ASME/ANS Standard RA-Sa-requirements in the 2009 ASME/ANS PRA Standard.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 5 Baseline CDF and LERF

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE The purpose of this Enclosure is to document the baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the hazards used for the Harris TSTF-505 license amendment request (LAR) and the RICT Program. The baseline plant risk is an integral part of the calculation of risk-informed completion times (RICTs).

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002.

4. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011.

3.0 INTRODUCTION

Section 4.0, Item 6 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the LAR provide the plant-specific total CDF and total LERF to confirm that these are less than 10-4/year and 10-5/year, respectively. This assures that the potential risk increases allowed under the RICT Program are consistent with the limits set forth in RG 1.174, Revision 1 (Reference 3). Note that RG 1.174, Revision 2 (Reference 4), issued by the NRC in May 2011, did not revise these limits. 4.0 BASELINE RISK Baseline risk, as well as the model files used to reproduce baseline risk, are documented in each hazards quantification calculation. Baseline risk, in these calculations, are documented as nominal-maintenance. For the quantitative purposes of this LAR, these nominal-maintenance results are utilized as a bounding representation of CDF and LERF. Note that for RICT Program implementation, the models used will be no-maintenance models. The baseline results from the Harris PRA models are provided in Table E5-1 below.

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 TABLE E5 TOTAL BASELINE CDF & LERF Baseline CDF Baseline LERF Source Contribution Source Contribution Internal Events PRA 2.86E-06 Internal Events PRA 1.07E-06 Internal Flooding PRA 2.36E-06 Internal Flooding PRA 1.73E-07 Fire PRA 3.20E-05 Fire PRA 2.86E-06 Seismic1 2.14E-06 Seismic1 No significant contribution Other External Events No significant contribution Other External Events No significant contribution Total CDF 3.94E-05 Total LERF 4.10E-06 Note 1: The Seismic contribution is a bounding penalty factor, as documented in Enclosure 4. As demonstrated, CDF is less than the limit of 1E-04 imposed by RG 1.174 (Reference 4). LERF is also lower than the imposed limit of 1E-05. Thus, the PRA models are acceptable for use in risk-informed applications.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 6 Justification of Application of At-Power PRA Models to Shutdown Modes

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 This enclosure is not applicable to Shearon Harris Nuclear Power Plant, Unit 1 (HNP). Duke Energy is proposing to apply the Risk-Informed Completion Time Program only in Modes 1 and 2 and not in any other Mode.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 7 PRA Model Update Process

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE This enclosure describes how the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) PRA models used in the calculation of Completion Times are maintained consistent with the as-built, as-operated plant.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Duke Energy procedure, AD-NF-NGO-0502, Probabilistic Risk Assessment (PRA)

Model Technical Adequacy, Revision 3, March 2019.

3.0 INTRODUCTION

Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a discussion of the licensees programs and procedures which assure the Probabilistic Risk Assessment (PRA) models which support the Risk-Managed Technical Specifications (RMTS) are maintained consistent with the as-built/as-operated plant. This enclosure describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions will be identified and reviewed prior to implementation to determine if they could impact the PRA models per AD-NF-NGO-0502 (Reference 3). The configuration control program will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models, which will be addressed by the applicable site Corrective Action Program (CAP). Should a plant change or a discovered condition be identified that has a significant impact to the RICT Program calculations, as defined by the above procedure, an unscheduled update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic updates are typically performed every four years. 4.0 PRA MODEL UPDATE PROCESS 4.1 PRA Model Maintenance and Update The Duke Energy risk management process ensures that the applicable PRA models (i.e., Internal Events, Internal Flooding, and Fire models) used to support the RICT program reflect the as-built and as-operated plant. The PRA configuration control procedure (Reference 3)

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 delineates the responsibilities and guidelines for updating the PRA models and includes criteria for both periodic and unscheduled PRA model updates. The process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors/limitations identified in the model), assessing the risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the Configuration Risk Management Program (CRMP) model. Changes to the PRA models that are considered an upgrade (as opposed to an update) per the ASME/ANS PRA Standard receive a peer review focused on those aspects of the PRA models that represent the upgrade. In this way, the PRA models are ensured to remain in compliance with the ASME/ANS PRA Standard. Any open finding level facts and observations are discussed and dispositioned in Enclosure 2. 4.2 Review of Plant Changes for Incorporation into the PRA Models The following describes the process used to review plant changes for applicability to the PRA models.

1. Plant changes or discovered conditions are reviewed for potential impact to the PRA models, including the CRMP model and the subsequent risk calculations which support the RICT program (Reference 2, Section 2.3.4, Items 7.2 and 7.3, and 2.3.5, Items 9.2 and 9.3).

2. Plant changes that meet the criteria defined in Reference 3 will be incorporated into the applicable PRA model(s), consistent with Reference 2 guidance. Otherwise, the change is assigned a priority and is incorporated as part of a subsequent periodic update in accordance with procedural requirements (Reference 2, Section 2.3.5, Item 9.2).

3. PRA updates for plant changes are performed at least once every two refueling cycles, consistent with the guidance of NEI 06-09 (Reference 2, Section 2.3.4, Item 7.1 and 2.3.5, Item 9.1).

4. If a PRA model change is required for the CRMP model but cannot be immediately implemented for a significant plant change or discovered condition, either:

a. Interim analyses to address the expected risk impact of the change will be performed. In such a case, these interim analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance in Reference 2.

b. Appropriate administrative restrictions on the use of the RICT Program for extended Completion Times (CTs) are put in place until the model changes are completed, consistent with the guidance of Reference 2.

These actions satisfy the requirements of Reference 2, Section 2.3.5, Item 9.3.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 8 Attributes of the Real-Time Model

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE This enclosure describes how the baseline Probabilistic Risk Assessment (PRA) model, which calculates average annual risk, is evaluated and modified for use in a real-time risk (RTR) model to assess real-time configuration risk, and describes the scope of, and quality controls applied to, the real-time model. In NEI 06-09-A, the RTR model is referred to as the Configuration Risk Management Program (CRMP), but that term is not used in TSTF-505. The two terms are used here interchangeably.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

4. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011.

3.0 INTRODUCTION

Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a description of PRA models and tools used to support the RMTS. This includes identification of how the baseline PRA model is modified for use in the CRMP tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. This item should also confirm that the Risk-Informed Completion Time (RICT) Program tools can be readily applied for each Technical Specification (TS) Limiting Condition for Operation (LCO) within the scope of the plant-specific submittal. This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the CRMP software to support the RICT Program. The process employed to adapt the baseline models is demonstrated: x to preserve the Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) quantitative results x to maintain the quality of the peer-reviewed PRA models x to correctly accommodate changes in risk due to configuration-specific considerations. Quality controls and training programs applicable to the CRMP are also discussed in this enclosure.

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 4.0 TRANSLATION OF BASELINE PRA MODEL FOR USE IN REAL-TIME RISK The baseline PRA models for Internal Events, Internal Flooding, and Fire are the peer-reviewed models which will be implemented into the CRMP software tool. These models are updated when necessary to incorporate plant changes to reflect the as-built, as-operated plant. The three models are all currently maintained as separate models. These models will be used in the CRMP. The models may be optimized for quantification speed but are verified to provide the same result as the baseline models in accordance with approved procedures. The CRMP software will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. The baseline PRA models are modified as follows for use in configuration risk calculations: x The unit availability factor is set to 1.0 (i.e., the unit is available) x Maintenance unavailability of structures, systems, and components (SSCs) in the PRA model is set to zero/false unless the unavailability is due to the configuration in question x Mutually exclusive combinations, including normally-disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration x Average alignment fractions of running/standby equipment trains are adjusted to one/true or zero/false to accurately represent the configuration. The CRMP software is designed to quantify the unit-specific configuration for Internal Events, Internal Flooding, and Fire, and includes the Seismic penalty factor when calculating the risk management action time (RMAT) and RICT. The unique aspect of the CRMP software for the RICT Program is the quantification of Internal Flooding and Fire risk, as well as the inclusion of the Seismic penalty factor. The other adjustments above are those used for the evaluation of risk under the 10CFR50.65(a)(4) program. 5.0 QUALITY REQUIREMENTS AND CONSISTENCY OF PRA MODEL AND CONFIGURATION RISK TOOLS The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA model update process (described in Enclosure 7) and the use of self-assessments and independent peer review (described in Enclosure 2). The information provided in Enclosure 2 demonstrates that the sites Internal Events, Internal Flood, and Fire PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide 1.200 (Reference 3). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing initiatives. For maintenance of an existing CRMP model, changes made to the baseline PRA model in translation to the CRMP model are currently, and will continue to be, controlled and documented. An acceptance test is performed after every CRMP model update. This testing also verifies correct mapping of plant components to the basic events in the CRMP model. 6.0 TRAINING AND QUALIFICATION The PRA staff is responsible for development and maintenance of the CRMP model. Operations and Work Control staff will use the CRMP tool under the RICT Program. PRA Staff

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 and Operations are trained in accordance with a program using National Academy for Nuclear Training (NANT) documents (ACAD), which is also accredited by the Institute of Nuclear Power Operations (INPO). 7.0 APPLICATION OF THE CRMP TOOL TO THE RICT PROGRAM SCOPE The chosen CRMP tool, an Electric Power Research Institute (EPRI) product called Phoenix Risk Monitor (PRM), will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. This program is specifically designed to support implementation of the RICT Program. PRM will permit the user to evaluate all plant configurations using appropriate mapping of plant equipment to PRA basic events. The equipment in the scope of the RICT Program will be able to be evaluated in the appropriate PRA models. The CRMP will meet RG 1.174 (Reference 4) and Duke Energy software quality assurance requirements.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 9 Key Assumptions and Sources of Uncertainty

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE The purpose of this enclosure is to document the assumptions and sources of uncertainty of the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) Probabilistic Risk Assessment (PRA) models in support of the Risk-Informed Completion Time (RICT) Program in accordance with NEI 06-09-A (Reference 1). Specifically, this enclosure provides a summary of the process for determining the assumptions and sources of uncertainty in the PRA models, including the determination of which of those are key assumptions and sources of uncertainty, and to provide dispositions of those assumptions and sources of uncertainty for the PRA models used in development of the real-time risk (RTR) model used to determine RICTs. In addition, NEI 06-09-A requires that the uncertainty be addressed in RICT Program RTR tools by consideration of the translation from the PRA model. The RTR model, also referred to as the Phoenix model as discussed in Enclosure 8, includes Internal Events, Internal Flooding and Fire PRA models. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the RTR tool during RICT Program calculations.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Final Report, Revision 1, March 2017.

4. EPRI 1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008.

5. EPRI 1026511, Practical Guidance on the use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, December 2012.

6. EPRI 1013491, Guideline for the Treatment of Uncertainty in Risk-Informed Applications, October 2006.

3.0 INTRODUCTION

Section 4.0, Item 10 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a discussion of how the key assumptions and sources of uncertainty were identified and how their impact on the RICT Program was assessed and dispositioned. 4.0 ASSUMPTIONS AND SOURCES OF UNCERTAINTY 4.1 Process for Identification of Assumptions and Sources of Uncertainty To identify the assumptions and uncertainties used in the Internal Events and Internal Flood base PRA models supporting the RICT Program, the generic issues identified in Table A.1 of

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 EPRI 1016737 (Reference 4) were reviewed, as well as the PRA documentation for plant-specific assumptions and uncertainties. This identification process is consistent with NUREG-1855 Revision 1 (Reference 3) Stage E. To identify the assumptions and uncertainties used in the Fire base PRA model supporting the RICT Program, the generic issues identified in EPRI 1026511 (Reference 5) were reviewed, as well as the PRA documentation for plant-specific assumptions and uncertainties. This identification process is consistent with NUREG-1855 Revision 1 (Reference 3) Stage E. 4.2 Process for Identification of Key Assumptions and Sources of Uncertainty To determine whether each assumption or uncertainty is key or not for this application, the assumption or uncertainty was individually assessed based on the definitions in RG 1.200 Revision 2, NUREG-1855 Revision 1 (Reference 3), and related references (i.e., EPRI 1016737, EPRI 1013491, and EPRI 1026511; References 4, 6, and 5, respectively). These documents provide definitions and guidance to identify if a specific assumption or uncertainty is key for an application and requires further consideration of the impact to the application. This assessment was applied to all uncertainties and assumptions identified via the methods described in Section 4.1 for the internal hazards (including fire). Assumptions or uncertainties determined not to be key are those that do not meet the definitions of key uncertainty or key assumption in RG 1.200 Revision 2, NUREG-1855 Revision 1 (Reference 3), or related references. Specifically, the following considerations were used to determine those assumptions and uncertainties that do not require further consideration as key to the application: x The uncertainty of assumption is implementing a consensus model as defined in NUREG-1855 Revision 1 (Reference 3). x The uncertainty or assumption will have no impact on the PRA results and therefore no impact on the duration of the calculated RICT. x There is no different reasonable alternative to the assumption which would produce different results and/or there is no reasonable alternative that is at least as sound as the assumption being challenged. (RG 1.200 Revision 2) x The uncertainty or assumption implements a conservative bias in the PRA model, and that conservatism does not influence the results. These conservatisms are expected to be slight and only applied to minor contributors to the overall model. EPRI 1013491 (Reference 6) uses the term realistic conservatisms. Thus, uncertainties and assumptions that implement realistic (slight) conservatisms can be screened from further consideration. x EPRI 1013491 (Reference 6) elaborates on the definition of a consensus model to include those areas of the PRA where extensive historical precedence is available to establish a model that has been accepted and yields PRA results that are considered reasonable and realistic. Thus, uncertainties and assumptions for which there is extensive historical precedence, and for which produced results are reasonable and realistic, can be screened from further consideration. If the assumption or uncertainty does not meet one of the considerations above, then it is retained as key for the application and is presented in Table E9-1.

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 This assessment was applied to all uncertainties and assumptions identified via the methods in Section 4.1 for the internal hazards (including fire). 4.3 Identified Key Sources of Uncertainty Table E9-1 below provides the identified key sources of uncertainty, the characterization of the uncertainty and a disposition for each uncertainty regarding the RICT Program.

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 TABLE E9 IDENTIFIED KEY ASSUMPTIONS AND UNCERTAINTIES - INTERNAL HAZARDS (INTERNAL EVENTS, FLOOD, AND FIRE) Item Assumption/ Uncertainty Discussion Disposition

1. Common Cause Failure (CCF) In the calculations, MGL factors for group size four were While it would be preferable to model full combinations for all CCF Modeling available, so the fifth valve was conservatively assumed to fail in groups, none of the identified groups greater than 4 members Multiple Greek Letter (MGL) common cause. appear in base case model cutsets. As is, with the conservative Factors implementation, there is no impact on model results and therefore Model: Internal no impact on the application.

Events/Flood/Fire

2. CCF Modeling CCF of the RHR suction and discharge check valves is not In the HNP model, CCF events for check valves are set to 0 due Residual Heat Removal (RHR) modeled, in lieu of the modeling of the CCF for RHR pump to the exceedingly low failure rate of check valves. MGL values Check Valve CCF failures to start. are 0 in the data. In addition, the current NRC data for check Model: Internal valve failures to open lists the alpha factors (through a grouping of Events/Flood/Fire 8) at 0. Thus, the RICT Program is not sensitive to this uncertainty.

3. CCF Modeling CCFs were considered only for those combinations of The most risk significant ESFAS CCF events in base cutsets are Engineered Safety Features components which would disable both trains of ESFAS, since on the order of E-4 F-V. These events cannot apply to a one-train Actuation System (ESFAS) the probability of a lesser CCF disabling one train in conjunction failure given that there are only 2 components to fail. Even Same-Train CCFs with another random failure is probabilistically insignificant. assuming they could, the risk is negligible in the model and will not Model: Internal impact RICT calculations appreciably.

Events/Flood/Fire

4. CCF Modeling CCFs of the SSPS logic (digital circuitry) were not modeled due A sensitivity was performed wherein a new basic event Solid State Protection System to the very high reliability of these components. representing CCF failure of SSPS buses was added, using the (SSPS) CCFs latest CCF data. This should be mostly bounding considering the Model: Internal higher failure rate (E-4) of this high-level component versus the Events/Flood/Fire low failure rate (E-6) of lower level redundant components such as fuses. The sensitivity had a negligible risk increase on CDF (1E-8). This does not appreciably affect the results of RICT calculations, so the RICT Program is therefore not sensitive to this uncertainty.

5. CCF Modeling The modeling of CCW pump fail-to-start and fail-to-run CCFs, This uncertainty seems to be harshly conservative when Component Cooling Water while necessary, has a number of assumptions. compared to current data sets. Current Internal Events F-V of (CCW) CCF Modeling CCW CCF is on the order of 2E-03, with negligible contribution to Model: Internal Internal Flooding and Fire. That said, however, the currently-Events/Flood/Fire modeled CCF parameters have beta factors of E-2 while current 15&GDWD&&)3DUDPHWHU(VWLPDWLRQVKDVIDFWRUVRI

and E-3 for start and run, respectively. Given that current data is

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 TABLE E9 IDENTIFIED KEY ASSUMPTIONS AND UNCERTAINTIES - INTERNAL HAZARDS (INTERNAL EVENTS, FLOOD, AND FIRE) Item Assumption/ Uncertainty Discussion Disposition lower for CCW CCF, this is a conservative uncertainty which otherwise should not impact RICT calculations.

6. Containment Sump Clog The containment sumps are designed to accommodate a certain A sensitivity was performed in which the basic event modeling Modeling amount of debris assumed to exist in containment. containment sump clogging due to debris was increased roughly Model: Internal Administrative controls are provided to limit the amount of loose two orders of magnitude. There was a negligible risk increase for Events\Flood\Fire items allowed into containment, and inspections are conducted all hazards and would not appreciably impact calculated RICTs.

after containment entries per the Technical Specifications. Therefore it is judged that the RICT Program is not sensitive to Based on these controls, sump clogging due to debris intrusion this uncertainty. on the sump screens is expected to be a non-significant contributor to RHR system unavailability. Clogging of the sumps is conservatively addressed in the model.

7. ESFAS Actuation Modeling ESFAS actuations are considered only for those components of Adding ESFAS components which provide additional signals that Model: Internal significance for prevention of core damage or containment accomplish the same functions will decrease the importance of the Events/Flood/Fire failure. Components having limited impact on the safe components which are modeled as performing those functions.

shutdown of the plant and mitigation of accidents are not However, the importance of the ESFAS components that are not addressed in this analysis. modeled would obviously be understated. For the LCOs proposed to be in scope for the RICT Program, the components themselves or logically equivalent surrogates are used. Other unmodeled ESFAS actuations are already risk insignificant, and any increase in their importance is not expected to impact RICT calculations.

8. Requirement to Isolate After the accumulators have emptied, the operator is required by The action to isolate the accumulators is part of the action to Accumulators After Injection emergency operating procedures to close the three accumulator cooldown and depressurize the RCS for transients and SGTRs, Model: Internal discharge valves and lock the breakers open in order to prevent which is modeled in the PRA via HFEs OPER-9 "Failure to initiate Events/Flood/Fire injecting nitrogen into the RCS. This action is not assumed to RCS cooldown to use LPSI/RHR" and OPER-41 "Failure to initiate be required in the PRA. RCS cooldown to use LPSI/RHR (SGTR)". However, the specific execution steps to isolate the accumulators are not included in the This is not an issue for large and medium LOCAs where an N2 development of the HEP.

is likely to be swept out of the break. However, for small LOCAs or transients in which the RCS must be depressurized to get to The execution steps to isolate the accumulators will be added to shutdown conditions, the insertion of N2 into the RCS could be these HFE calculations prior to implementation of the RICT an issue. Program.

9. Modeling of Condensate Based on the diversity of the instrumentation, the unavailability These level transmitters only required for HFE OPER-29 Storage Tank (CST) Level "FAILURE TO ALIGN ESW TO AFW PUMP(S)". Thus, a

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 TABLE E9 IDENTIFIED KEY ASSUMPTIONS AND UNCERTAINTIES - INTERNAL HAZARDS (INTERNAL EVENTS, FLOOD, AND FIRE) Item Assumption/ Uncertainty Discussion Disposition Indication of CST level indication is not modeled in the fault tree. sensitivity was performed wherein OPER-29 was increased by a Model: Internal factor of 3 and propagated through the dependence analysis. The Events/Flood/Fire sensitivity resulted in a negligible risk increase. Therefore, the RICT Program is not sensitive to this uncertainty.

10. CCW Pre-Initiator Operator Since testing would follow any maintenance activities on the A sensitivity was performed which added a pre-initiator operator Action Modeling standby train, and since valve lineups are double verified error for both the A & B CCW trains when needing to start. The Model: Internal following maintenance, no pre-initiator operator errors for the value was chosen to be the most limiting pre-initiator value in the Events/Flood/Fire standby train are postulated. model, which is likely conservative. The results show a risk increase is on the order of E-8, which does not appreciably affect RICT calculations. Additionally, after maintenance on a CCW train, a flow test is performed, which should preclude the error altogether. It is therefore judged that the RICT Program is not sensitive to this uncertainty.

11. Medium LOCA Thermal- The selection of an 8-inch LOCA to establish the time available A sensitvity was performed in which the available time of the Hydraulics Relating to for operators to manually start the RHR pumps is unclear. The action (OPER-47 "Failure to Manually Start RHR Pumps (N/A to Mitigation with RHR range established for medium LOCAs is 5 inches to 13 inches Large LOCAs") was reduced by over half, which resulted in an Model: Internal such that the time could be shorter. Selecting a 13-inch break HEP increase of over one decade. The new value was Events/Flood/Fire would provide a bounding analysis. propagated through the dependence analysis and the Internal Events model was re-run. Results show a negligible increase in CDF (on the order of E-9 or less) and no increase in LERF.

Therefore, the RICT Program is not sensitive to this uncertainty.

12. Small LOCA Thermal- The selection of a 3-inch LOCA to establish the time available This operator action (OPER-49, "Failure to Manually Align Hydraulics Relating to for operators to establish an alternate HHSI injection path is not Alternate HHSI Path") showed to be insensitive to reduced Mitigation with High Head clear. The upper end of the small (S2) LOCA range is 5 inches timeline, so a sensitivity was performed in which the HEP was Safety Injection (HHSI) such that the time could be shorter. Selecting that size should tripled and propagated through the dependence analysis. Results Model: Internal provide a bounding analysis. show a negligible increase in CDF and LERF (each on the order of Events/Flood/Fire E-9 or less). Therefore, the RICT Program is not sensitive to this uncertainty.

13. Containment Fan Cooler (CFC) The CFC system is assumed to be protected from damage due A spatial analysis was performed which shows that two of the Modeling Regarding LOCAs to LOCA initiators. Although failure of the CFCs due to LOCA CFCs (AH-3 and AH-4) are on the 286 ft level of containment, Model: Internal effects for small LOCAs can be discounted, no spatial analysis while the other two (AH-1 and AH-2) are on the 236 ft level, such Events/Flood/Fire has been performed for largers LOCAs. that a LOCA event would not impact CFCs on both floors. On the 286 ft level, the two CFCs are on the containment wall approximately 60 degrees apart such that a single Large LOCA

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 TABLE E9 IDENTIFIED KEY ASSUMPTIONS AND UNCERTAINTIES - INTERNAL HAZARDS (INTERNAL EVENTS, FLOOD, AND FIRE) Item Assumption/ Uncertainty Discussion Disposition would not impact both CFCs. Similarly, on the 236 ft level the two CFCs are on the containment wall approximately 60 degrees apart such that, again, a single Large LOCA would not impact both CFCs. A sensitivity was performed in which all large and medium LOCAs impact a single CFC, while the other 3 are unaffected. The sensitivity returned no risk delta. Therefore, the RICT Program is not sensitive to this uncertainty.

14. Emergency Service Water A failure of ESW due to backflow through the NSW system if Further evaluation of the interconnection between the ESW and (ESW) Failure Due to Backflow NSW fails to isolate is not postulated since a motor-operated NSW systems shows that additional failures would be required to Through Normal Service Water valve (MOV) and a check valve would both need to fail to close get backflow through the NSW system. When an NSW pump trips (NSW) if the NSW pump is unavailable or fails to run. or is stopped, its discharge MOV automatically closes.

Model: Internal Additionally, when and ESW pump starts, the ESW cross-tie MOV Events/Flood/Fire (1SW-39 or 1SW-40) between the NSW supply and the ESW supply automatically closes. Thus, to get backflow through the NSW system on ESW start would require the running NSW pump to fail to run, failure of its discharge MOV to close, failure of the common NSW supply check valve (1SW-59) to close, and failure of an ESW cross-tie valve (1SW-39 or 1SW-40) to close. In the HNP PRA model the failure rate for an MOV to close on demand is 3.5E-03. Since there is no common cause between the NSW pump discharge MOV and the ESW cross-tie MOV, the probability of failure of both is 1.2E-05. The probability of the running NSW pump failing over the 24 hour mission time is 1.4E-04 (basic event VPMNSWPAVR). Therefore, even ignoring the check valve, the likelihood of this event is approximately 1.7E-09. Therefore, this assumption has a negligible impact on the acceptance criteria for TSTF-505 and will not appreciably affect RICT calculations.

15. Fire Detection/Suppression In the HNP fire model, it is assumed that if no detection system For fire zones with no detection system installed, the chief concern Model: Fire is installed in an area, manual detection will occur in 15 minutes. surrounding detection time is the formation of a hot gas layer Although this assumption is probably realistic, some fire (HGL). The compartments these zones are in are either:

compartments may have a relatively low potential of fire 1) physically incapable of generating a HGL due to room size or detection, especially if they are closed and have low occupancy location (e.g., outside), levels. 2) probabilistically insignificant to fire risk, or

3) contain no important equipment/cables, and thus do not

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 TABLE E9 IDENTIFIED KEY ASSUMPTIONS AND UNCERTAINTIES - INTERNAL HAZARDS (INTERNAL EVENTS, FLOOD, AND FIRE) Item Assumption/ Uncertainty Discussion Disposition contribute at all to plant risk.

U.S. Nuclear Regulatory Commission Page 10 Serial: RA-19-0001 5.0 ASSESSMENT OF TRANSLATION (REAL-TIME RISK MODEL) UNCERTAINTIY IMPACTS Incorporation of the baseline PRA models into the Real Time Risk model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-2 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion regarding the Real-Time Risk model. TABLE E9 ASSESSMENT OF TRANSLATION UNCERTAINTY IMPACTS Real Time Risk Portion of Model Model Change and Impact on Model Disposition Affected Assumptions PRA model logic Fault tree logic The model, if restructured, will be logically Since the restructured model will structure may be model structure, equivalent and will produce results produce comparable numerical optimized to affecting both comparable to the baseline PRA logic results, this is not a source of increase solution internal and fire model. uncertainty for the RICT Program. speed. PRAs. Incorporation of Calculation of The addition of bounding impacts for Since this is a bounding approach for seismic risk bias to RICT and RMAT seismic events has no impact on baseline addressing seismic risk in the RICT support RICT within Real-Time PRA or the Real-Time Risk model. Impact Program, it is not a source of Program risk Risk model. is reflected in calculation of all RICTs and translation uncertainty, and the RICT calculations RMATs. Program calculations are not A conservative value impacted; thus, no mandatory RMAs for the Seismic risk are required. is applicable. Set plant availability Basic event X- Since the Real-Time Risk model evaluates This change is consistent with Real-factor (Reactor POWEROP specific configurations during at-power Time Risk tool practice; therefore, this Critical Years conditions, the use of a plant availability change does not represent a source Factor) basic event factor less than 1.0 is not appropriate. of uncertainty and RICT program to 1.0. This change allows the Real-Time Risk calculations are not impacted. Thus, model to produce appropriate results for no mandatory risk management specific at-power configurations. actions (RMAs) are required.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 10 Program Implementation

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE This enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the Risk-Informed Completion Time (RICT) Program implementation including training of plant personnel, and specifically discusses the decision process for risk management action (RMA) implementation during extended Completion Times (CTs).

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3.0 INTRODUCTION

Section 4.0, Item 11 of the NRC Final Safety Evaluation for NEI 06-09-A (Reference 1) requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the RMTS implementation, and specifically discuss the decision process for RMA implementation during a RICT. This enclosure provides the required description. 4.0 RICT PROGRAM AND PROCEDURES A program description and implementing procedures will be developed by Duke Energy for the RICT Program. This program description will serve to establish management responsibilities and general requirements for training, implementation, and monitoring of the RICT Program, including development and maintenance of the Configuration Risk Management Program (CRMP) software tool and model reflecting the as-built, as-operated plant. The RICT program will be implemented by site procedures which fully address all aspects of the guidance in NEI 06-09-A (Reference 2). The program will be integrated with online work control processes, which identify the need to enter a Limiting Condition of Operation (LCO) Action Statement. Operations, specifically the control room staff, is responsible for compliance with Technical Specifications (TS). With RICT Program implementation, Operations will additionally be responsible for implementation of a RICT and any RMAs determined to be appropriate for the plant configuration. Entry into a RICT will require management approval prior to planned maintenance activities and as soon as practical following emergent conditions. The procedures developed for the RICT Program will address the following attributes consistent with NEI 06-09-A: x Plant management positions with authority to approve entry into the RICT Program, both for pre-planned maintenance activities and emergent conditions x Definitions related to the RICT Program x Plant conditions for which the RICT Program is applicable

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 x Departmental and positional responsibilities for activities in the RICT Program x Conditions under which entry into a RICT is forbidden or otherwise may not be voluntarily entered for calculation of RICTs and RMA Times (RMATs) x Conditions for exiting a RICT x Implementation of the RICT Programs 30-day back-stop limit x Use of the CRMP software tool with the RICT Program x Requirements to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded x Consideration of common cause failure (CCF) potential in emergent RICTs x The use of RMAs, including the conditions under which they may be credited in RICT calculations x Requirements for training on the RICT Program x Documentation requirements as they relate to individual RICT calculations, implementation of extended CTs, and accumulated annual risk 5.0 RICT PROGRAM TRAINING The scope for training for the RICT Program will include rules for the new TS program, CRMP tool, TS Actions included in the RICT Program, and the implementing procedures as determined using a Systematic Approach to Training (SAT) for the applicable personnel. Training will be conducted for the following Duke Energy personnel, as applicable: Site Personnel x Plant Manager x Operations Manager x Operations Personnel (Licensed and Non-Licensed) x Operations Work Control Managers x Operations Work Control Personnel x Work Week Managers x Operations Training x Outage Manager x Engineering x Regulatory Personnel x Selected Maintenance Personnel x Other Selected Management x Site NRC Resident Inspector Corporate Personnel x Operations Corporate Functional Area Manager x Licensing/Regulatory Affairs Management and Personnel x Probabilistic Risk Assessment Management and Personnel x Training Management and Personnel x Other Selected Management

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001 Training will be carried out in accordance with the Systematic Approach to Training as well as Duke Energy training procedures and processes. Duke Energy procedures are written based on the Institute of Nuclear Power Operations (INPO) Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training (NANT). Duke Energy has planned three levels of training for implementation of the RICT Program. They are described below. 5.1 Level 1 Training - User Training This training is the most detailed and is intended for those individuals who will be directly involved in the implementation of the RICT Program. 5.2 Level 2 Training - Management Training This training is applicable to plant management positions with the authority to approve entry into the RICT Program, as well as those supervisory, managerial, and other positions who will closely support RICT Program implementation. This group of personnel will not be qualified to perform the tasks for actual implementation of the RICT Program. 5.3 Level 3 Training - Site Awareness Training This training is intended for the remaining personnel who require an awareness of the RICT Program.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 11 Monitoring Program

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE This enclosure describes the monitoring program for cumulative risk impacts as described in NEI 06-09-A, Section 2.3.2, Step 7. This should include a description of how the calculations are made and what actions and thresholds are applied when corrective measures are necessary due to excessive risk increases.

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002.

4. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011.

5. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011.

3.0 INTRODUCTION

Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, Revision 1 (Reference 3) and NEI 06-09-A, Revision 0. Note that RG 1.174, Revision 2 (Reference 4), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC Safety Evaluation for Section 4.0, Item 12.

4.0 DESCRIPTION

OF THE MONITORING PROGRAM The Risk-Informed Completion Time (RICT) Program requires the calculation of the cumulative risk impact at least every refueling cycle, not to exceed 24 months, as set forth in NEI 06-09, Revision 0 (Reference 2). For each assessment period under evaluation, data will be collected for each of the risk increases associated with the application of the RICT Program (i.e., periods in which an extended Completion Time (CT) beyond the front-stop CT is invoked) and summed. This will be done for both Core Damage Frequency (CDF) and Large Early Release Frequency

/(5) 7KHGDWDRILQWHUHVWLVWKHFKDQJHLQ&')DQG/(5) ¨&')DQG¨/(5)UHVSHFWLYHO\

above the zero-maintenance baseline levels for the durations of operation in the extended CT. The calculated delta-risk is converted to average annual values. The resulting total average annual delta-risk for extended CTs is then compared to the guidance established in RG 1.174 (Reference 4), specifically Figures 4 and 5 for CDF and LERF, respectively. For cases in which the annual risk increase is acceptable (i.e., not in Region I), the RICT Program implementation is considered acceptable for the assessment period. Otherwise, further assessment of the factors causing the exceedance of RG 1.174 guidance, as

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 well as implementation of corrective actions to ensure continuing plant operation is within guidance, will be conducted under the sites Corrective Action Program. The assessment will raise some points for consideration for each evaluation period, including but not limited to the following: x RICT applications that dominate the annual risk increase x Relative contributions of planned and unplanned (i.e., emergent) RICT applications x Risk Management Actions (RMAs) implemented but not credited in the risk calculations x Risk of using a RICT versus not using a RICT and instead using multiple shorter system, structure, or component (SSC) outages x Reduction in overall risk levels through improvements to SSC reliability and availability due to improved maintenance strategies allowed through the RICT program Corrective actions identified in the assessment to be necessary and appropriate are developed and approved as appropriate. These may include: x Administrative restrictions on RICT use for specific high-risk configurations x Additional RMAs for specific high-risk configurations x Rescheduling of planned maintenance activities x Deferring planned maintenance to shutdown conditions x Use of temporary equipment to replace out-of-service SSCs x Plant modifications to reduce the risk impact of future planned maintenance configurations In addition to impacting cumulative risk, the unavailability of SSCs may also be impacted by the implementation of the RICT Program. The existing Maintenance Rule (MR) monitoring programs set forth in 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts that may be incurred from RICT Program implementation. Use of the MR Program is acceptable since SSCs in the scope of the RICT Program are also within the scope of the MR Program. The monitoring program for MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as defined in Element 3 of RG 1.174 and NEI 06-09-A.

U.S. Nuclear Regulatory Commission Page 1 Serial: RA-19-0001 Serial: RA-19-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400 / Renewed License No. NPF-63 License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Enclosure 12 Risk Management Action Examples

U.S. Nuclear Regulatory Commission Page 2 Serial: RA-19-0001 1.0 PURPOSE This enclosure describes the process for identification of Risk Management Actions (RMAs) applicable during extended Completion Times (CTs) and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program consistent with the guidance provided in NEI 06-09-A (Reference 2).

2.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, U.S. Nuclear Regulatory Commission, March 2017 (ADAMS Accession No. ML17062A466).

4. EPRI TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, Technical Update, Electric Power Research Institute, December 2012.

5. TSTF-505-A, Rev. 2, Technical Specifications Task Force Improved Standard Technical Specifications Change Traveler, November 2018.

6. Southern Nuclear Letter to US NRC, Vogtle Electric Generating Plant, Units 1 and 2 Response to Request for Additional Information on Technical Specifications Change to Adopt Risk Informed Completion Times, April 14, 2017 (ADAMS Accession No. ML17108A253).

3.0 INTRODUCTION

Section 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request (LAR) provide a description of the process to identify and provide compensatory measures and RMAs during extended CTs, including specific examples. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. These procedures will provide guidance for the determination and implementation of RMAs when entering the RICT Program and is consistent with the guidance set forth in NEI 06-09-A (Reference 2). 4.0 RESPONSIBILITIES Work Management is responsible for developing RMAs with assistance from Operations and Probabilistic Risk Assessment (PRA) for planned entries into the RICT Program. Operations is responsible for approval and implementation of these identified RMAs. Additionally, for emergent entries into the RICT Program, Operations is responsible for development of RMAs.

U.S. Nuclear Regulatory Commission Page 3 Serial: RA-19-0001 5.0 PROCEDURAL GUIDANCE For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. Additionally, if an emergent event occurs which requires recalculation of a RMAT already in place, the procedure will require a reevaluation of the existing RMAs for the new plant configuration to determine if the new RMAs are appropriate. These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A (Reference 2). For emergent entry into a RICT, if the extent of condition is not known, RMAs related to the success of redundant and diverse structures, systems, or components (SSCs) and reducing the likelihood of initiating events relying on the affected function will be developed to address the increased likelihood of a common cause event. RMAs will be implemented no later than the point at which an incremental core damage probability (ICDP) of 1.0E-06 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1.0E-07 is reached. If, as the result of an emergent condition, the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1.0E-03 per year or 1.0E-04 per year, respectively, RMAs are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A (Reference 2). By determining which SSCs are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. The guidance in NUREG-1855 (Reference 3) and EPRI TR-1026511 (Reference 4) will be used in examining PRA results for significant contributors for the configuration, to aid in identifying appropriate compensatory measures (e.g., related to risk-significant systems that may provide diverse protection, or important support systems, or human actions). Enclosure 9 identifies several areas of uncertainty in the Internal Events, Internal Flooding, and Fire PRAs that will be considered in defining configuration-specific RMAs when entering a RICT. If the planned maintenance activity or emergent condition scope includes an SSC that is identified to impact the Fire PRA as identified in the Configuration Risk Management Program (CRMP) software tool, Fire PRA-specific RMAs associated with that SSC will be implemented per plant procedure. It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and operator actions are modeled in the PRA; such quantification of RMAs, however, is neither required nor expected by NEI 06-09-A (Reference 2). Regardless, if RMAs are to be credited in RICT calculations, the relevant procedure instructions will be consistent with the guidance set forth in NEI 06-09-A (Reference 2). 6.0 TYPES OF RISK MANAGEMENT ACTIONS NEI 06-09-A (Reference 2) classifies RMAs into three categories, as discussed below.

U.S. Nuclear Regulatory Commission Page 4 Serial: RA-19-0001

1. Actions to increase risk awareness and control x Shift brief x Pre-job brief x Training (formal or informal) x Presence of system engineer or other subject matter expert (SME) related to the activity x Special purpose procedure to identify risk sources and contingency plans

2. Actions to reduce the duration of maintenance activities x Pre-staging materials x Conducting training on mock-ups x Performing the activity around the clock x Performing walkdowns on the actual system(s) to be worked on prior to beginning work

3. Actions to minimize the magnitude of the risk increase x Suspending or minimizing activities on redundant systems x Suspending or minimizing activities on other systems that adversely affect the CDF or LERF x Suspending or minimizing activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate x Using temporary equipment to provide backup power, ventilation, etc.

x Rescheduling other maintenance activities 7.0 EXAMPLE RMAs Representative examples of RMAs that may be considered during a RICT Program entry, to reduce the risk impact and ensure adequate defense-in-depth, for TS 3.8 electrical equipment and for several other examples are provided below. As directed in TSTF-505-A Rev 2 (Reference 5), additional focus has been made on TS 3.8, Electrical Power Systems, in particular, similar to what has been provided by Southern Nuclear in their request for additional information (RAI) response letter dated April 14, 2017 (Reference 6). 7.1 TS 3.8 ACTION STATEMENTS To adequately demonstrate a reasonable balance of defense-in-depth is maintained, the following sample RMAs are provided for TS 3.8 Action Statements, which pertain to safety-related electrical equipment. 7.1.1 TS 3.8.1.1 Action a - One Offsite Circuit Inoperable For TS 3.8.1.1 Action a, one offsite circuit inoperable, the sample calculated RICT provided in is on the order of 8 days compared to the current CT of 72 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained during the example emergent scenario for TS 3.8.1.1 Action a are as follows: x Prohibit elective maintenance on SSCs in accordance with plant procedure OMM-001, Operations Administrative Requirements, or current site-specific guidance.

U.S. Nuclear Regulatory Commission Page 5 Serial: RA-19-0001 x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Notify Energy Control Center regarding the planned entry into a RICT to avoid activities or conditions which stress the grid or otherwise increase the likelihood of a loss of offsite power. x Perform a beginning-of-shift-week brief that focuses on actions which operators will take in response to a loss of offsite power, including applicable AOPs and EOPs. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Consider continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Maintain availability of Fire Protection pumps. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. 7.1.2 TS 3.8.1.1 Action b - One Emergency Diesel Generator (EDG) Inoperable For TS 3.8.1.1 Action b, one EDG inoperable, the sample calculated RICT provided in is on the order of 26 days compared to the current CT of 72 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained during the example emergent scenario for TS 3.8.1.1 Action b are as follows: x Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Notify Energy Control Center regarding the planned entry into a RICT to avoid activities or conditions which stress the grid or otherwise increase the likelihood of a loss of offsite power. x Perform a beginning-of-shift-week brief that focuses on actions which operators will take in response to a loss of offsite power, including applicable AOPs and EOPs. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Consider continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure.

U.S. Nuclear Regulatory Commission Page 6 Serial: RA-19-0001 7.1.3 TS 3.8.1.1 Action d - Two Offsite Circuits Inoperable For TS 3.8.1.1 Action d, two offsite circuits inoperable, the sample calculated RICT provided in is on the order of 4 days compared to the current CT of 24 hours. This is a more bounding example than TS 3.8.1.1 Action a, which is discussed above in Section 7.1.1. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained during the example emergent scenario for TS 3.8.1.1 Action d are as follows: x Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Notify Energy Control Center regarding the entry into a RICT to avoid activities or conditions which stress the grid or otherwise increase the likelihood of a loss of offsite power. x Perform a beginning-of-each-shift brief that focuses on actions which operators will take in response to a loss of offsite power, including applicable AOPs and EOPs. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Establish continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Maintain availability of Fire Protection pumps. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. 7.1.4 TS 3.8.1.1 Action h - One Automatic Load Sequencer Inoperable For TS 3.8.1.1 Action h, one automatic load sequencer inoperable, the sample calculated RICT provided in Enclosure 1 is 30 days compared to the current CT of 24 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained during the example emergent scenario for TS 3.8.1.1 Action h are as follows: x Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Notify Energy Control Center regarding the planned entry into a RICT to avoid activities or conditions which stress the grid or otherwise increase the likelihood of a loss of offsite power.

U.S. Nuclear Regulatory Commission Page 7 Serial: RA-19-0001 x Perform a beginning-of-shift-week brief that focuses on actions operators will take in response to a loss of offsite power, including applicable AOPs and EOPs. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Consider continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. 7.1.5 TS 3.8.3.1 Action b - One 118V AC Vital Bus Not Energized from Associated Inverter For TS 3.8.3.1 Action b, one 118V AC vital bus not energized from its associated inverter, the sample calculated RICT provided in Enclosure 1 is 30 days, compared to the current CT of 2 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained during the example emergent scenario for TS 3.8.3.1 Action b are as follows: x Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Notify Energy Control Center regarding the planned entry into a RICT to avoid activities or conditions which stress the grid or otherwise increase the likelihood of a loss of offsite power. x Perform a beginning-of-each-shift brief that focuses on actions operators will take in response to a loss of offsite power, including applicable AOPs and EOPs. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Establish continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. 7.2 Other Example RMAs To provide a more diverse set of examples for sample RMAs, the following cases are provided to demonstrate that a reasonable balance of defense-in-depth is maintained. 7.2.1 TS 3.7.1.2 Action a - One Auxiliary Feedwater (AFW) Pump Inoperable For TS 3.7.1.2 Action a, one AFW pump inoperable, there are three distinct cases to examine - two separate motor-driven pumps and one turbine-driven pump. The limiting RICT calculation for TS 3.7.1.2 provided in Enclosure 1 is on the order of 25 days, compared with the current CT

U.S. Nuclear Regulatory Commission Page 8 Serial: RA-19-0001 of 72 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained for the cases of motor-driven and turbine-driven pumps are provided below: x Motor-Driven AFW Pump A o Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. o Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. o Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. o Perform a beginning-of-shift-week brief that focuses on actions operators will take in response to plant transients, including manual throttling of the turbine-driven AFW pump. o Verify required parts/materials on site prior to voluntary entry into a RICT. o Consider continuous maintenance coverage. o Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. o Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. x Motor-Driven AFW Pump B o Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. o Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. o Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. o Perform a beginning-of-shift-week brief that focuses on actions operators will take in response to plant transients, including manual throttling of the turbine-driven AFW pump. o Verify required parts/materials on site prior to voluntary entry into a RICT. o Consider continuous maintenance coverage. o Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. o Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. x Turbine-Driven Pump o Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. o Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs.

U.S. Nuclear Regulatory Commission Page 9 Serial: RA-19-0001 o Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. o Perform a beginning-of-shift-week brief that focuses on actions operators will take in response to plant transients, including manual operation of motor-driven AFW pumps. o Verify required parts/materials on site prior to voluntary entry into a RICT. o Consider continuous maintenance coverage. o Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. o Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure. 7.2.2 TS 3.7.3 Action - One Component Cooling Water (CCW) Flow Path Inoperable For TS 3.7.3 Action (undesignated), one CCW flow path inoperable, the calculated RICT provided in Enclosure 1 is 30 days, compared to the current CT of 72 hours. Example RMAs to ensure a reasonable balance of defense-in-depth is maintained for TS 3.7.3 Action (undesignated) are as follows: x Prohibit elective maintenance on SSCs in accordance with OMM-001, Operations Administrative Requirements, or current site-specific guidance. x Defer planned testing or maintenance with the potential to affect procedurally-protected SSCs. x Evaluate weather forecasts for the duration of the RICT prior to voluntary entry into a RICT. Take appropriate actions to mitigate potential impacts of severe weather for both voluntary and involuntary entries into a RICT. x Perform a beginning-of-shift-week brief that focuses on actions operators will take in response to plant transients, including operation of the Dedicated Shutdown Diesel Generator (DSDG) and the Alternate Seal Injection (ASI) system. x Verify required parts/materials on site prior to voluntary entry into a RICT. x Consider continuous maintenance coverage. x Evaluate currently ongoing maintenance activities and prioritize activities for return to service per CRMP Component Importance report. x Implement 10 CFR 50.65(a)(4) plant-specific Fire RMAs in accordance with site procedure.]]

v t e Letter Sequence Request
EPID:L-2019-LLA-0218, TSTF-505 (Approved, Closed)
Initiation Request Acceptance Supplement Administration Questions 29 September 2020 Answers 11 November 2020 Results Approval Other: ML20141L623, ML20175A575, ML20329A381, ML21116A207
MONTHYEAR2020-05-20 [Table View]

RA-19-0001, License Amendment Request to Revise Technical Specifications to Adopt Risk- Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b

Text

Subject:

Enclosures:

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

Background

2.0 REFERENCES

3.0 INTRODUCTION

Enclosure:

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

4.0 DESCRIPTION

2.0 REFERENCES

3.0 INTRODUCTION

Navigation menu

RA-19-0001, License Amendment Request to Revise Technical Specifications to Adopt Risk- Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b

Text

Subject:

Enclosures:

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

Background

2.0 REFERENCES

3.0 INTRODUCTION

Enclosure:

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

2.0 REFERENCES

3.0 INTRODUCTION

4.0 DESCRIPTION

2.0 REFERENCES

3.0 INTRODUCTION

Navigation menu

Search