ML20154K763

NRR E-mail Capture - Revision 2 to the Plan for the Audit of the Prairie Island Nuclear Generating Plant TSTF-505 License Amendment Request (Epdi: L-2019-LLA-0283)

ML20154K763
Person / Time
Site:	Prairie Island
Issue date:	06/02/2020
From:	Robert Kuntz NRC/NRR/DORL/LPL3
To:	Gohdes P Northern States Power Company, Minnesota
References
L-2019-LLA-0283
Download: ML20154K763 (29)

Text

From: Kuntz, Robert Sent: Tuesday, June 2, 2020 10:44 AM To: Gohdes, Peter D.

Subject:

Revision 2 to the Plan for the Audit of the Prairie Island Nuclear Generating Plant TSTF-505 License Amendment Request (EPDI: L-2019-LLA-0283)

Mr. Gohdes, As discussed in the messages dated March 20, 2020 (ADAMS Accession No. ML20083F420) and May 14, 2020 (ADAMS Accession No. ML20135G821), the NRC staff has determined that an electronic audit is necessary to support its review of the Prairie Island Nuclear Generating Plant, Units 1 and 2, TSTF-505 application. The staff is revising the questions related to the audit. Therefore, the following is an update to the plan for the audit transmitted on March 20, 2020 and revised by message dated May 14, 2020. The revised list of questions deletes previously transmitted Question 3f and adds Question 19. As noted during the audit discussions, the Nuclear Regulatory Commission staff does not request any information from Xcel Energy related to previously transmitted Question 3f related to a potential license condition.

If Xcel Energy has any questions or requires information contact me.

Robert Kuntz Senior Project Manager NRC/NRR/DORL/LPL3 (301) 415-3733 REVISED AUDIT PLAN BY THE OFFICE OF NUCLEAR REACTOR REGULATION TO SUPPORT THE REVIEW OF LICENSE AMENDMENT REQUEST TO ADOPT TSTF-505, REVISION 2, "PROVIDE RISK-INFORMED EXTENDED COMPLETION TIMES -

RITSTF INITIATIVE 4b PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-282 AND 50-306

1.0 BACKGROUND

By letter dated December 16, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19350C188179), Northern States Power Company, a Minnesota corporation, doing business as Xcel Entergy (NSPM), submitted a license amendment request for the Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The proposed amendment would modify the licensing basis of PINGP to allow for the implementation of the provisions of Technical Specification Task Force (TSTF) Traveler - 505, Provide Risk-informed Extended Completion Times - RITSTF Initiative 4b (Reference 1). The U.S. Nuclear Regulatory Commission (NRC) staff's review of the subject LARs has commenced in

accordance with the Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-101, "License Amendment Review Procedures" (Reference 2).

The NRC staff has determined that a regulatory audit of the LARs should be conducted in accordance with the NRR Office Instruction LIC-111, "Regulatory Audits" (Reference 3), for the staff to gain a better understanding of the proposed risk-informed completion time (RICT) program.

2.0 AUDIT BASES A regulatory audit is a planned license or regulation-related activity that includes the examination and evaluation of primarily non-docketed information. The bases are the LAR for the PINGP, Units 1 and 2 and the Standard Review Plan Section 19.2 (Reference 4). The audit is determined to be the most efficient approach toward a timely resolution of issues associated with this LAR review. This will ensure that the staff will have an opportunity to minimize the potential for multiple rounds of requests for additional information (RAIs) and that no unnecessary burden will be imposed to address issues that are no longer necessary to make a safety determination.

3.0 OBJECTIVES The objectives of this audit are to:

• Acquire understanding of the extent that the proposed amendments to modify TS requirements for RICTs are in accordance with TSTF-505, Revision 2 and Nuclear Energy Institute (NEI) 06-09, Revision 0-A (Reference 5).

• Gain a better understanding of the detailed calculations, analyses, and bases underlying the LAR and confirm the staff's understanding of the LAR.

• Gain a better understanding of plant design features and their implications to the LAR.

• Acquire understanding of the technical acceptability of the probabilistic risk assessment (PRA) for use in the application.

• Identify necessary further information that should be submitted in order for staff to reach a licensing or regulatory decision and discuss potential RAls.

• Acquire understanding of whether the proposed configurations introduce any adverse effects on the ability or capacity of plant equipment to perform its design-basis function(s) when the plant is operated in the proposed TS allowable configuration.

4.0 SCOPE AND NECESSARY INFORMATION The areas of focus for the regulatory audit are the information contained in the LAR, the enclosed audit information needs, and all associated and relevant supporting documentations (e.g., methodology, process information, calculations, etc.). The relevant supporting documents are identified below.

The following documentation should be available to the audit team:

1. Facts and Observations (F&O) closure reports for the Independent Assessments conducted in October 2017 and May 2019, for the internal events, internal flooding and fire PRA.

2. Any draft or final RICT program procedures (i.e., Risk Management Action (RMA) procedure, PRA Functionality Determination Procedure, Recording Limiting Condition for Operation (LCO) procedures, etc.).

3. Plant specific documentation related to PRA model assumptions and sources of uncertainty for the internal events, internal flooding, and the fire PRA (i.e., PRA uncertainty).

4. Documentation supporting the example RICT calculations presented in LAR Enclosure 1 Table E1-2.

5. Design of PINPG, Unit 1 and PINPG, Unit 2 shared systems, including electrical and mechanical systems, and modeling of shared systems in the PINGP, Unit 1 and PINGP, Unit 2 PRAs.

6. Detailed justification or analysis to support Change #7 in Attachment 1 and Section 3.0 of Enclosure 1 of the LAR, which are related to RTS and ESFAS instrumentation.

The team will review the PRA methods used to determine the risk impact from which the revised completion times are obtained, including the internal events and fire PRAs, and the quantification of risk from significant external events through PRA or bounding methods.

The team will discuss audit questions and identify the need for any additional information or clarification.

5.0 LOGISTICS The audit will be conducted from March 20, 2020 to July 17, 2020 through an online portal (i.e., electronic portal, ePortal, electronic reading room) established by NSPM. NRC staff and contractors access to the online portal should be terminated on July 18, 2020.

The staff would like to conduct remote meetings with NSPM staff to discuss the attached audit questions the week of May 18, 2020.

6.0 TEAM AND REVIEW ASSIGNMENTS The audit will be conducted by the following NRC staff and contractors from Pacific Northwest National Laboratory (PNNL). Other NRC staff may participate by conference call.

Rob Kuntz, Project Manager Jeff Circle, Technical Reviewer, Team Leader.

Stephen Dinsmore, Technical Reviewer Medhi Reisi-fard, Technical Reviewer Keith Tetter, Technical Reviewer Sergiu Basturescu, Technical Reviewer

Norbert Carte, Technical Reviewer Andrea Russell, Technical Reviewer Mark Wilk, Technical Reviewer (PNNL)

Garill A. Coles, Technical Reviewer (PNNL)

Steve M. Short, Technical Reviewer (PNNL) 7.0 SPECIAL REQUESTS The NRC staff would like access to the documents listed above in Section 4.0 through an online portal that allows the NRC staff and contractors to access documents via the internet. The following conditions associated with the online portal must be maintained throughout the duration that the NRC staff and contractors have access to the online portal:

• The online portal will be password-protected, and separate passwords will be assigned to the NRC staff and contractors who are participating in the audit.

• The online portal will be sufficiently secure to prevent the NRC staff and contractors from printing, saving, downloading, or collecting any information on the online portal.

• Conditions of use of the online portal will be displayed on the login screen and will require acknowledgement by each user.

User name and password information should be provided directly to the NRC staff and contractors. The NRC project manager will provide Exelon the names and contact information of the NRC staff and contractors who will be participating in the audit. All other communications should be coordinated through the NRC project manager.

8.0 DELIVERABLES An audit summary will be prepared within 90 days of the completion of the audit. If the NRC staff identifies information during the audit that is needed to support its regulatory decision, the staff will issue RAIs.

9.0 REFERENCES

1. Letter from U.S. Nuclear Regulatory Commission to Technical Specifications Task Force, "Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2,

'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 48,"' dated November 21, 2018 (ADAMS Package Accession No. ML18269A041).

2. U.S. Nuclear Regulatory Commission, NRR Office Instruction, LIC-101, Revision 5, "License Amendment Review Procedures," dated January 9, 2017 (ADAMS Accession No. ML16061A451).

3. U.S. Nuclear Regulatory Commission, NRR Office Instruction, LIC-111, Revision 1, "Regulatory Audits," dated October 31, 2019 (ADAMS Accession No. ML19226A274).

4. U.S. Nuclear Regulatory Commission, Standard Review Plan (NUREG-0800) 19.2, Review of Risk Information Used to Support Permanent Plant-Specific changes to the Licensing Basis: General Guidance, June 2007 (ADAMS Accession No. ML071700658).

5. Nuclear Energy Institute, NEI 06-09, Revision 0-A, "Risk-Informed Technical Specification Initiative 4b Risk-Managed Technical Specification Guidelines," dated November 2006 (ADAMS Accession No. ML12286A322).

ATTACHMENT AUDIT QUESTIONS Question 1 - Consideration of Shared Systems in RICT Calculations LAR Enclosure 1, Table E1-1 identifies each Technical Specification (TS) Limiting Condition for Operation (LCO) proposed to be included in the RICT program and describes how the systems and components covered in the TS LCO are implicitly or explicitly modeled in the PRA. LAR Section 2.4.7, states that the PINGP Cooling Water (CL) System is a shared system between units. LAR Enclosure 1, Table E1-1 states for TS LCO 3.8.1 (AC Sources - Operating) Condition B (One Diesel Generator (DG) inoperable) that PRA success criteria also includes credit for re-powering buses through the cross-tie to the opposite unit in some circumstances. These statements indicate that the function of certain systems can be shared across units. NRC staff notes that for certain events such as dual unit events (e.g., loss of offsite power) the shared system can only be credited for one unit. Therefore, address the following:

a) Explain whether shared systems are credited in the PRA models for both units, and if so, identify those systems.

b) If shared systems are credited in the Real Time Risk (RTR) model that supports the RICT calculations, then explain how the shared system is modeled for each unit in a dual unit event.

c) If a shared system is credited in the RTR model that support the RICT calculations and the impact of events that can create a concurrent demand for the system shared by both units is not addressed in the PRA models, then justify that this exclusion does not impact the RICT calculations.

Question 2 - Real-Time Risk Model Regulatory Position 2.3.3 of RG 1.174 states that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

Section 4.2 of NEI 06-09 describes attributes of the configuration risk management (CRM) tool.

A few of these attributes are listed below:

• Initiating events accurately model external conditions and effects of out-of-service equipment.

• Model translation from the PRA to a separate CRM tool is appropriate; CRM fault trees are traceable to the PRA. Appropriate benchmarking of the CRM tool against the PRA model shall be performed to demonstrate consistency.

• Each CRM application tool is verified to adequately reflect the as-built, as-operated plant, including risk contributors which vary by time of year or time in fuel cycle or otherwise demonstrated to be conservative or bounding.

• Application specific risk important uncertainties contained in the CRM model (that are identified via PRA model to CRM took benchmarking) are identified and evaluated prior to use of the CRM tool for RMTS applications.

• CRM application tools and software are accepted and maintained by and appropriate quality program.

• The CRM tool shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

• Seasonal or time-in-operating cycle variations must be either conservatively assessed or properly quantified for the conditions. of the LAR describes the attributes of the Real-Time Risk (RTR), or CRM, tool, for use in RICT calculations at PINGP. The LAR explains that the internal flood model is integrated into the internal events PRA model, but the fire PRA model is maintained as a separate model.

The LAR also describes several changes made to the internal events and fire PRA models to support calculation of configuration-specific risk and mentions approaches for ensuring the fidelity of the RTR to the PRAs including RTR maintenance, documentation of changes, and testing. With regards to development and application of the RTR model, provide the following:

a) Explain how any changes in environmental conditions due to seasonal variations are accounted for in the CRM model for use in RICT calculations. Include discussion of impacts on the plant response model (e.g., temperature impact on system success criteria) and on initiator frequency (e.g. impact on LOOP frequency for to seasonal events).

b) Confirm that out-of-service equipment will be properly reflected in the CRM model initiating event models as well as in the system response models.

c) Describe the process that will be used to maintain the accuracy of any pre-solved cutsets with changes in plant configuration.

Question 3 - TSTF-505 Implementation Items The NRC Safety evaluation approving Nuclear Energy Institute (NEI) 06-09 states that:

[Regulatory Guide] RG 1.174, Revision 1, and RG 1.200, Revision 1 [ADAMS Accession No. ML090410014] define the quality of the [probabilistic risk assessment] PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

NEI 06-09 states that, [t]he PRA shall be reviewed to the guidance of Regulatory Guide 1.200 Rev. 0 for a PRA which meets Capability Category 2 for the supporting requirements of the ASME internal events at power PRA standard. Deviations from these capability categories relative to the [risk-managed technical specifications] RMTS program shall be justified and documented. NEI 06-09 further clarifies that, [t]he PRA shall be maintained and updated in

accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

License amendment request (LAR) Attachment 5 identifies two implementations items to be complete prior to implementation of the Risk-Informed Completion Time (RICT) program to satisfy the guidance that the PRA reflect the as-built, as-operated plant and that the PRA technical adequacy is acceptable.

Item #1 of LAR Attachment 5, Table A5-1 states:

[Northern States Power Company] NSPM shall ensure that the fire PRA model used for the RICT Program reflects the as-built, as-operated plant using the same fire PRA model used to support National Fire Protection Association (NFPA) 805 implementation for both PINGP units prior to implementation of the RICT Program.

This meaning of the phrase using the same fire PRA model is not completely clear to NRC staff. NRC staff observes that the fire PRA used to support the NFPA 805 application did not reflect the as-built, as-operated plant, but rather credited plant modifications and implementation items that NSPM committed to complete prior to implementation of the NFPA 805 program. If not all the NFPA 805 modifications and implementation items are complete prior to implementation of the RICT, then the fire PRA needs to be adjusted reflect the as-built, as-operated plant.

Item #2 of LAR Attachment 5, Table A5-1 states: NSPM shall ensure that the High-High Containment Pressure signal input to the [main steam isolation valve] MSIV closure logic is modeled in the PINGP PRA prior to implementation of the RICT Program. Is this implementation item for both the fire and internal events PRAs or just the internal events PRA model?

The NRC staff notes that no change to the Renewed Facility Operating License was proposed in the LAR to require completion of the cited implementation items.

In light of these observations:

a) Confirm that implementation Item #1 of LAR Table A5-1 is to ensure that the fire PRA model used in the RICT calculations reflects the as-built, as-operated plant even if not all NFPA 805 plant modifications and implementation items are complete and adjust the wording in in Item #2 of LAR Table A5-1 accordingly.

b) If the cited implementation item is different from stated in part (a) above, then clarify what the commitment is and justify that the fire PRA sufficiently reflects the as-built, as-operated plant prior to implementation of the RICT program.

c) Confirm that implementation Item #2 of LAR Table A5-1 is to ensure that the High-High Containment Pressure signal input to the Main Steam Isolation Valve (MSIV) closure logic modeled in the internal events PRA model prior to implementation of the RICT Program also applies to the fire PRA model and adjust the wording in Item #2 of LAR Table A5-1 accordingly.

d) If implementation item 2 is not meant to apply to the fire PRA, then explain why and justify that the fire PRA model will be sufficient to support the RICT program.

e) Table E2-1 in the LAR discusses internal event finding SY-A17 that the PRA includes credit for the reactor coolant pump (RCP) abeyance seal. The finding is left open because an NRC accepted model for the abeyance seal has not been developed. The impact states that a sensitivity study indicated minimal impact of crediting this seal on RICT estimates. Confirm that this sensitivity study included the fire PRA and the internal event PRA. If the fire PRA was not included, address the impact of the RCP abeyance seal in the fire PRA on the RICT calculations and provide an implementation item if necessary.

Question 4 - Total Risk Estimates Against RG 1.174 Guidelines RG 1.174 provides the risk acceptance guidance for total core damage frequency (CDF) (1E-04 per year) and LERF (1E-05 per year). LAR, Enclosure 4, Table E5-1 shows that the total CDF for PINGP, Unit 1 is 8.22E-05 per year and for PINGP, Unit 2 is 8.16E-05 per year based on the baseline Model of Record PRAs. NRC staff notes that implementation item No. 1 identified in LAR Attachment 5, Table A5-1 ensures that the fire PRA used for the RICT program reflects the as-built, as-operated plant. If an NFPA 805 plant modification or NFPA 805 implementation item has not yet been implemented, then credit for that plant modification or implementation item should be removed from the fire PRA prior to it being used in the RICT program in order to reflect the as-built, as-operated plant. If this PRA adjustment is required it could result in an increase in the total CDF and LERF for PINGP.

In addition, based on RG 1.174 and Section 6.4 of NUREG-1855, Revision 1, for a Capability Category II risk evaluation, the mean values of the risk metrics (total and incremental values) need to be compared against the risk acceptance guidelines. The mean values referred to are the means of the probability distributions that result from the propagation of the uncertainties on the PRA input parameters and model uncertainties explicitly reelected in the PRA models. In general, the point estimate CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state of knowledge (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines). Enclosure 4 of the LAR shows that for PINGP, Units 1 and 2, the CDF values begin to approach the RG 1.174, Revision 3 guidelines for total CDF and LERF without considering the risk increase due to SOKC and the potential need to remove credit for an NFPA 805 plant modifications or implementation items that are not yet implemented. Therefore, an increase in CDF and LERF due to SOKC could possibly impact the conclusions of this application by increasing the PINGP total CDF and LERF values above the RG 1.174 risk acceptance guidelines.

In light of these observations, address the following:

a. Demonstrate that after the fire PRA models are updated to execute implementation item No. 1 in LAR, Attachment 1, Table A5-1 and after the total CDF and after LERF estimates are updated to include the internal events and fire risk increase associated with SOKC that the total risk for each unit will be in conformance with the RG 1.174 risk acceptance guidance (i.e., CDF < 1E-04 and LERF < 1E-05 per year).

b. Alternatively, adjust the commitment in LAR, Attachment 1, Table A5-1, implementation item No.1 to include (1) recalculation of fire CDF and LERF to remove credit for NFPA 805 plant modifications and implementation items not yet implemented, (2) recalculation of fire CDF and LERF to include the contribution of the SOKC and (3) confirmation that the updated total CDF and LERF values resulting from these two risk increases are still in conformance with the RG 1.174 risk acceptance guidance (i.e., CDF < 1E-04 and LERF < 1E-05 per year).

Question 05 - Evaluation of Common Cause for Planned Maintenance NEI 06-09, Revision 0-A, states that no common cause failure (CCF) adjustment is required for planned maintenance. The NRC SE related to NEI 06-09, Revision 0 Section 2.2, states that, specific methods and guidelines acceptable to the NRC staff are [] outlined in RG 1.177 for assessing risk-informed TS changes. The NRC SE, Section 3.2, further states that consistency with the guidance of RG 1.174, Revision 1, and RG 1.177, Revision 1, is achieved by evaluation using a comprehensive risk analysis, which assesses the configuration-specific risk by including contributions from human errors and common cause failures.

The guidance in RG 1.177, Revision 1, Section 2.3.3.1, states that, CCF modeling of components is not only dependent on the number of remaining in-service components but is also dependent on the reason components were removed from service (i.e. whether for preventative or corrective maintenance). In relation to CCF for preventive maintenance, the guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states:

If the component is down because it is being brought down for maintenance the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant.

The LAR does not discuss how CCFs are treated in the PRA models for planned maintenance.

Therefore, address the following:

a) Explain how CCFs are included in the PRA model (e.g., with all combinations in the logic models as different basic events or with identification of multiple basic events in the cut sets);

b) Explain how the quantification and/or models will be changed when, for example, one train of a 3x100 percent train system is removed for preventative maintenance and describe how the treatment of CCF meets the guidance in RG 1.177, Revision 1, or meets the intent of this guidance when quantifying a RICT.

Question 6 - Common Cause Modeling for Emergent Conditions According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-

operated plant. Attachment 2 of the LAR provides the proposed changes to the TSs. Part (d) to TS 5.5.18, Programs and Manual, insert states:

For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Regarding option 1 cited above, provide the following:

a) Describe and justify how the numerical adjustment for increased possibility of CCF will be performed, or b) Confirm that numerically accounting for the increased possibility of CCF in the RICT calculation will be performed in accordance with RG 1.177, Revision 1.

Question 8 - PRA Different from Design Basis Success Criteria The NRC SE related to NEI 06-09 specifies that a LAR is to provide a comparison of the TS functions to the PRA modeled functions of the SSCs subject to LCO actions in the RICT program and demonstration that the scope of the PRA model is consistent with the licensing basis assumptions. LAR Enclosure 1, Table E1-1 summarizes how the PRA success criteria differs from the design basis success criteria. In certain instances, the LAR does not provide sufficient justification for success criteria used the PRA models that appears to be less demanding than the design basis success criteria. Therefore, address the following:

a) LAR Table E1-1 indicates for TS LCO 3.4.9 (Pressurizer) Condition B (One group of pressurizer heaters inoperable) that the PRA success criterion is different from the design basis success criterion (unless offsite power is lost). LAR Table E1-1 indicates that the design basis success criterion is One of two groups of safeguards powered pressurizer heaters, with a capacity of 100kW, and that the normal PRA success criterion is One out of five groups (two safeguards powered; three non-safeguards powered) of pressurizer heaters under normal conditions. LAR Table E1-1 does not expand on why there is a difference and what the basis is for the success criterion used in the PRA models. Therefore, address the following:

i. For TS LCO Condition 3.4.9.B, explain why the PRA and design basis success criteria are different for the pressurizer heaters and discuss the basis that justifies the success criterion used in the PRA models.

ii. For TS LCO Condition 3.4.9.B, if the PRA success criterion cannot be justified, then adjust the PRA modelling of the pressurizer heaters to use

success criteria that can be justified (e.g., use the design basis success criteria.)

b) LAR Table E1-1 indicates for TS LCO 3.7.2 (Main Steam Isolation Valves (MSIVs))

Condition A (One Main Steam Safety Valve (MSSV) inoperable) that the PRA success criterion is different from the design basis success criterion. LAR Table E1-1 indicates that the design basis success criterion is Five of five MSSVs per SG, and that the PRA success criterion is One of five MSSVs per SG when associated PORV and steam dump not available. LAR Table E1-1 does not expand on why there is a difference and what the basis is for the success criteria used in the PRA models. Therefore, address the following:

i. For TS LCO Condition 3.7.2.A, explain why the PRA and design basis success criteria are different for the MSSVs and discuss the basis that justifies the success criteria used in the PRA models.

ii. For TS LCO Condition 3.7.2.A, if the PRA success criterion cannot be justified, then adjust the PRA modelling of the MSSVs to use success criteria that can be justified (e.g., use the design basis success criteria.)

c) LAR Table E1-1 does not define for TS LCO 3.7.4 (Atmospheric Dump Valves (ADVs))

Condition A (Steam Generator (SG) Power Operated Relief Valves (PORV) line inoperable) the success criteria used in the PRA models (though comments are made about other systems that are credited besides the SG PORVs for steam relief in the secondary cooling and plant cooldown). Therefore, address the following:

i. For TS LCO Condition 3.7.4.A, define the success criteria that was used to model the SG PORVs in the PRA and explain whether they are different from the design basis success criteria for the SG PORVs.

ii. For TS LCO Condition 3.7.4.A, if the success criteria used in the PRA models are different from the design basis success criteria for the SG PORVs, then explain why and discuss the basis that justifies the PRA success criteria used for the SG PORVs.

iii. For TS LCO Condition 3.7.4.A, if the PRA success criteria cannot be justified, then adjust the PRA modelling of the SG PORVs to use success criteria that can be justified (e.g., use the design basis success criteria.)

d) LAR Table E1-1 indicates for TS LCO 3.7.5 (Auxiliary Feedwater (AFW) System)

Condition B (One AFW train inoperable in Mode 1, 2, or 3 for reasons other than Condition A) that the PRA success criterion is different from the design basis success criterion. LAR Table E1-1 indicates that the design basis success criterion is One of two AFW trains (pumps or flow path) supplying feedwater to both SGs, and that the non-ATWS PRA success criterion is One of two AFW pumps supplying feedwater to one of two SGs. LAR Table E1-1 does not expand on why there is a difference and what the basis is for the success criteria used in the PRA models. Therefore, address the following:

i. For TS LCO Condition 3.7.5.B, explain why the PRA and design basis success criteria are different for the AFW pump supply to the SGs and discuss the basis that justifies the success criteria used in the PRA models.

ii. For TS LCO Condition 3.7.2.A, if the PRA success criterion cannot be justified, then adjust the PRA modelling of the AFW pump supply to the SGs to use success criteria that can be justified (e.g., use the design basis success criteria.)

e) LAR Table E1-1 indicates for TS LCO 3.7.8 (Service Water System (SWS)) Condition A (No safeguards Cooling Water (CL) operable for one train) that the PRA success criterion is different from the design basis success criterion. LAR Table E1-1 indicates that the design basis success criterion is One of two DDCLPs [diesel-driven CL pumps]

(or 121 MDCLP [motor-driven CL pumps], if aligned), and for the PRA success criteria Table E1-1 refers to LAR Section 2.4.7 which defines the DDCLP/MDCLP success criteria according to the system configuration and scenario. Neither LAR Section 2.4.7 or Table E1-1 explicitly expand on why there is a difference and what the basis is for the success criteria used in the PRA models. Therefore, address the following:

i. For TS LCO Condition 3.7.8.A, explain why the PRA and design basis success criteria are different for the DDCLP/MDCLP supply to the SWS and discuss the basis that justifies the success criteria used in the PRA models.

ii. For TS LCO Condition 3.7.8.A, if the PRA success criterion cannot be justified, then adjust the PRA modelling of the DDCLP/MDCLP supply to the SWS to use success criteria that can be justified (e.g., use the design basis success criteria.)

f) LAR Table E1-1 indicates for TS LCO 3.3.2 (ESFAS) Condition B, C, and E, and TS LCO 3.6.5 (Containment Spray and Cooling Systems) Condition A, C, and D that the PRA success criterion is different from the design basis success criterion. Table E1-1 states for these LCO Conditions that the Containment Spray (CS) and Cooling Systems function is not modeled in the PRA because it has been screened out based on hydraulic analysis. Table E1-1 states that hydraulic analysis has been performed showing that success or failure of the CS function does not impact which sequences contribute to large early release frequency (LERF). Therefore, address the following:

i. Explain how the change-in-risk will be calculated for a RICT when a CS train, containment fan coil units, or CS actuation channel is taken out of service, given that the CS function is not modeled in the PRAs. If no RICT calculation will be performed, then explain what RICT will be assumed for the cited LCO Conditions.

ii. Describe the hydraulic analysis that is the basis used to justify that the Containment Spray and Cooling Systems success or failure have no impact which sequences contribute to LERF.

iii. Justify that the results of the hydraulic analysis are applicable to the PINGP regardless of configurations that are allowed by the RICT program.

Question 8 - Potential Loss of Function Conditions

TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493) does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE) in the RICT Program.

LAR Enclosure 1, Table E1-1 appears to include several TS LCO Conditions that could represent TS loss of function because the Condition allows a configuration that does not meet the design basis success criteria indicated in Table E1-1. These Conditions include:

• TS LCO 3.3.1 (Reactor Trip System (RTS)) Condition L (One or both channel(s) inoperable on one bus). Loss of both channels on one bus defeats the design basis success criteria.

• TS LCO 3.3.2. (ESFAS) Condition E (One or more Containment Pressure Channel(s) inoperable). Loss of both High-High Containment Pressure channels in one of the three sets defeats the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.3.2. (ESFAS) Condition I (One or both channel(s) inoperable on one bus).

Loss of both undervoltage channels on one of the two buses defeats the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.5.2 (ECCS Operating) Condition A (One or more trains inoperable). Loss of both safety injection (SI) pumps or both Residual Heat Removal (RHR) pumps and other combinations of losses defeat the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.6.2 (Containment Airlocks) Condition C (One or more containment air locks inoperable for reasons other than Condition A or B). Both airlocks open defeats the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.6.5 (Containment Spray and Cooling Systems) Condition C (One or both containment cooling fan coil unit(s) (FCU) in one train inoperable). Loss of two containment FCUs defeats the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.8.9 (Distribution Systems-Operating) Condition A (One or more safeguards AC electrical power distribution subsystems inoperable). Loss of both safeguards AC electrical power subsystems defeats the design basis success criteria indicated in LAR Table E1-1.

• TS LCO 3.8.9 (Distribution Systems-Operating) Condition B (One or more safeguards DC electrical power distribution subsystems inoperable). Loss of both safeguards DC electrical power subsystems defeats the design basis success criteria indicated in LAR Table E1-1.

Therefore, address the following:

a) Justify that these LCO Conditions does not represent TS loss of function.

b) If in the response to item a. above, it cannot be justified that one or more of the LCO Conditions cited above does not represent TS loss of function, then remove these LCO condition from the RICT program and provide an updated TS markup.

Question 9 - PRA Model Uncertainty Analysis Process The NRC staff SE related to NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainties for the internal events and fire PRAs was performed using the guidance in NUREG-1855, Revision 1. The LAR states that the internal events and fire PRA models and notebooks were reviewed for plant-specific key assumptions and sources of uncertainty. The LAR states that for both the internal events and fire PRAs no specific uncertainty issues have been identified that would impact the RICT application, and no candidate key assumption and sources of uncertainty were presented in the LAR NSPM provided the report PRA-CALC-V.SPA.19.013-R0, Prairie Island RICT Evaluation of Open F&Os and Uncertainties, in support of the audit. This report contains tables (Tables 2 and

3) which evaluate the potential impact of the identified sources of internal event and fire event uncertainties, respectively. This document states that a comprehensive list of all plant specific internal event sources of uncertainty and internal event generic sources in EPRI TR-1016737 had been identified and reviewed in PRA-PI-UN, Uncertainty Notebook. This document also states that a comprehensive list of all plant fire event sources of uncertainty and fire event generic sources in EPRI TR-1026511 had been identified and reviewed in FPRA-PI-UN, Fire PRA Model Uncertainty Notebook. The document states that if the initial reviews determined that the source of uncertainty need not be evaluated further (negligible contribution, realistic modeling, etc.) then those uncertainties are not included in Tables 2 or 3.

a) Describe the specific process and criteria used to screen uncertainties from the initial comprehensive lists of PRA uncertainties (including those associated with plant specific features, modeling choices, and generic industry concerns), in order to conclude that the uncertainty issues could not impact the RICT calculations and needed no further evaluation in Table 2 and Table 3 of PRA-CALC-V.SPA.19.013-R0 .

b) A number of sources of uncertainty (e.g., Table 2, #2) were dispositioned by referencing, for example, PCD PI-18-065 was completed on RHR system to address adding component failures. Sometimes the PCD was missing (e.g., PI-18-0058). Explain what these documents are, e.g., are they quantitative evaluations or some type of sensitivity studies. Provide two or three examples that illustrate the different types of evaluations if applicable.

c) The discussion in Table 2, items #24 and #25, indicate that external vessel cooling is credited to prevent core melt from escaping the vessels and justifies the credit by referring to realistic MAAP modelling in #24 and some discussions of the modelling

assumptions in #25. Presumably in-vessel retention will affect LERF and could substantively affect LERF. Has the MAAP modelling been previously reviewed and accepted? If so, please provide reference to the previously accepted MAAP modeling. If a previously accepted model is unavailable, please provide a report describing the MAAP modelling, assumptions, and results. Alternatively, please summarize the scenarios affected by this assumption and provide a sensitivity study to evaluate the impact of in-vessel cooling not succeeding on the RICTs. If the impact is not negligible but the modelling will be retained, describe how NSPM will ensure that the sensitivity study will become part of the applicable RICT calculations.

Question 10 - TSTF 505 - Instrumentation and Controls modeling NEI 06-09 state, concerning the quality of the PRA model, that RG 1.174, Revision 1, and RG 1.200, Revision 1 define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

Based on documentation in the LAR, it is not clear to the NRC staff whether instrumentation and control I&C is always modeled in sufficient detail to support implementation of TSTF-505, Revision 2. The following additional information is requested:

a. Explain how I&C is modeled in the PRA. Include (1) the scope of the I&C equipment that is explicitly included (e.g., bistables, relays, sensors, integrated circuit cards), 2) description of the level of detail that modeled (e.g., are all channels of an actuation circuit modeled?), (3) discussion of what data and whether plant specific data is used, and (4) discussion of the associated TS functions for which a RICT could be applied.

b. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation and that sensitivity studies should be used to develop appropriate compensatory risk management actions (RMAs).

Regarding digital I&C, NRC staff notes the lack of consensus industry guidance for modeling these systems in plant PRAs to be used to support risk-informed applications.

In addition, known modeling challenges exist such as the lack of industry data for digital I&C components, the difference between digital and analog failure modes, and the complexities associated with modeling software failures including common cause software failures. Given these needs and challenges, if the modeling of digital I&C system is included in the Real-Time Risk (RTR) model, then address the following:

i. Provide the results of a sensitivity study on the SSCs in the RICT program demonstrating that the uncertainty associated with modeling digital I&C systems has inconsequential impact on the RICT calculations.

ii. Alternatively, identify which LCOs are determined to be impacted by the digital I&C system modeling for which RMAs will be applied during a RICT. Explain

and justify the criteria used to determine what level of impact to the RICT calculation require additional RMAs.

Question 11 - I & C Question In Section 3.0, Evaluation of Instrumentation and Control Systems of Enclosure 1 of the LAR, the functional units are listed for both the Reactor Trip System (RTS) and the Engineered Safety Features Actuation System (ESFAS). RTS Instrumentation in Section 3.1 of the LAR states that The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS. The LAR lists all the trip inputs but does not describe the diversity and defense-in-depth associated with each plant limiting condition/event. Similarly, for the ESFAS Instrumentation in Section 3.2 of the LAR, the licensee lists the different inputs through which the actuation occurs; however, the LAR does not describe the diversity and defense-in-depth associated with each limiting condition/event.

The NRC staff notes that for both RTS and ESFAS, the LAR does not provide adequate information to verify at least one redundant or diverse means will remain available to accomplish the intended safety functions of proposed I&C TS with RICT in the LAR.

In light of these observations:

a) Describe other means that exist to initiate the safety function for each plant accident condition/event that the identified I&C TS function in the LAR is currently designed to address. The evaluation of diverse means should identify the conditions that each functional unit responds to, and for each condition, other means (e.g., diversity, redundancy, or operator actions) that can be used.

b) Section 3.0 of the LAR Enclosure 1, for both RTS and ESFAS, lists several manual actuations as diverse means for each affected I&C safety function. Confirm that these manual actuations are defined in the PINGP operation procedures to which the operators are trained.

c) In the LAR, TS LCO 3.3.4, Restore automatic load sequencer to OPERABLE status, is proposed to be risk-informed. The associated diversity and defense-in-depth analysis for this proposed change is not included in the LAR. Please provide the diversity and defense-in-depth analysis for the proposed LCO 3.3.4 with RICT.

Question 12 - Credit for FLEX Equipment and Actions The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2.

With regards to equipment failure probability, in the May 30, 2017 memo, the NRC staff concludes (Conclusion 8):

The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA Standard as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.

With regards to human reliability analysis (HRA), NEI 16-06 Section 7.5 recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as: debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses; and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. In the May 30, 2017 memo, the NRC staff concludes (Conclusion 11):

Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, [Human Error Probabilities] HEPs associated with actions for which the existing approaches are not explicitly applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

With regard to uncertainty, Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties should be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions. Uncertainty exists in PRA modeling of FLEX, related to the equipment failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities.

Therefore, FLEX modeling assumptions could be key assumptions and sources of uncertainty for RICTs proposed in this application.

The LAR does not address whether FLEX equipment or actions have been credited in the PRA models. The NRC staff notes that the LAR Enclosure 4, Section 3.2 refers to post-Fukushima FLEX mitigating strategies now in place., but provides no additional information about if, and how, FLEX equipment is modeled in the PRA. To understand the credit that will be taken for FLEX equipment and actions in the RICT Program, address the following separately for the internal events PRA, internal flooding PRA, and fire PRA:

a) Discuss whether NSPM has credited FLEX equipment or mitigating actions in the PINGP internal events, including internal flooding, or fire PRA models.

If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested, and the remainder of this question is not applicable.

b) Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

c) Regarding the credited equipment:

i. Discuss whether the credited equipment (regardless of whether it is portable or permanently-installed) are like other plant equipment (i.e. SSCs with sufficient plant specific or generic industry data).

If all credited FLEX equipment is similar to other plant equipment credited in the PRA (i.e. SSCs with sufficient plant-specific or generic industry data), responses to items ii and iii below are not necessary.

ii. Discuss the data and failure probabilities used to support the modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

iii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact on RICT due to FLEX equipment data and failure probabilities. Part of the response include the following:

1. Justify values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Describe how the results of the sensitivity studies will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

d) Regarding HRA, address the following:

i. Discuss whether any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06.

If any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06, answer either item ii or iii below:

ii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact from the FLEX independent and dependent HEPs associated with deploying and staging FLEX portable equipment on the RICTs proposed in this application. Part of the response include the following:

1. Justify independent and joint HEP values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Discuss composite sensitivity studies of the RICT results to the operator action HEPs and the equipment reliability uncertainty sensitivity study provided in response to RAI APLA 13.c.iii.

4. Describe how the source of uncertainty due to the uncertainty in FLEX operator actions HEPs will be addressed in the RICT program. Describe specific RMAs being proposed, and how t these RMAs are expected to reduce the risk associated with this source of uncertainty.

iii. Alternatively, to item d.ii) above, provide information associated with the following items listed in supporting requirements (SR) HR-G3 and HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard to support detailed NRC review:

1. the level and frequency of training that the operators and/or non-operators receive for deployment of the FLEX equipment (performance shaping factor (a)),

2. performance shaping factor (f), regarding estimates of time available and time required to execute the response,

3. performance shaping factor (g) regarding complexity of detection, diagnosis and decision making and executing the required response,

4. Performance shaping factor (h) regarding consideration of environmental conditions, and

5. Human action dependencies as listed in SR HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard.

e) The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

Provide an evaluation of the model changes associated with incorporating FLEX mitigating strategies, which demonstrates that none of the following criteria is satisfied:

(1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

Question 13 - Application Specific Model CDF/LERF LAR Enclosure 5, Table E5-2 presents the CDF and LERF valves for the baseline application specific model. Why are the CDF and LERF values from this model presented in the LAR and how is the baseline application specific model defined? It appears to NRC staff that the application specific model does not represent a specific configuration or an average configuration. Accordingly, explain why the CDF and LERF values from the baseline application specific model are presented in the LAR and how this model is defined.

Question 14 - Joint Human Error Probability Floor Guidance in NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), (Table 2-1) April 2005, (ADAMS Accession No. ML051160213) recommends joint human error probability (HEP) values should not be below 1E-05. Table 4-3 of EPRI 1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, provides a lower limiting value of 1E-06 for sequences with a very low level of dependence. The NRC staff notes that underestimation of minimum joint probabilities could result in non-conservative RICTs of varying degrees for different inoperable SSCs.

In PRA RAI 02.a (Reference 24) during the NFPA-805 LAR review, the NRC staff requested additional information with respect to the minimum for joint HEPs used in the fire PRA. The response to PRA RAI 02.a (Reference 15), indicated that it updated the FPRA to use no joint HEP value below 1.0E-05. The response to PRA RAI 02.a, stated that adequate justification for the future use of any value less than 1.0E-05 in the fire PRA will be provided.

TSTF-505 evaluations use the fire PRA and the internal events PRA. The LAR does not provide information about whether and, if so what, minimum joint HEP values are currently assumed in the internal events PRA. Considering these observations:

a. Clarify if the NFPA-805 fire PRA will be used for TSTF-505 calculations. If not, please respond to the following question for fire PRAs joint HEPs below 1.0E-5 in addition to the requested information for internal event joint HEPs below 1.0E-6.

b. Explain what minimum joint HEP value was assumed in the internal events PRA.

c. If a minimum joint HEP value less than 1E-6 was used in the internal events PRA, then provide a description of the sensitivity study that was performed and the quantitative results that justify that the minimum joint HEP value has no impact on the RICT application.

d. If, in response part (c), if it cannot be justified that the minimum joint HEP value has no impact on the application, confirm that each joint HEP value used in the internal events PRA below 1E-6 includes its own separate justification that demonstrates the inapplicability of the EPRI 1021081 lower value guideline (i.e., using such criteria as the dependency factors identified in NUREG-1921 to assess level of dependence). Provide an estimate of the number of these joint HEP values below the guideline values of 1.0E-6 for the internal events PRA, discuss the range of values, and provide at least two different examples, separately for the internal events and the fire PRA, where this justification is applied.

QUESTION 14 - RICT Estimates for unmodeled equipment Regulatory Position 2.3.3 of RG 1.174 states that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

The SE for NEI 06-09 states that a RICT can be applied to SSCs that are either modeled in the PRA, or whose impact can be quantified using conservative or bounding approaches. It further specifies that the LAR is to provide a comparison of the TS functions to the PRA modeled functions and that sufficient justification is to be provided to show that the scope of the PRA model is consistent with the licensing basis assumptions. Consistent with the guidance, Item 11 in Section 2.3 of TSTF-505, Revision 2, states that The traveler will not modify Required Actions for systems that do not affect core damage frequency (CDF) or large early release frequency (LERF) or for which a RICT cannot be quantitatively determined.

Address the following:

a. 3.6.3.A and 3.6.3.C in Table E1-1 both include in the Comments column that, [o]nly penetrations that can contribute to LERF are modeled. Will a RICT be applied to penetrations that do not contribute to LERF and, if so, how is the RICT calculated consistent with the guidance in TSTF-505, Revision 2?

b. 3.6.5.C and 3.6.5.D in Table E1-1 both state that the containment cooling fan coil units are not modeled in the PRA. The additional discussion in section 2.6 states that,

[a]dverse impacts caused by operation of the CS system are considered; such as increased Refueling Water Storage Tank (RWST) depletion rate during ECCS injection, potential for spurious operation and subsequent loss of RWST inventory after a fire initiating event, and potential failure of 4 kV bus load-rejection sequence if the CS breaker fails to open on demand. The report provided in support of the audit, V.SPA.19.012-R0, TSTF-505 LAR Supporting Calculations indicates, however, that the seismic penalty factor risk increase is used to calculate a RICT for these LCO because the failure of the equipment does not contribute to CDF and LERF. The two statements appear contradictory, one that adverse impacts are modeled (and could be removed) while the other that nothing is modeled in the PRA that can be used to estimate a RICT based on CDF or LERF. Please clarify what is actually modeled in the PRA for these systems that can affect CDF or LERF and how the RICT is calculated consistent with the guidance in TSTF-505, Revision 2.

Question 16 - Bounding Seismic LERF Estimate Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A (ADAMS Accession No. ML12286A322),

states that the impact of other external events risk shall be addressed in the [Risk Managed Technical Specifications] RMTS program, and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated Risk-Informed Completion Time (RICT). The NRC staffs safety evaluation for NEI 06-09 (ADAMS Accession No. ML071200238) states that [w]here [probabilistic risk assessment] PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT.

A seismic PRA model is not available for PINGP, Units 1 and 2, and the seismic hazard cannot be screened out for the RICT application. Section 3 of Enclosure 4 to the LAR stated that a seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) penalty was determined for this application using the current PINGP seismic hazard curve developed in response to Recommendation 2.1 of the Near-Term Task Force (NTTF) (ADAMS Accession No. ML14086A628). Section 3.1 of Enclosure 4 to the LAR stated that the total using PINGP high confidence of low probability of failure (HCLPF) and spectral ratios in safety

assessment for GI-199 (ADAMS Accession No. ML100270639), and the hazard curves developed in response to Recommendation 2.1 of NTTF, the total PINGP SCDF is estimated to be 3.0E-06. It is unclear to the staff how the licensee developed the CDF estimate from information cited above.

Details of the approach for determining the seismic LERF penalty are provided in LAR , Section 3.3 using the Conditional Large Early Release Probability (CLERP) for internally initiated events with some adjustment (i.e., the contribution of certain containment bypass events that would not be expected from a seismic event were not included in the CLERP.) The LAR states that the CLERP determined using this approach was chosen as an adequately conservative estimate. As noted earlier, the NEI 06-09, Revision 0-A, as well as the corresponding NRC staff SE, calls for a bounding analysis. In addition, NRC staff observes that LERF-to-CDF ratio for seismic events can be significantly higher than the same ratio for internal events due to the unique nature of seismically-induced failures. It is unclear that the selected CLERP of 5% can be considered as a bounding value for use in the RICT calculation.

a) Demonstrate how SCDF estimate in Section 3.1 of LAR Enclosure 4 is derived using the PINGP HCLPF and spectral ratios used in GI-199 assessment and the most recent hazard curve.

b) Justify that the seismic LERF penalty provided in the submittal to support RICT calculations for the PINGP is bounding. Include rationale that deriving seismic LERF-to-CDF ratio using the internal events LERF-to-CDF ratio is bounding for seismically induced events, given that internal events random failures do not capture seismically-induced failures that may uniquely contribute to LERF.

c) If the approach to estimating the seismic LERF penalty cannot be justified as bounding for this application in response to part (b) above, then provide, with justification, the bounding seismic LERF penalty for use in RICT calculations.

Question 17 - Screening the External Flooding Hazard Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 (ADAMS Accession No. ML071200238) states that [o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including external flooding. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program. LAR , Table E4-2 indicates that criterion PS1 (design basis hazard cannot cause a core damage accident) was used to screen the external flooding hazard and states based on the flood hazard reevaluation report (FHRR) and a follow-up focused evaluation for PINGP that concluded external flooding does not challenge the current licensing basis or plant safety systems. LAR Table E4-2 states that during local intense precipitation (LIP) the site has effective flood protection through the determination of Available Physical Margin and the reliability of protection features. NRC staff notes that the June 2014 staff assessment report on the flooding walkdown report (ADAMS Accession No. ML14148A477) states that a deficiency in

the flood response was initially identified related to the power supply for needed portable sump pumps to ensure their functionality in case of loss of off-site power during the event. If the reliability of the flood response is dependent on systems and SSCs such as power supply and distribution, then the reliability of flood response could potentially be impacted by plant configuration. In light of these observations, it is unclear to the staff whether the licensees screening of external flooding risk from the RICT program has adequately considered the reliability of protective features considering the plant configuration.

Identify the protective features credited for screening the external flooding hazard and justify that screening of the external flooding hazard considering the reduced reliability/availability of those protection features due to plant configuration. Alternatively, describe how the risk associated with the external flooding hazard is considered in the RICT program.

Question 18 - Screening the Snow Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 (ADAMS Accession No. ML071200238) states that [o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including snow. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program. LAR Enclosure 4, Table E4-2, indicates that criterion C1 (event damage potential is less than events for which plant is designed) and criterion C4 (event is included in the definition of another event) was used to screen the snow hazard. The LAR further states that the design basis roof live load is 50 pounds per square foot (psf) and the maximum recorded snowfall from a single storm in Minnesota occurred near Finland, Minnesota and measured 46.5 inches with an estimated weight of 46.5 psf, which is within the design basis. Considering the small margin between the design basis roof live load and the maximum recorded snowfall, it is unclear to the staff whether the risk of this hazard is adequately considered for this application In light of these observations, justify the screening of risk associated with snowfall from the application by showing that the occurrence frequency of snowfall events that could challenge the plant is low.

Question 19 - PRA Model Uncertainty Analysis Results The NRC staff SE to NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainties for the internal events and fire PRAs was performed using the guidance in NUREG-1855, Revision 1. The LAR states that the internal events and fire PRA models and notebooks were reviewed for plant-specific key assumptions and sources of uncertainty. The LAR states that for both the internal events and fire PRAs no specific uncertainty issues have been identified that would impact the RICT application, and no candidate key assumption and sources of uncertainty were presented in the LAR.

Xcel Energy provided three reports on the document portal that present evaluations of key assumptions and sources of uncertainty associated with internal events and fire PRA modelling.

(PRA-PI-UN, Revision 5.3, Uncertainty Notebook, FPRA-PI-UN, Revision 5.3, Fire PRA Model Uncertainty Notebook, and PRA-CALC-V.SPA.19.013-R0, Prairie Island RICT Evaluation of Open F&Os and Uncertainties) One of the documents reports on an evaluation of sources of uncertainty that was specifically performed for the RICT program. In the uncertainty analysis report that provided an evaluation of sources of uncertainty specifically for the RICT program, the disposition for each entry states that the identified uncertainty does not represent a key source of uncertainty and should be not included in RICT LAR. As part of NRC audit, NRC staff reviewed all three documents and noted sources of uncertainty that appear to have the potential to impact the RICT application. Therefore, address the following:

a) The PINGP uncertainty analysis report for the internal events PRA (PRA-PI-UN, Table DA-2, Page 31 of 106, first and third row under the top header associated with DA-B-1 and DA-C-2) identifies the applicability of component type data and the applicability of generic data as potential sources of modelling uncertainty. The resolutions provided for these sources of uncertainty explain that the best available data sources were used and they explain which generic data sources were used. The report states that the primary source for generic failure rates, probabilities and distribution parameters was NUREG-6928 (ADAMS Accession No. ML070650650), but that secondary sources were also used including Utility Calculation Notes.

The report concludes that the applicability of component type data and generic data is not a source of uncertainty. Concerning the reference to Utility Calculation Notes, it is not clear to NRC staff what information is contained in this reference or how it was used to support the PRA models. NRC staff notes that the failure rates for non-typical equipment can be a source of uncertainty because it may require the use of surrogate data or engineering judgement.

Therefore, address the following:

i. Explain what information is contained in the Utility Calculation Notes, and how it was used to support the development of component failure probabilities. Include explanation of whether this source of uncertainty is caused by non-typical equipment and whether engineering judgement was used to determine a failure probability for certain components. Also, include examples of how failure rates were determined for non-typical equipment not listed is NUREG-2928.

ii. Justify your treatment of the potential sources of uncertainty cited above and explain or demonstrate why they have no impact on the RICT calculations.

i. If in response to part (ii) above it cannot be justified that your treatment of these uncertainties has no impact on the RICT program, then explain how these uncertainties will be treated in the RICT program. Include discussion of any additional Risk Management Actions (RMAs) that would be implemented.

b) The PINGP uncertainty analysis report for the fire PRA (FPRA-PI-UN, Table 2, Page A-2 of 63, Item FPRA-PI-ES-2) states:

Components without cable routing are assumed failed unless further analysis was performed to assure systems are not compromised by the transient fire (Credit by exception).

The report indicates that this assumption is not a source of uncertainty because it is industry practice. It is not clear how many or which components and systems are assumed to be failed in fire scenarios because of the lack of cable tracing. NRC staff notes that even though this modelling treatment produces a conservative estimation of fire CDF and LERF it can underestimate the change-in-risk determined in the RICT calculations by masking risk which results in the underestimation of associated completion times. In a RICT calculation, if an SSC is part of a system not credited in the fire PRA or it is supported by a system that is not credited, then the risk-increase due to taking that SSC out of service is masked. It is not clear to NRC staff that the cited assumption has no impact on the RICT program. Therefore, address the following:

i. Identify the systems or components that are assumed to be always be failed (or are not included) in the fire PRA due to lack of cable tracing.

ii. Justify that exclusion of credit for the SSCs identified in part (i) above has an inconsequential impact on the RICT calculations. Include discussion about whether the risk associated with an SSC in the RICT program can be masked because the SCC (or a system that supports the SSC) is not credited (or not fully credited) in the fire PRA.

iii. As an alternative to part (ii), above, propose a mechanism to ensure that a sensitivity study is performed for the RICT calculations for applicable SSCs which accounts for the impact on the RICT of the non-conservative PRA treatment (i.e., that the SCC is failed or not included in the PRA model). The proposed mechanism should also ensure that any additional risk from correcting the false assumption that the SSC is always failed is either accounted for in the RICT calculation or is compensated for by applying additional RMAs during the RICT.

c) The PINGP uncertainty analysis report for the fire PRA (FPRA-PI-UN, Table 2, Page A-41 of 63 and A-48 of 63, Items FPRA-PI-PRA-3 and FPRA-PI-PRA-42) identifies the modeling of the Very Early Warning Fire Detection System (i.e., incipient detection) as a potential source of uncertainty but dismisses it because the modelling is based on an industry standard approach. The report states that the [i]ncipient fire detection system is credited for all electrical panel scenarios.

NRCs Safety Evaluation (SE) (ADAMS Accession No ML17163A027) for adopting National Fire Protection Association (NFPA) 805 states that Northern Plains Power Company - Minnesota (NSPM) committed to an implementation item (i.e., #70) that will be completed prior to implementation of its NFPA 805 program. The commitment concerns update of the fire PRA to incorporate the guidance on crediting incipient detection in NUREG-2180 (ADAMS Accession No. ML16286A000). The SE states that NSPM used the guidance from fire PRA FAQ-08-0046, Incipient Fire Detection Systems, which has been superseded by the guidance in NUREG-2180.

The guidance using FAQ-08-0046 is known to overestimate the credit for incipient detection compared to using the guidance from NUREG-2180. It is not clear to NRC staff that using the retired guidance from FAQ-08-0046 would have a no impaction on the RICT calculations. In light of these observations, address the following:

i. Confirm that the fire PRA has already been updated to incorporate the guidance in NUREG-2180 concerning modeling incipient detection of fires.

ii. If the fire PRA has not already been updated to incorporate the guidance in NUREG-2180, then justify that the impact of using the retired guidance has no impact on the RICT calculations (e.g., perform a sensitivity showing the impact on specific RICT calculations for applicable affected TS LCO Conditions) or explain how the uncertainty will be adequately treated in the RICT program using additional RMAs. Alternatively, propose a mechanism that ensures that the guidance from NUREG-2180 is incorporated into the fire PRA prior to implementation of the RICT program.

d) The PINGP uncertainty analysis report that provided an evaluation of sources of uncertainty specifically for the RICT program (PRA-CALC-V.SPA.19.013-R0, Page 34, Item #10) states that transient fire weighting factors were applied in the fire PRA using the approach given in Chapter 6 of NUREG/CR-6850. NRCs SE for adopting NFPA 805 (ADAMS Accession No ML17163A027) indicates that more current guidance from FAQ 12-0064 was used to apply transient fire weighting factors to the fire PRA. In light of this discrepancy:

i. Confirm that the guidance from FAQ 12-0064 was used to apply transient fire weighting factors to the fire PRA.

ii. If it cannot be confirmed in response to part (i) above that guidance from FAQ 12-0064 was used to apply transient fire weighting factors to the fire PRA, then justify that your treatment of applying transient fire weighting factors has no impact on the RICT calculations. Alternatively, propose a mechanism that ensures that the guidance from FAQ 12-0064 is incorporated into the fire PRA prior to implementation of the RICT program.

e) The PINGP uncertainty analysis report that provided an evaluation of sources of uncertainty specifically for the RICT program (PRA-CALC-V.SPA.19.013-R0, Page 10-11, Item #2) states that diversion flow paths were not modelled for the Residual Heat Removal (RHR) system. he sources of flow diversion that were identified in the report were (1) failure of the heat RHR exchanger crosstie valves that diverts flow to the safety injection (SI) crossover and containment Spray (CS) suction lines, (2) failure of the RHR heat exchanger crosstie valves that diverts flow to the letdown line, and (3) failure of the Component Cooling (CC) pumps that diverts flow back through the CC pump. The report states that the impact of these failures was determined to be negligible because the failure of an RHR train is dominated by other train failures (by more than 2 orders of magnitude). On this basis, the report concludes that there is no impact from this source of uncertainty on the RICT calculations. NRC staff notes that the cited failures may have the potential to cause impacts on the plant besides RHR flow diversion and that there is a possibility that the cited failures can in the same accident scenario also contribute to the functional failure of other systems such as SI, CS, and the CC system. Also, NRC notes that modelling treatments that have only a small impact on overall CDF and LERF can potentially have a more significant impact for particular configurations allowed under the RICT program. In light of these observations, address the following:

i. Explain what impact the cited failures that create RHR diversion flow paths have on interfacing systems such as the SI, CS, and the CC system and whether those failures could contribute to the same accident scenario.

ii. Justify that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths will have no impact on calculated RICTs including RICTS associated with RHR, SI, CS, and the CC system. One way to justify this uncertainty is to perform a sensitivity showing that the impact of the calculated RICT is minimal for configurations allowed under the RICT program

iii. If in the response to part (ii) above, it cannot be justified that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths have no impact on the RICT program, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

Hearing Identifier: NRR_DRMA Email Number: 616 Mail Envelope Properties (SA9PR09MB5550CC0B3009172B4D1D7B2C998B0)

Subject:

Revision 2 to the Plan for the Audit of the Prairie Island Nuclear Generating Plant TSTF-505 License Amendment Request (EPDI: L-2019-LLA-0283)

Sent Date: 6/2/2020 10:44:15 AM Received Date: 6/2/2020 10:44:00 AM From: Kuntz, Robert Created By: Robert.Kuntz@nrc.gov Recipients:

"Gohdes, Peter D." <Peter.Gohdes@xenuclear.com>

Tracking Status: None Post Office: SA9PR09MB5550.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 81186 6/2/2020 10:44:00 AM image003.png 641 Options Priority: Normal Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date: