ML20192A144

NRR E-mail Capture - Request for Additional Information Prairie Island License Amendment Request to Adopt TSTF-505

ML20192A144
Person / Time
Site:	Prairie Island
Issue date:	07/07/2020
From:	Robert Kuntz NRC/NRR/DORL/LPL3
To:	Gohdes P Northern States Power Company, Minnesota
References
L-2019-LLA-0283
Download: ML20192A144 (25)

Text

From: Kuntz, Robert Sent: Tuesday, July 7, 2020 4:07 PM To: Gohdes, Peter D.

Subject:

RE: Request for Additional Information RE: Prairie Island license amendment request to adopt TSTF-505 (EPID: L-2019-LLA-0283)

Attachments: PINGP TSTF-505 RAI.docx Mr. Gohdes, By letter dated December 16, 2019 (Agencywide Documents Access and Management System (ADAMS)

Accession No. ML19350C188), Northern States Power Company (NSPM) submitted a license amendment request to revise the technical specifications (TS) for Prairie Island Nuclear Generating Plant, Units 1 and 2 (PINGP). The proposed change would modify the TS requirements related to completion times for required actions to provide the option to calculate a longer, risk-informed completion time. A new risk informed completion time program is added to the TS Section 5, Administrative Controls. The NRC staff has determined that additional information is required for the NRC staff to complete its review. The attached is the NRC staffs request for additional information (RAI). During a teleconference held July 1, 2020 for the NRC staff to provide clarity on the previously forwarded draft RAI, a response date of September 1, 2020 was proposed. The staff has determined that a September 1, 2020 date is acceptable for responding the attached RAI. Also, the staff has determined that draft RAI 21 will not be needed because the information sought will be provided in response to RAI 1. Draft RAI 21 has therefore been deleted from the RAI attached (draft RAI 22 has become RAI 21 in the attached). Draft RAI 21 had stated:

RAI 21 - Electrical Shared Equipment LAR Enclosure 1, Table E1-1 states for TS LCO 3.8.1 (AC Sources - Operating) Condition B (One Diesel Generator (DG) inoperable) that, PRA success criteria also includes credit for re-powering buses through the cross-tie to the opposite unit in some circumstances. Identify the shared systems between the units and the minimum electric power system requirements from each unit to avoid loss of function of shared system(s).

Robert Kuntz Senior Project Manager NRC/NRR/DORL/LPL3 (301) 415-3733

Hearing Identifier: NRR_DRMA Email Number: 667 Mail Envelope Properties (SA9PR09MB5550C45A893DF3065D32001399660)

Subject:

RE: Request for Additional Information RE: Prairie Island license amendment request to adopt TSTF-505 (EPID: L-2019-LLA-0283)

Sent Date: 7/7/2020 4:07:08 PM Received Date: 7/7/2020 4:07:08 PM From: Kuntz, Robert Created By: Robert.Kuntz@nrc.gov Recipients:

"Gohdes, Peter D." <Peter.Gohdes@xenuclear.com>

Tracking Status: None Post Office: SA9PR09MB5550.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 1883 7/7/2020 4:07:08 PM PINGP TSTF-505 RAI.docx 90633 Options Priority: Normal Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 LICENSE AMENDMENT REQUEST TO REVISE TECHNICAL SPECIFICATIONS TO ADOPT TSTF-505, REVISION 2, PROVIDE RISK-INFORMED EXTENDED COMPLETION TIMES - RITSTF INITIATIVE 4B DOCKET NUMBER 50-282 AND 50-306 RENEWED FACILITY OPERATING LICENSE NOS. DPR-42 AND DPR-60 DRAFT REQUEST FOR ADDITIONAL INFORMATION

Background

By letter dated December 16, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19350C188), Northern States Power Company (NSPM, the licensee), submitted a license amendment request (LAR) to revise the technical specifications (TS) for Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The proposed change would modify the TS requirements related to completion times for required actions to provide the option to calculate a longer, risk-informed completion time, consistent with the approach approved in TSFT-505 Revision 2, Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4b (ADAMS Accession No. ML ML18183A493).

During the Nuclear Regulatory Commission (NRC) staffs review of the license amendment request, the NRC staff determined that more information was needed to complete the review.

Regulatory Analysis Basis Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36, Technical Specifications, in part, requires that the technical specifications be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto and includes items in following categories: (1) safety limits, limiting safety systems settings, and limiting control settings; (2) limiting conditions for operation (LCO); (3) surveillance requirements; (4) design features; (5) administrative controls; (6) decommissioning; (7) initial notifications; and (8) written reports.

10 CFR 50.36(c)(2)(i) states, in part, that limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. This license amendment request contains changes to the remedial actions permitted by the TSs, specifically their allowed outage times.

Request for Additional Information (RAI)

RAI 1 - Consideration of Shared Systems in RICT Calculations LAR Enclosure 1, Table E1-1 identifies each TS Limiting Condition for Operation (LCO) proposed to be included in the Risk Informed Completion Time (RICT) program and describes how the systems and components covered in the TS LCO are implicitly or explicitly modeled in the PRA. LAR Section 2.4.7, states that the PINGP, Units 1 and 2, Cooling Water (CL) System is a shared system between units. Shared systems operate continuously and simultaneously supporting both units. There are also cross-tied systems that can, when needed, be cross-tied to the unit needing the extra functions. For example, LAR Enclosure 1, Table E1-1 states for TS LCO 3.8.1 (AC Sources - Operating) Condition B (One Diesel Generator (DG) inoperable) that PRA success criteria also includes credit for re-powering buses through the cross-tie to the opposite unit in some circumstances. Therefore, address the following:

a) Explain how shared systems are modelled when the shared systems are credited in the PRA models for both units.

b) Explain how cross-tied systems are modelled when the cross-ties are credited in the PRA models for both units.

c) If shared and/or cross-tied systems are credited in the Real Time Risk (RTR) model that supports the RICT calculations, then explain how the systems are credited when a RICT is calculated for each unit.

d) If shared and/or cross-tied systems are credited in the RTR model that support the RICT calculations, then explain how the impact of initiating events can create a concurrent demand for the system at both units.

RAI 2 - TSTF-505 Implementation Items The NRC safety evaluation approving Nuclear Energy Institute (NEI) 06-09 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML071200238) states that: [Regulatory Guide] RG 1.174, Revision 1, and RG 1.200, Revision 1 [ADAMS Accession No. ML090410014] define the quality of the [probabilistic risk assessment] PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

NEI 06-09 (ADAMS Accession No. ML12286A322) states that, [t]he PRA shall be reviewed to the guidance of Regulatory Guide 1.200 Rev. 0 for a PRA which meets Capability Category 2 for the supporting requirements of the ASME internal events at power PRA standard.

Deviations from these capability categories relative to the [risk-managed technical specifications] RMTS program shall be justified and documented. NEI 06-09 further clarifies that, [t]he PRA shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

LAR Attachment 5 identifies two items to be completed prior to implementation for the RICT program to satisfy the guidance that the PRA reflect the as-built, as-operated plant and that the PRA technical adequacy is acceptable.

Item #1 of LAR Attachment 5, Table A5-1 states:

NSPM shall ensure that the fire PRA model used for the RICT Program reflects the as-built, as-operated plant using the same fire PRA model used to support National Fire Protection Association (NFPA) 805 implementation for both PINGP units prior to implementation of the RICT Program.

The meaning of the phrase using the same fire PRA model is not clear to NRC staff. NRC staff observes that the fire PRA used to support the NFPA 805 application did not reflect the as-built, as-operated plant, but rather credited plant modifications and implementation items that NSPM committed to complete prior to implementation of the NFPA 805 program. If not all the NFPA 805 modifications and implementation items are completed prior to implementation of the RICT, then the fire PRA needs to be adjusted to reflect the as-built, as-operated plant.

Item #2 of LAR Attachment 5, Table A5-1 states: NSPM shall ensure that the High-High Containment Pressure signal input to the [main steam isolation valve] MSIV closure logic is modeled in the PINGP PRA prior to implementation of the RICT Program.

In light of these observations:

a) Confirm that implementation Item #1 of LAR Table A5-1 is to ensure that the fire PRA model used in the RICT calculations reflects the as-built, as-operated plant even if not all NFPA 805 plant modifications and implementation items are complete and adjust the wording in in Item #1 of LAR Table A5-1 accordingly.

b) If the cited implementation item is different from stated in part (a) above, then clarify what the item is and justify that the fire PRA sufficiently reflects the as-built, as-operated plant prior to implementation of the RICT program.

c) Confirm that implementation Item #2 of LAR Table A5-1 is to ensure that the High-High Containment Pressure signal input to the Main Steam Isolation Valve (MSIV) closure logic modeled in the internal events PRA model prior to implementation of the RICT Program also applies to the fire PRA model and adjust the wording in Item #2 of LAR Table A5-1 accordingly.

d) If implementation item 2 is not meant to apply to the fire PRA, then explain why and justify that the fire PRA model will be sufficient to support the RICT program.

e) Table E2-1 in the LAR discusses the internal event finding SY-A17 that the PRA includes credit for the reactor coolant pump (RCP) abeyance seal. The finding is left open because an NRC accepted model for the Abeyance seal has not been developed.

The LAR reported in a sensitivity study that demonstrated that removing credit for the Abeyance seal in the internal events PRA has minimal impact on the RICT estimates.

The LAR discussion appeared to have been limited to the sensitivity study on only the internal events base PRA model. Non-SBO loss of cooling to the RCPs is seldom a significant contributor to internal event risk because multiple independent failures are usually needed. However, fire can potentially cause such multiple failures which can make a loss of RCP seal cooling a significant contributor in a Fire PRA. The RICT estimates in the sensitivity study reported in the LAR also assume that only the SSCs related to each LCO are not available. During operations, RICT estimates are based on the as-operated plant which could include other SSCs being unavailable. The

unavailability of other SSCs can have a significant impact on the risk profile of the plant and, therefore the sensitivity of the results to the RCP abeyance seal model.

Therefore:

i. Clarify how the abeyance seal is currently credited in the PRA model-of-record and whether that credit will be retained in the Real Time Risk (RTR) model that will be used to calculate RICTs. If the credit for the abeyance seal will be used in the RTR model to calculate RICTs, provide the following additional information:

ii. Confirm that this sensitivity study reported in the LAR recalculated the reported RICTs after removing credit for the abeyance seal from both the internal event and the fire PRAs. If credit was not removed from the PRA, provide the sensitivity of the Abeyance seal to the estimated RICTs after removing its credit from both PRAs.

iii. Provide an evaluation of the impact of crediting the Abeyance seal on the RICTs for credible combinations of LCOs (i.e., when multiple SSCs are unavailable). If the credit for the Abeyance seal can have more than a negligible impact on credible RICT combinations (i.e., is a key source of uncertainty), explain how this key source of uncertainty will be evaluated and dispositioned in the RICT calculations. If this key source of uncertainty will not be evaluated and dispositioned consistent with guidance in NUREG-1855, justify the proposed disposition.

RAI 3 - Total Risk Estimates Against RG 1.174 Guidelines RG 1.174 provides the risk acceptance guidance for total core damage frequency (CDF) (1E-04 per year) and LERF (1E-05 per year). LAR, Enclosure 4, Table E5-1 shows that the total CDF for PINGP, Unit 1 is 8.22E-05 per year and for PINGP, Unit 2 is 8.16E-05 per year based on the baseline Model of Record (MOR) PRAs. NRC staff notes that implementation item No. 1 identified in LAR Attachment 5, Table A5-1 ensures that the fire PRA used for the RICT program reflects the as-built, as-operated plant. If an NFPA 805 plant modification or NFPA 805 implementation item has not yet been implemented, then credit for that plant modification or implementation item should be removed from the fire PRA prior to it being used in the RICT program in order to reflect the as-built, as-operated plant. If this PRA adjustment is required it could result in an increase in the total CDF and LERF for PINGP.

In addition, based on RG 1.174 and Section 6.4 of NUREG-1855, Revision 1, for a Capability Category II risk evaluation, the mean values of the risk metrics (total and incremental values) need to be compared against the risk acceptance guidelines. The mean values referred to are the means of the probability distributions that result from the propagation of the uncertainties on the PRA input parameters and model uncertainties explicitly reflected in the PRA models. In general, the point estimate CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state of knowledge correlation (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines). Enclosure 4 of the LAR shows that for PINGP, Units 1 and 2, the CDF values begin to approach the RG 1.174, Revision 3 guidelines for total CDF and LERF without considering the risk increase due to SOKC and the potential need to remove credit for an NFPA 805 plant modifications or implementation items that are not yet implemented. Therefore, an increase in CDF and LERF due to SOKC could

possibly impact the conclusions of this application by increasing the PINGP total CDF and LERF values above the RG 1.174 risk acceptance guidelines.

Provide the estimated total CDF and LERF estimates for each hazard modelled with a PRA model that includes the contribution from the SOKC to confirm that the RG 1.174 risk guidelines for total CDF and LERF (i.e., CDF < 1E-04 and LERF < 1E-05 per year) for using a RICT program are met.

RAI 4 - Evaluation of Common Cause for Planned Maintenance NEI 06-09, Revision 0-A, states that no common cause failure (CCF) adjustment is required for planned maintenance. The NRC SE related to NEI 06-09, Revision 0 Section 2.2, states that, specific methods and guidelines acceptable to the NRC staff are [] outlined in RG 1.177 for assessing risk-informed TS changes. The NRC SE, Section 3.2, further states that consistency with the guidance of RG 1.174, Revision 1, and RG 1.177, Revision 1, is achieved by evaluation using a comprehensive risk analysis, which assesses the configuration-specific risk by including contributions from human errors and common cause failures.

The guidance in RG 1.177, Revision 1, Section 2.3.3.1, states that, CCF modeling of components is not only dependent on the number of remaining in-service components but is also dependent on the reason components were removed from service (i.e. whether for preventative or corrective maintenance). In relation to CCF for preventive maintenance, the guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states:

If the component is down because it is being brought down for maintenance the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant.

The LAR does not discuss how CCFs are treated in the PRA models for planned maintenance.

Therefore, address the following:

a) Explain how CCFs are included in the PRA model (e.g., with all combinations in the logic models as different basic events or with identification of multiple basic events in the cut sets);

b) Explain how the quantification and/or models will be changed when, for example, one train of a 3x100 percent train system is removed for preventative maintenance and describe how the treatment of CCF meets the guidance in RG 1.177, Revision 1, or meets the intent of this guidance when quantifying a RICT.

RAI 5 - Common Cause Modeling for Emergent Conditions According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified

to reflect the reduced number of available components in order to properly model the as-operated plant. Attachment 2 of the LAR provides the proposed changes to the TSs. Part (d) to TS 5.5.18, Programs and Manual, insert states:

For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Regarding option 1 cited above, provide the following:

a) Describe and justify how the numerical adjustment for increased possibility of CCF will be performed, or b) Confirm that numerically accounting for the increased possibility of CCF in the RICT calculation will be performed in accordance with RG 1.177, Revision 1.

RAI 6 - Design Basis Success Criteria and RICT estimates TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493) does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE) in the RICT Program.

Additionally, the guidance in Item 11 in Section 2.3 of TSTF-505, Revision 2, states that The traveler will not modify Required Actions for systems that do not affect core damage frequency (CDF) or large early release frequency (LERF) or for which a RICT cannot be quantitatively determined. LAR Enclosure 1, Table E1-1 appears to include several TS LCO Conditions that could represent TS loss of function because the Condition allows a configuration that does not meet the design basis success criteria indicated in Table E1-1. LAR Enclosure 1, Table E1-1 summarizes how the PRA success criteria differs from the design basis success criteria. In certain instances, it is unclear if the design basis success criteria can be satisfied in all the conditions for which a RICT is proposed. Therefore, address the following:

a. TS LCO 3.6.3.A and 3.6.3.C in Table E1-1 both include in the Comments column that,

[o]nly penetrations that can contribute to LERF are modeled. Will a RICT be applied to penetrations that do not contribute to LERF and, if so, how is the RICT calculated consistent with the guidance in TSTF-505, Revision 2?

b. TS LCO 3.7.1 in Table E1-1 indicates that the design basis success criterion is Five of five MSSVs per SG, and that the PRA success criterion is One of five MSSVs per SG when associated [SG] PORV and steam dump not available. Clarify why one MSSV

inoperable is not a loss of TS specified safety function. If it is a loss of TS specified safety function clarify why a RICT can be applied to the condition.

c. TS LCO 3.6.5: Table E1-1 states for these LCO Condition C and Condition D that the LCO 3.6.5 Containment Spray (CS) and Cooling Systems function is not modeled in the PRA because it has been screened out based on hydraulic analysis. TS LCO 3.6.5.C and 3.6.5.D in Table E1-1 state that the containment cooling fan coil units are not modeled in the PRA. The additional discussion in section 2.6 states that, [a]dverse impacts caused by operation of the CS system are considered; such as increased Refueling Water Storage Tank (RWST) depletion rate during ECCS injection, potential for spurious operation and subsequent loss of RWST inventory after a fire initiating event, and potential failure of 4 kV bus load-rejection sequence if the CS breaker fails to open on demand. The two statements appear contradictory, one that adverse impacts are modeled while the other that nothing is modeled in the PRA. Therefore, address the following:

i. Clarify what is actually modeled in the PRA for these systems and which end states are affected by the modelled equipment (i.e., CDF, LERF, etc.).

ii. Summarize the minimum equipment needed to fulfill the design basis function(s) and confirm that a RICT is not applied to any loss of function condition.

iii. Explain how the change-in-risk will be calculated for a RICT when a CS train, containment fan coil units, or CS actuation channel is taken out of service, given that the CS function does not contribute to CDF or LERF. If no RICT calculation will be performed, then explain what RICT will be assumed for the cited LCO Conditions.

iv. Describe the hydraulic analysis mentioned in Table E1-1 that is the basis used to justify that the CS and Cooling Systems success or failure have no impact which sequences contribute to LERF.

v. Justify that the results of the hydraulic analysis are applicable to the PINGP regardless of configurations that are allowed by the RICT program.

RAI 7 - PRA Model Uncertainty Analysis Results The NRC staff SE for NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

During the audit, NRC staff reviewed the uncertainty analyses which consisted of (1) analysis of internal events PRA assumptions and sources of uncertainty, (2) analysis of fire PRA assumptions and sources of uncertainty, and (3) evaluation of key assumptions and sources of PRA modeling uncertainty specifically for the RICT program. The evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program concluded that there were no sources of uncertainty that needed to be included in the RICT LAR. However, during NRC review, NRC staff noted a few identified sources of uncertainty that appear to have the potential to impact the RICT calculations. Therefore, address the following:

a) The PINGP, Units 1 and 2, analysis of internal events PRA assumptions and sources of uncertainty identifies the applicability of component type data and the applicability of generic data as potential sources of modelling uncertainty. The analysis concludes that these are not really sources of uncertainty because the best available data sources were used. The primary source of generic failure rates, probabilities and distribution parameters used was NUREG-6928 (ADAMS Accession No. ML070650650), but secondary sources were also used including Utility Calculation Notes. Concerning the use of Utility Calculation Notes, it is not clear to NRC staff what information is contained in these calculation notes used to support the PRA models. NRC staff observes that the failure rates for non-typical equipment can be a source of uncertainty because it may require the use of surrogate data or engineering judgement. Therefore, address the following:

i. Explain what information is contained in the Utility Calculation Notes, and how it was used to support the development of component failure probabilities. Include explanation of whether this source of uncertainty is caused by non-typical equipment and whether engineering judgement was used to determine a failure probability for certain components. Also, include examples of how failure rates were determined for non-typical equipment not listed is NUREG/CR-6928.

ii. Justify your treatment of the potential sources of uncertainty cited above and explain or demonstrate why they have no impact on the RICT calculations.

iii. If in response to part (ii) above it cannot be justified that your treatment of these uncertainties has no impact on the RICT program, then explain how these uncertainties will be treated in the RICT program. Include discussion of any additional Risk Management Actions (RMAs) that would be implemented.

b) The PINGP, Units 1 and 2, analysis of fire PRA assumptions and sources of uncertainty indicates that components without cable routing are assumed failed unless further analysis was performed to assure systems are not compromised by the transient fire.

The analysis concludes that this assumption is not a source of uncertainty because it is industry practice. However, it is not clear to NRC staff how many or which components and systems are assumed to be failed in fire scenarios because of the lack of cable tracing. NRC staff notes that even though this modelling treatment produces a conservative estimation of fire CDF and LERF it can underestimate the change-in-risk determined in the RICT calculations by masking risk which results in the underestimation of associated completion times. In a RICT calculation, if an SSC is part of a system not credited in the fire PRA or it is supported by a system that is not credited, then the risk-increase due to taking that SSC out of service is masked. It is not clear to NRC staff that the cited assumption has no impact on the RICT program. Therefore, address the following:

i. Identify the systems or components that are assumed to always be failed (or are not included) in the fire PRA due to lack of cable tracing.

ii. Justify that exclusion of credit for the SSCs identified in part (i) above have an inconsequential impact on the RICT calculations. Include discussion about whether the risk associated with an SSC in the RICT program can be masked because the SCC (or a system that supports the SSC) is not credited (or not fully credited) in the fire PRA.

iii. As an alternative to part (ii), above, propose a mechanism to ensure that a sensitivity study is performed for the RICT calculations for applicable SSCs which accounts for the impact on the RICT of the non-conservative PRA treatment (i.e.,

that the SCC is failed or not included in the PRA model). The proposed mechanism should also ensure that any additional risk from correcting the false assumption that the SSC is always failed is either accounted for in the RICT calculation or is compensated for by applying additional RMAs during the RICT.

c) The PINGP, Units 1 and 2, evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program indicates that diversion flow paths were not modelled for the Residual Heat Removal (RHR) system. The analysis identified the following sources of flow diversion that were identified in the report were (1) failure of the RHR heat exchanger crosstie valves that diverts flow to the safety injection (SI) crossover and CS suction lines, (2) failure of the RHR heat exchanger crosstie valves that diverts flow to the letdown line, and (3) failure of the Component Cooling (CC) pumps that diverts flow back through the CC pump. The analysis determined the impact of these failures to be negligible because the failure of an RHR train is dominated by other train failures (by more than 2 orders of magnitude) and concluded that there is no impact from this source of uncertainty on the RICT calculations. NRC staff notes that the cited failures may have the potential to cause impacts on the plant besides RHR flow diversion and that there is a possibility that the cited failures can in the same accident scenario also contribute to the functional failure of other systems such as SI, CS, and the CC system.

Also, NRC notes that modelling treatments that have only a small impact on overall CDF and LERF can potentially have a more significant impact for particular configurations allowed under the RICT program. In light of these observations, address the following:

i. Explain what impact the cited failures that create RHR diversion flow paths have on interfacing systems such as the SI, CS, and the CC system and whether those failures could contribute to the same accident scenario.

ii. Justify that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths will have no impact on calculated RICTs including RICTS associated with RHR, SI, CS, and the CC system. One way to justify this uncertainty is to perform a sensitivity showing that the impact of the calculated RICT is minimal for configurations allowed under the RICT program.

iii. If in the response to part (ii) above, it cannot be justified that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths have no impact on the RICT program, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

d) The PINGP, Units 1 and 2 evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program indicates that external vessel cooling is credited to prevent core melt from escaping the vessels based on realistic MAAP modelling. In this case, it is not clear to NRC staff what is meant by realistic MAAP modelling.

Provide a description of the MAAP modelling, assumptions, and results that justifies this credit. Alternatively, summarize the scenarios affected by this assumption and provide a sensitivity study showing that this source of uncertainty has no impact on the RICT calculations by removing credit for external vessel cooling to prevent core melt escaping the vessels.

RAI 8 - TSTF 505 - Modelling of Instrumentation and Controls NEI 06-09 state, concerning the quality of the PRA model, that RG 1.174, Revision 1, and RG 1.200, Revision 1 define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

Based on documentation in the LAR, it is not clear to the NRC staff whether instrumentation and control (I&C) is always modeled in sufficient detail to support implementation of TSTF-505, Revision 2. The following additional information is requested:

a. Explain how I&C is modeled in the PRA. Include (1) the scope of the I&C equipment that is explicitly included (e.g., bistables, relays, sensors, integrated circuit cards), (2) description of the level of detail that is modeled (e.g., are all channels of an actuation circuit modeled?), (3) discussion of what data and whether plant specific data is used, and (4) discussion of the associated TS functions for which a RICT could be applied.

b. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation and that sensitivity studies should be used to develop appropriate compensatory RMAs.

Regarding digital I&C, NRC staff notes the lack of consensus industry guidance for modeling these systems in plant PRAs to be used to support risk-informed applications. In addition, known modeling challenges exist such as the lack of industry data for digital I&C components, the difference between digital and analog failure modes, and the complexities associated with modeling software failures including common cause software failures. Given these needs and challenges, if the modeling of digital I&C system is included in the RTR model, then address the following:

i. Provide the results of a sensitivity study on the SSCs in the RICT program demonstrating that the uncertainty associated with modeling digital I&C systems have inconsequential impact on the RICT calculations.

ii. Alternatively, identify which LCOs are determined to be impacted by the digital I&C system modeling for which RMAs will be applied during a RICT. Explain

and justify the criteria used to determine what level of impact to the RICT calculation require additional RMAs.

RAI 9 - Credit for FLEX Equipment and Actions The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2.

With regards to equipment failure probability, in the May 30, 2017 memo, the NRC staff concludes (Conclusion 8):

The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA Standard as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.

With regards to human reliability analysis (HRA), NEI 16-06 Section 7.5 recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as: debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses; and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. In the May 30, 2017 memo, the NRC staff concludes (Conclusion 11):

Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, [Human Error Probabilities] HEPs associated with actions for which the existing approaches are not explicitly applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

With regard to uncertainty, Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties should be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions.

Uncertainty exists in PRA modeling of FLEX, related to the equipment failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities. Therefore, FLEX modeling assumptions could be key assumptions and sources of uncertainty for RICTs proposed in this application.

The LAR does not address whether FLEX equipment or actions have been credited in the PRA models. The NRC staff notes that the LAR Enclosure 4, Section 3.2 refers to post-Fukushima FLEX mitigating strategies now in place., but provides no additional information about if, and

how, FLEX equipment is modeled in the PRA. To understand the credit that will be taken for FLEX equipment and actions in the RICT Program, address the following separately for the internal events PRA, internal flooding PRA, and fire PRA:

a) Discuss whether NSPM has credited FLEX equipment or mitigating actions in the PINGP internal events, including internal flooding, or fire PRA models.

If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested, and the remainder of this question is not applicable.

b) Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

c) Regarding the credited equipment:

i. Discuss whether the credited equipment (regardless of whether it is portable or permanently-installed) are like other plant equipment (i.e. SSCs with sufficient plant specific or generic industry data).

If all credited FLEX equipment is similar to other plant equipment credited in the PRA (i.e. SSCs with sufficient plant-specific or generic industry data), responses to items ii and iii below are not necessary.

ii. Discuss the data and failure probabilities used to support the modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

iii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact on RICT due to FLEX equipment data and failure probabilities. Part of the response include the following:

1. Justify values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Describe how the results of the sensitivity studies will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

d) Regarding HRA, address the following:

i. Discuss whether any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06.

If any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06, answer either item ii or iii below:

ii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact from the FLEX independent and dependent HEPs associated with deploying and staging FLEX portable equipment on the RICTs proposed in this application. Part of the response include the following:

1. Justify independent and joint HEP values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Discuss composite sensitivity studies of the RICT results to the operator action HEPs and the equipment reliability uncertainty sensitivity study provided in response to RAI APLA 13.c.iii.

4. Describe how the source of uncertainty due to the uncertainty in FLEX operator actions HEPs will be addressed in the RICT program. Describe specific RMAs being proposed, and how t these RMAs are expected to reduce the risk associated with this source of uncertainty.

iii. Alternatively, to item d.ii) above, provide information associated with the following items listed in supporting requirements (SR) HR-G3 and HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard to support detailed NRC review:

1. the level and frequency of training that the operators and/or non-operators receive for deployment of the FLEX equipment (performance shaping factor (a)),

2. performance shaping factor (f), regarding estimates of time available and time required to execute the response,

3. performance shaping factor (g) regarding complexity of detection, diagnosis and decision making and executing the required response,

4. Performance shaping factor (h) regarding consideration of environmental conditions, and

5. Human action dependencies as listed in SR HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard.

e) The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that upgrades of a PRA shall receive a peer review in accordance with the

requirements specified in the peer review section of each respective part of this Standard.

Provide an evaluation of the model changes associated with incorporating FLEX mitigating strategies, which demonstrates that none of the following criteria is satisfied:

(1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

RAI 10 - Application Specific Model CDF/LERF LAR Enclosure 5, Table E5-2 presents the CDF and LERF values for the baseline application specific model. It appears to NRC staff that the application specific model does not represent a specific configuration or an average configuration. Accordingly, explain why the CDF and LERF values from the baseline application specific model are presented in the LAR and how this model is defined.

RAI 11 - Joint Human Error Probability Guidance in NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), (Table 2-1) April 2005, (ADAMS Accession No. ML051160213) recommends joint human error probability (HEP) values should not be below 1E-05. Table 4-3 of EPRI 1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, provides a lower limiting value of 1E-06 for sequences with a very low level of dependence. The NRC staff notes that underestimation of minimum joint probabilities could result in non-conservative RICTs of varying degrees for different inoperable SSCs.

In PRA RAI 02.a (ADAMS Accession No. ML15089A157) during the NFPA-805 LAR review, the NRC staff requested additional information with respect to the minimum for joint HEPs used in the fire PRA. The response to PRA RAI 02.a (ADAMS Accession No. ML15714A139), indicated that it updated the FPRA to use no joint HEP value below 1.0E-05. The response to PRA RAI 02.a, stated that adequate justification for the future use of any value less than 1.0E-05 in the fire PRA will be provided.

TSTF-505 evaluations use the fire PRA and the internal events PRA. The LAR does not provide information about whether and, if so what, minimum joint HEP values are currently assumed in the internal events PRA. Considering these observations:

a. Clarify if the NFPA-805 fire PRA will be used for TSTF-505 calculations. If not, respond to the following question for fire PRAs joint HEPs below 1.0E-5 in addition to the requested information for internal event joint HEPs below 1.0E-6.

b. Explain what minimum joint HEP value was assumed in the internal events PRA.

c. If a minimum joint HEP value less than 1E-6 was used in the internal events PRA, then provide a description of the sensitivity study that was performed and the quantitative results that justify that the minimum joint HEP value has no impact on the RICT application.

d. If, in response part (c), it cannot be justified that the minimum joint HEP value has no impact on the application, confirm that each joint HEP value used in the internal events PRA below 1E-6 includes its own separate justification that demonstrates the inapplicability of the EPRI 1021081 lower value guideline (i.e., using such criteria as the dependency factors identified in NUREG-1921 to assess level of dependence). Provide an estimate of the number of these joint HEP values below the guideline values of 1.0E-6 for the internal events PRA, discuss the range of values, and provide at least two different examples, separately for the internal events and the fire PRA, where this justification is applied.

RAI 12 - Bounding Seismic LERF Estimate Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the [Risk Managed Technical Specifications] RMTS program, and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated Risk-Informed Completion Time (RICT). The NRC staffs safety evaluation for NEI 06-09 states that [w]here [probabilistic risk assessment] PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT.

A seismic PRA model is not available for PINGP, Units 1 and 2, and the seismic hazard cannot be screened out for the RICT application. Section 3 of Enclosure 4 to the LAR stated that a seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) penalty was determined for this application using the current PINGP, Units 1 and 2, seismic hazard curve developed in response to Recommendation 2.1 of the Near-Term Task Force (NTTF) (ADAMS Accession No. ML14086A628). Section 3.1 of Enclosure 4 to the LAR stated that the total PINGP SCDF is estimated to be 3.0E-06 per year using PINGP, Units 1 and 2, high confidence of low probability of failure (HCLPF), the spectral ratios in the safety assessment for GI-199 (ADAMS Accession No. ML100270639), and the hazard curves developed in response to Recommendation 2.1 of NTTF (ADAMS Accession No. ML14086A628). It is unclear to the NRC staff why the spectral ratios determined from the IPEEE submittals in GI-199 were used in this application, instead of developing them from the more recent hazard curves developed in response to Recommendation 2.1 of NTTF to determine the SCDF estimate.

Details of the approach for determining the seismic LERF penalty are provided in LAR , Section 3.3 using the Conditional Large Early Release Probability (CLERP) for internally initiated events with some adjustment (i.e., the contribution of certain containment bypass events that would not be expected from a seismic event were not included in the CLERP). The LAR states that the CLERP determined using this approach was chosen as an adequately conservative estimate. As noted earlier, the NEI 06-09, Revision 0-A, as well as the corresponding NRC staff SE, calls for a bounding analysis. In addition, NRC staff observes that LERF-to-CDF ratio for seismic events can be significantly higher than the same ratio for internal events due to the unique nature of seismically-induced failures. It is unclear that the selected CLERP of 5% can be considered as a bounding value for use in the RICT calculation.

a) Update the total PINGP, Units 1 and 2, SCDF using spectral ratios developed from the current PINGP, Units 1 and 2, seismic hazard curve in the response to Recommendation

2.1 of NTTF or provide justification on why using the GI-199 spectral ratios instead of the more recent seismic hazard curves is acceptable.

b) Justify that the seismic LERF penalty provided in the submittal to support RICT calculations for the PINGP, Units 1 and 2, is bounding. Include rationale that deriving seismic LERF-to-CDF ratio using the internal events LERF-to-CDF ratio is bounding for seismically induced events, given that internal events random failures do not capture seismically-induced failures that may uniquely contribute to LERF.

c) If the approach to estimating the seismic LERF penalty cannot be justified as bounding for this application in response to part (b) above, then provide, with justification, the bounding seismic LERF penalty for use in RICT calculations.

RAI 13 - Screening the External Flooding Hazard Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that

[o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including external flooding. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program.

LAR Enclosure 4, Table E4-2 indicates that criterion PS1 (design basis hazard cannot cause a core damage accident) was used to screen the external flooding hazard and states based on the flood hazard reevaluation report (FHRR) and a follow-up focused evaluation for PINGP that concluded external flooding does not challenge the current licensing basis or plant safety systems. LAR Table E4-2 states that during local intense precipitation (LIP) the site has effective flood protection through the determination of Available Physical Margin and the reliability of protection features. NRC staff notes that the June 2014 staff assessment report on the flooding walkdown report (ADAMS Accession No. ML14148A477) states that a deficiency in the flood response was initially identified related to the power supply for needed portable sump pumps to ensure their functionality in case of loss of off-site power during the event. If the reliability of the flood response is dependent on systems and SSCs such as power supply and distribution, then the reliability of flood response could potentially be impacted by plant configuration. In light of these observations, it is unclear to the staff whether the licensees screening of external flooding risk from the RICT program has adequately considered the reliability of protective features considering the plant configuration.

Identify the protective features credited for screening the external flooding hazard and justify that screening of the external flooding hazard considering the reduced reliability/availability of those protection features due to plant configuration. Alternatively, describe how the risk associated with the external flooding hazard is considered in the RICT program.

RAI 14 - Screening of Snowfall Risk Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the

PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that

[o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including snow. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program. LAR , Table E4-2, indicates that criterion C1 (event damage potential is less than events for which plant is designed) and criterion C4 (event is included in the definition of another event) was used to screen the snow hazard. The LAR further states that the design basis roof live load is 50 pounds per square foot (psf) and the maximum recorded snowfall from a single storm in Minnesota occurred near Finland, Minnesota and measured 46.5 inches with an estimated weight of 46.5 psf, which is within the design basis. Considering the small margin between the design basis roof live load and the maximum recorded snowfall, it is unclear to the staff whether the risk of this hazard is adequately considered for this application In light of these observations, justify the screening of risk associated with snowfall from the application by showing that the occurrence frequency of snowfall events that could challenge the plant is low.

RAI 15 - Real-Time Risk Model Regulatory Position 2.3.3 of RG 1.174 states that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

Section 4.2 of NEI 06-09 describes attributes of the configuration risk management tool (CRM).

A few of these attributes are listed below:

• Initiating events accurately model external conditions and effects of out-of-service equipment.

• Model translation from the PRA to a separate CRM tool is appropriate; CRM fault trees are traceable to the PRA. Appropriate benchmarking of the CRM tool against the PRA model shall be performed to demonstrate consistency.

• Each CRM application tool is verified to adequately reflect the as-built, as-operated plant, including risk contributors which vary by time of year or time in fuel cycle or otherwise demonstrated to be conservative or bounding.

• Application specific risk important uncertainties contained in the CRM model (that are identified via PRA model to CRM took benchmarking) are identified and evaluated prior to use of the CRM tool for RMTS applications.

• CRM application tools and software are accepted and maintained by and appropriate quality program.

• The CRM tool shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

• Seasonal or time-in-operating cycle variations must be either conservatively assessed or properly quantified for the conditions. of the LAR describes the attributes of the RTR, or CRM, tool, for use in RICT calculations at PINGP, Units 1 and 2. The LAR explains that the internal flood model is integrated into the internal events PRA model, but the fire PRA model is maintained as a separate model. The LAR also describes several changes made to the internal events and fire PRA models to support calculation of configuration-specific risk and mentions approaches for ensuring the fidelity of the RTR to the PRAs including RTR maintenance, documentation of changes, and testing. With regards to development and application of the RTR model, address the following:

a) NEI 06-09 Section 2.3.4 states:

If the PRA model is constructed using data points or basic events that change as a result of time of year or time of cycle (examples include moderator temperature coefficient, summer versus winter alignments for HVAC, seasonal alignments for service water), then the RICT calculation shall either 1) use the more conservative assumption at all time, or 2) be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration for the feature as modeled in the PRA.

Explain how any changes in environmental conditions due to seasonal variations are accounted for in the CRM model for use in RICT calculations. Include discussion of impacts on the plant response model (e.g., temperature impact on system success criteria) and on initiator frequency (e.g. impact on LOOP frequency). Also, include discussion of the bases for not modelling the potential impact of seasonal variations on systems included in the PRAs (e.g., Use of analyses such of GOTHIC (General Purpose Thermal-Hydraulic Analysis) to determine the impact of ambient air temperature on system success, and the use of Risk Management Actions).

b) Confirm that out-of-service equipment will be properly reflected in the CRM model initiating event models as well as in the system response models.

c) Describe the process that will be used to maintain the accuracy of any pre-solved cutsets with changes in plant configuration.

RAI 16 - PRA Model Uncertainty Analysis Process The NRC staff SE to NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainties for the internal events and fire PRAs was performed using the guidance in NUREG-1855, Revision 1. The LAR explains that to identify key assumptions and sources of PRA modeling uncertainty (1) the internal events and fire PRA models and notebooks were reviewed for plant-specific issues and (2) generic sources of uncertainty identified in Electric Power Research Institute (EPRI) Technical Report (TR) -1016737 and 1026511 were also reviewed for applicable issues. The LAR concludes for both the internal events and fire PRAs that no specific uncertainty issues have been identified that would impact the RICT application, and no candidate key assumption and sources of uncertainty were presented in the LAR.

Based on the discussion in the LAR, it is not clear to NRC staff what specific process and criteria were used to screen uncertainties from an initial comprehensive list of assumptions and sources of PRA modeling uncertainty (including those associated with plant specific features, modeling choices, and generic industry concerns), in order to conclude that no uncertainty issues could impact the RICT calculations. It is also not clear whether certain key assumptions and sources of uncertainty were initially identified but found to be unimportant through use of sensitivity studies per guidance described in LAR Enclosure 9, Section 1.0.

Therefore, address the following:

a) Describe the specific PINGP process used to screen uncertainties from the initial comprehensive lists of PRA uncertainties (including those associated with plant specific features, modeling choices, and generic industry concerns), in order to eventually conclude that the uncertainty issues could not impact the RICT calculations.

b) Include description of the criteria that was used to screen down from a comprehensive listing of sources of uncertainty to a smaller set of key candidate assumptions and sources of uncertainty; and also describe the criteria used to justify that none of the key candidate assumptions and sources of uncertainty could have an impact on the RICT calculations. As part of this description, explain whether use of the results of sensitivity studies were included as part of the criteria that was used.

c) Include description of plant or PRA procedures, practices or processes that are used to support the identification and dispositioning PRA modelling uncertainty concerns (e.g., a PRA change database).

RAI 17 - Loss of Function TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493), does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be operable) in the risk informed completion time program.

Based on the design success criteria provided in the license amendment request Enclosure 1, Table E1-1, it appears that some LCO Conditions and/or Required Actions may constitute a loss of function. Provide a basis for why the following does not constitute a loss of function, or alternatively, remove it from the scope of the risk informed completion time program.

1. TS 3.3.1, Reactor Trip System (RTS) Instrumentation

• Required Action M.1 o The option of calculating a RICT is applied to the action to restore channel to OPERABLE status (for Condition M, One Reactor Coolant Pump Breaker Open channel inoperable). This appears to be a loss of function when greater than the P-7 interlock and less than the P-8 interlock.

• Required Action O.1 (previously N.1 before insertion of new Conditions N & P) o Place channel in trip (for Condition O, One Turbine Trip channel inoperable). This appears to be a loss of function for instrument 14.b, Turbine Stop Valve Closure.

2. TS 3.3.2, Engineered Safety Features Actuation System (ESFAS) Instrumentation

• Required Action B.1 o The option of calculating a RICT is applied to the action to restore channel or train to OPERABLE status (for Condition B, One channel or train inoperable). This appears to be a loss of function for instrument 2.a, Containment Spray Manual Initiation.

• Required Action F.1 o The option of calculating a RICT is applied to the action to restore channel or train to OPERABLE status (for Condition F, One channel or train inoperable). This appears to be a loss of function for instrument 4.a, Steam Line Isolation Manual Initiation.

3. TS 3.3.4, 4 kV Safeguards Bus Voltage Instrumentation

• Required Action C.5 o The option of calculating a RICT is applied to the action to restore automatic load sequencer to OPERABLE status (for Condition C, Required Action and associated completion time of Condition A or B not met, or Function a or b or both with three channels per bus inoperable, or one required automatic load sequencer inoperable). This appears to be a loss of function for the Condition when Function a or b or both with three channels per bus inoperable.

4. TS 3.7.8, Cooling Water (CL) System

• Required Action A.1 o The option of calculating a RICT is applied to the action to restore one safeguards CL pump to OPERABLE status (for Condition A, No safeguards CL pumps OPERABLE for one train). This appears to be a loss of function as Updated Final Safety Analysis Report Section 6.2.2.1.3 states:

For post-DBA recirculation flow, two of the three safeguards Cooling Water pumps (two diesel driven and one motor driven) are started.

However, only one Cooling Water pump is required to operate during the recirculation phase to cool the recirculation flow and containment atmosphere in the unit suffering the accident and provide the necessary cooling for the other unit.

RAI 18 - Instrument and Controls (I&C) Defense-in-Depth In Section 3.1.2.3 Evaluation of Instrumentation and Control Systems of the TSTF-505 Revision 2 Model safety evaluation (SE) (ADAMS Accession No. ML18267A259), the NRC

clarifies, in part, that the basis of the staffs safety evaluation is to consider a number of potential plant conditions allowed by the new TSs and to consider what redundant or diverse means were available to assist the licensee in responding to various plant conditions. The TSTF-505 Revision 2 Model SE states, in part, that at least one redundant or diverse means (e.g., other automatic features or manual action) to accomplish the safety functions (e.g.,

reactor trip, safety injection, or containment isolation) remain available during the use of the risk-informed completion time (RICT).

RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Licensing Basis, states, in part, that the licensee should assess whether the proposed license basis (LB) change meets the defense-in-depth principle by not over-relying on programmatic activities as compensatory measures associated with the change in the LB. RG 1.174 also elaborates that human actions (e.g., manual system actuation) are considered as one type of compensatory measure.

RG 1.177, An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications, describes the regulatory position with respect to defense-in-depth (including diversity).

In Section 3.0, Evaluation of Instrumentation and Control Systems of Enclosure 1 of the LAR, the functional units are listed for both the Reactor Trip System (RTS) and the Engineered Safety Features Actuation System (ESFAS). For RTS Instrumentation in Section 3.1, of the LAR the licensee states that The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS. The LAR lists all the trip inputs but does not describe the diversity and defense-in-depth associated with each plant limiting condition/event.

Similarly, for the ESFAS Instrumentation in Section 3.2 of the LAR, the licensee lists the different inputs through which the actuation occurs; however, the LAR does not describe the diversity and defense-in-depth associated with each limiting condition/event.

The NRC staff notes that for both RTS and ESFAS, the LAR does not provide adequate information to verify at least one redundant or diverse means will remain available to accomplish the intended safety functions of proposed instrumentation and control (I&C) TS with RICT in the LAR.

In light of these observations:

a) Describe other means that exist to initiate the safety function for each plant accident condition/event that the identified I&C TS function in the LAR is currently designed to address. The evaluation of diverse means should identify the conditions that each functional unit responds to, and for each condition, other means (e.g., diversity, redundancy, or operator actions) that can be used.

b) In Section 3.0 of the LAR Enclosure 1, for both RTS and ESFAS systems LAR lists several manual actuations as diverse means for each affected I&C safety function.

Confirm that these manual actuations are defined in the PINGP, Units 1 and 2, operation procedures to which the operators are trained.

RAI 19 - Design Success Criteria for TS 3.8.1 In Table E1-1 of Enclosure 1 of the LAR, the licensee stated that the design success criteria (DSC) for TS 3.8.1, Condition C - Two paths inoperable, are one qualified path to the grid for one safeguards bus. Describe the three independent paths/circuits with sufficient detail for the staff to understand how each path/circuit satisfies the design success criteria in terms of independence and capacity.

RAI 20 - RICT Estimates for Electrical TSs The LAR proposes a new TS requirement 5.5.18 Risk Informed Completion Time Program.

The proposed TS 5.5.18 states that This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, Risk-Managed Technical Specifications (RMTS) Guidelines. NEI 06-09-A, Revision 0, states the following regarding high risk configurations:

RMTS evaluations shall evaluate the instantaneous core damage frequency (CDF), instantaneous large early release frequency (LERF). If the SSC inoperability will be due to preplanned work, the configuration shall not be entered if the CDF is evaluated to be greater or equal than 10-3 events/year or the LERF is evaluated to be greater or equal to 10-4 events/year. If the SSC inoperability is due to an emergent event, if these limits are exceeded, the plant shall implement appropriate risk management actions to limit the extent and duration of the high risk configuration.

NEI 06-09, Revision 0-A, prohibits voluntary entry into a high risk configuration but it allows entry in such configurations due to emergent events with implementation of appropriate risk management actions.

Table E1-2 of Enclosure 1 of the LAR provides RICT estimates for TS actions proposed to be in the scope of the RICT program. However, RICT estimates for TS 3.8.4.B, 3.8.4.C, 3.8.9.A, and TS 3.8.9.B are not provided. In addition, Note #2 of Table E1-2 states:

Several quantification results exceed the risk cap level of 1E-03 (CDF) or 1E-04 (LERF). Those LCOs are listed as No Entry given the quantified risk. However, it is possible that the LCO could be entered for a partial failure and would result in lower quantified risk. In a lower risk condition, entry into the RICT Program would be allowed.

This note appears to be inconsistent with NEI 06-09, Revision 0-A, which states that involuntary RICT entries into conditions of high instantaneous CDF or LERF would be also prohibited.

Address the following:

a) Clarify the intent of Note #2 and how NEI 06-09, Revision 0-A, will be followed regarding involuntary entries into high risk configurations.

b) Discuss the risk management actions that would be implemented for these TS conditions.

c) Provide RICT estimates for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B.

d) Note #2 states, it is possible that the LCO could be entered for a partial failure and would result in lower quantified risk. Provide a description of potential partial failures for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B.

RAI 21 - Electrical RMAs As part of its evaluation, the NRC staff reviews the proposed RMA examples for reasonable assurance that the RMAs are considered to monitor and control risk and to ensure adequate defense-in depth. The RMA examples should be TS condition specific. Provide RMA examples for the electric power systems TS conditions (TS 3.8.1, TS 3.8.4, and TS 3.8.9) described in the LAR.