Text

Response to Request for Additional Information: License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4
	ML20245E401
Person / Time
Site:	Prairie Island
Issue date:	09/01/2020
From:	Sharp S; Northern States Power Company, Minnesota, Xcel Energy
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	EPID L2019-LLA- 0283, L-PI-20-026
	Download: ML20245E401 (159)
	v • d • e

fl Xcel Energy 1717 Wakonade Drive Welch, MN 55089 September 1, 2020 L-PI-20-026 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant, Units 1 and 2 Docket Nos. 50-282 and 50-306 Renewed Facility Operating License Nos. DPR-42 and DPR-60 Response to Request for Additional Information: License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (EPID: L2019LLA-0283)

References:

1) Letter (L-PI-19-031) from NSPM to the NRC, License Amendment Request: Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated December 16, 2019 (ADAMS Accession No. ML19350C188)

2) Letter from the Technical Specification Task Force (TSTF) to the NRC, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, Revision 2, dated July 2, 2018 (ADAMS Accession No. ML18183A493)

3) Email from the NRC to NSPM, Request for Additional Information RE:

Prairie Island license amendment request to adopt TSTF-505 (EPID:

L2019-LLA-0283), dated July 7, 2020 (ADAMS Accession No. ML20192A144)

In Reference 1, Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submitted a license amendment request to the Technical Specifications (TS) for the Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (Reference 2). The NRC identified the need for additional information and provided the Request for Additional Information (RAI) in Reference 3. The enclosure to this letter provides NSPMs response to the NRC RAI.

Document Control Desk Page 2 The information provided in this letter does not alter the evaluations performed in accordance with 10 CFR 50.92 in Reference 1.

NSPM is notifying the State of Minnesota of this request by transmitting a copy of this letter and enclosures to the designated State Official.

Please contact Mr. Peter Gohdes at (612) 330-6503 if there are any questions or if additional information is needed.

Summary of Commitments This letter makes no new commitments and no revisions to existing commitments.

I declare under penalty of perjury, that the foregoing is true and correct.

Executed on September j_, 2020.

Enclosure cc: Administrator, Region Ill, USNRC Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC State of Minnesota Page 2 of 2

L-PI-20-026 NSPM Enclosure Response to Request for Additional Information License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (EPID: L2019LLA-0283)

1.0 BACKGROUND

In Reference 1, Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submitted a license amendment request to the Technical Specifications (TS) for the Prairie Island Nuclear Generating Plant (PINGP), Units 1 and 2. The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (Reference 2). The NRC identified the need for additional information and provided the Request for Additional Information (RAI) in Reference 3. The following section provides NSPMs response to the NRC RAI.

2.0 RESPONSES TO REQUEST FOR ADDITIONAL INFORMATION RAI 1 - Consideration of Shared Systems in RICT Calculations LAR Enclosure 1, Table E1-1 identifies each TS Limiting Condition for Operation (LCO) proposed to be included in the Risk Informed Completion Time (RICT) program and describes how the systems and components covered in the TS LCO are implicitly or explicitly modeled in the PRA. LAR Section 2.4.7, states that the PINGP, Units 1 and 2, Cooling Water (CL)

System is a shared system between units. Shared systems operate continuously and simultaneously supporting both units. There are also cross-tied systems that can, when needed, be cross-tied to the unit needing the extra functions. For example, LAR Enclosure 1, Table E1-1 states for TS LCO 3.8.1 (AC Sources - Operating) Condition B (One Diesel Generator (DG) inoperable) that PRA success criteria also includes credit for re-powering buses through the cross-tie to the opposite unit in some circumstances. Therefore, address the following:

a) Explain how shared systems are modelled when the shared systems are credited in the PRA models for both units.

b) Explain how cross-tied systems are modelled when the cross-ties are credited in the PRA models for both units.

c) If shared and/or cross-tied systems are credited in the Real Time Risk (RTR) model that supports the RICT calculations, then explain how the systems are credited when a RICT is calculated for each unit.

Page 1 of 83

L-PI-20-026 NSPM Enclosure d) If shared and/or cross-tied systems are credited in the RTR model that support the RICT calculations, then explain how the impact of initiating events can create a concurrent demand for the system at both units.

NSPM Response to RAI 1.a There are several systems that are shared by both units during normal operation and accident mitigation. These shared systems include:

1. Cooling Water The cooling water (CL) system is normally in a ring-header configuration and splits into a two-train system upon receipt of a safety injection (SI) signal from either unit, or by manual operator action. Each CL system train feeds safeguards loads for the applicable safeguards train on both units. The system contains five pumps. One safeguards and one non-safeguards pump is present on each train. The non-safeguards pumps are normally running and the safeguards pumps will auto-start on low header pressure or SI signal. The 121 pump may be run when needed during high cooling water demand or when one of the non-safeguards pumps is out of service. The 121 CL pump is located between the trains and is a safeguards-powered pump that will auto-start and feed the ring header upon low pressure. If an SI signal occurs, the 121 CL pump will align to Train A for a Unit 1 SI signal, or Train B for a Unit 2 SI signal. The 121 CL pump can also be manually aligned to a header as a safeguards pump replacement. If aligned, the automatic alignment features are defeated such that the pump will remain on the aligned train even if an SI signal occurs.

The CL system takes suction from multiple sources. The two non-safeguards pumps take suction from the circulating water (CW) bays and the three safeguards pumps take suction from the safeguards CL pump bay. The safeguards CL pump bay is fed from both CW bays as well as an emergency intake line from the Mississippi river.

The CL system is designed to simultaneously feed both units, so the PRA model considers this capability. The PRA model considers when operators must manually shed loads to reduce demand on the system and when operators may need to re-cross-tie and re-pressurize a header if pump failures occur on that header after initial train split.

The PRA model also considers the different potential initial configurations of the system including ring-header, split headers, 121 CL pump aligned to a header, or partial header split.

The model also considers which pumps are running, and not running, since the system demand can vary throughout the year. Operators can align the system in the real-time risk model to match the actual header and operating pump configuration.

The PRA model also considers changes to the system configuration that will occur once an initiating event occurs as described above. Depending on initiator and initial configuration, the headers may split, turbine building loads may be shed, and pumps may auto-start. If not already aligned to a header, the 121 CL pump will align to the applicable train upon receipt of Page 2 of 83

L-PI-20-026 NSPM Enclosure an SI signal. The PRA model also considers operator recovery of failed pump start signals or header split signals.

2. External Circulating Water The external circulating water (CT) system is a non-safeguards system that provides a source of water to the circulating water, cooling water, and other pumps (e.g., fire pumps). The system consists of the intake screenhouse that admits water from the Mississippi river to the recycle canal. There are no system configuration changes that occur prior to or after an initiating event.

The system is designed to simultaneously feed water to the CW and CL pumps for both units at power and after an initiating event so the PRA model considers this capability. The model also considers when operators must manually open bypass gates upon failure of the automatic open signal.

3. Station and Instrument Air The Station and Instrument Air system is a non-safeguards system that provides compressed air to instrumentation, air-operated valves, and other equipment. The system consists of two separate subsystems that are normally cross-tied, Instrument Air and Station Air. The instrument air subsystem contains three instrument air compressors and the station air subsystem contains two station air compressors. The station air system provides a backup source of air to the instrument air system but a check valve prevents back flow from instrument air to station air. Compressors in each subsystem auto-start and stop as needed to maintain header pressure on their respective subsystem.

The instrument air subsystem is designed to feed air to both units simultaneously prior to and after an initiating event. The subsystem includes valves that will automatically close on low header pressure to split the subsystem into unit-specific portions.

The station air subsystem is credited in the PRA only to feed the instrument air subsystem, the remainder of the station air subsystem functions are not modeled.

The PRA model considers the instrument air subsystem capability to feed both units simultaneously. The PRA model also considers the automatic split of the system that will occur on low header pressure to prevent a failure on one unit from impacting the other.

4. Control Room Ventilation (including safeguards chilled water)

The control room ventilation (ZN) system is a safeguards system that controls the ambient air temperature in the control room. The system consists of two separate trains that normally mix and cool a combination of outside air and recycled air. One train is normally running and one train is normally in standby. Upon receipt of an SI signal from either unit, the standby train will start and the outside air dampers for both trains will close.

Page 3 of 83

L-PI-20-026 NSPM Enclosure The ZN system is cooled by a cooling coil in the ductwork that is cooled by the safeguards chilled water (ZH) system. The ZH system consists of two normally cross-tied trains of chilled water. Each train contains a chilled water pump and a chiller. One train is normally running and supplying chilled water to both trains and the other train is normally in standby. The cross-tied piping contains valves that close to split the trains when necessary. Upon receipt of an SI signal from either unit the cross-tie valves will close and the standby train will start.

The ZH system is designed to simultaneously feed chilled water to a number of unit coolers on both trains of both units in addition to the ZN system cooling function. The PRA model only credits the control room cooling function of the ZH system.

The PRA model considers the different potential initial configurations of the ZN and ZH systems including which train(s) of each system are in operation and whether the ZH system is cross-tied or in a split train configuration. Operators can align the system in the real-time risk model to match the actual configuration of operating ZN and ZH trains.

The PRA model also considers changes to the system configuration that will occur once an initiating event occurs as described above. Depending on initiator and initial configuration, the ZH trains may split and standby trains may auto-start. The PRA model also considers operator recovery of failed train start signals and re-establishment of the outside air supply following an inadvertent SI signal.

NSPM Response to RAI 1.b There are two systems modeled in the PRA that have cross-tie capability during accident mitigation. The systems that have cross-tie capability are:

1. Safeguards 4kV AC Power The safeguards 4kV buses are designed with cross-tie capability to the same train bus on the opposite unit (i.e. Bus 15 cross-tie to 25 and Bus 16 cross-tie to 26). The cross-tie consists of two 4kV breakers in series with one breaker on each bus. The breakers must be closed by operators from the control room when desired and they will automatically open during the load shed cycle after an SI signal from the applicable unit. Each cross-tie breaker is open during normal operation and is typically only closed for short periods during testing.

The PRA model credits the bus cross-ties to restore power to an AC bus when the normal and backup AC power sources are unavailable after an initiating event. For example, a loss of offsite power (LOOP) occurs and the emergency diesel generator(s) on one or both buses on a unit fail to start. Both the hardware failure of the cross-tie breakers, with associated dependencies, and operator failure to close the breakers are considered in the model when crediting the cross-tie capability.

There are two potential cases where this power recovery through the bus cross-tie is credited.

The first is an SBO, where both AC buses on a unit are unpowered. In this case, the timing of operator actions to recover power from the opposite unit varies depending on the initiating Page 4 of 83

L-PI-20-026 NSPM Enclosure event that resulted in the SBO, when the SBO occurred (i.e., <1 hour into the event or >1 hour into the event), and subsequent success or failure of the turbine driven AFW pump during the SBO coping period. The second case is when one bus is powered but the other bus is unpowered (i.e. non-SBO) due to a diesel failure. In this case, AC power recovery within the first hour is credited in some initiating events when at least one AFW pump successfully feeds at least one steam generator for one hour.

2. Auxiliary Feedwater The Auxiliary Feedwater System (AFW) is designed with a cross-tie between the two units motor driven AFW pumps. The cross-tie consists of two normally closed manual valves in series between the two pumps. When this cross-tie is used, the cross-tied pumps discharge throttle valves to its own units steam generators are closed and the pump is unavailable to supply its own unit.

The PRA model credits this cross-tie to restore AFW flow after failure of both AFW pumps on one unit. The hardware failure of the cross-tie valves and the opposite units motor driven AFW pump are considered as well as failure of operators to perform the cross-tie. Since the action must be performed locally, spatial impacts are also considered for internal flood and internal fire initiators to exclude credit for the operator action in situations where operators would not be able to access the area.

NSPM Response to RAI 1.c The shared and/or cross-tied systems are credited in the Configuration Risk Management (CRM) model as described in the response to RAIs 1.a and 1.b. The system fault trees utilized in the average maintenance PRA model are the same as those used in the CRM model, with the exception of changes to remove maintenance events and unit availability factor as well as changes associated with quantification speed improvement.

The PRA model used in the CRM model is a single fault tree that contains separate top events for each units CDF and LERF. The system fault trees within each units top events contain the applicable logic for shared and/or cross-tied systems so that items taken out of service in the CRM model for one unit will simultaneously impact both units. This ensures that calculation of a RICT will include consideration for any increase in risk caused by shared and/or cross-tied equipment that is out of service, or in an alignment that is different from the baseline zero-maintenance case.

NSPM Response to RAI 1.d

1. Cooling Water, External Circulating Water, Instrument Air, and Control Room Ventilation Systems As described in the response to RAI 1.a, concurrent demand on the Cooling Water, External Circulating Water, Instrument Air, and Control Room Ventilation systems are considered in the design of the systems and the systems have sufficient capacity to supply both units Page 5 of 83

L-PI-20-026 NSPM Enclosure simultaneously. No special modeling is required to further consider the impact of concurrent demands on these systems.

2. Safeguards 4kV AC Power The safeguards 4kV AC bus cross-tie hardware is rated for the full capacity of the 4kV buses, so no special modeling is required when the bus supplying the power is energized from offsite power. When the AC bus supplying power through the cross-tie is energized from its associated emergency diesel generator (DG), the DG capacity has been evaluated to determine required versus available capacity during concurrent demands. The evaluation showed that the Unit 2 D5 and D6 diesel generators have sufficient capacity to supply all required ECCS injection and recirculation loads combined with other applicable loads such as Motor Driven AFW, 121 CL Pump, and Containment Spray for the applicable train on both units simultaneously.

The Unit 1 D1 and D2 DG are lower capacity, but were shown to have sufficient capacity to support ECCS injection and recirculation loads on one unit while simultaneously supporting ECCS injection loads on the opposite unit and while also considering other applicable loads such as Motor Driven AFW and Containment Spray. The D1 and D2 diesel generators do not have sufficient capacity to power the 121 CL Pump so this load is assumed to be unavailable in the cross-tie configuration.

The AC power recovery logic differentiates between the capacity of the two units EDGs by including a late power recovery step on the Unit 2 event trees to account for the need of additional power recovery when D1 or D2 is providing power through the cross-tie. The late power recovery supports the ECCS recirculation function and requires recovery of offsite power because of the capacity limitation of D1 and D2. This logic prevents concurrent demands from causing overload of the D1 or D2 diesel generators.

3. Auxiliary Feedwater The motor driven AFW pump cross-tie logic in the PRA model is designed to exclude concurrent demand for the pump on both units. If a single-unit initiator exists the cross-tie logic is allowed. If a dual-unit initiator exists the availability of the turbine driven AFW pump is checked to ensure that the unit with the available motor driven AFW pump has sufficient AFW capability to mitigate the event. If the turbine driven AFW pump on the cross-tie unit is unavailable, the cross-tie is not credited because the motor driven AFW pump is required to support its own unit.

RAI 2 - TSTF-505 Implementation Items The NRC safety evaluation approving Nuclear Energy Institute (NEI) 06-09 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML071200238) states that: [Regulatory Guide] RG 1.174, Revision 1, and RG 1.200, Revision 1 [ADAMS Accession No. ML090410014] define the quality of the [probabilistic risk assessment] PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety Page 6 of 83

L-PI-20-026 NSPM Enclosure implications of the proposed TS change and the role the PRA plays in justifying the change.

NEI 06-09 (ADAMS Accession No. ML12286A322) states that, [t]he PRA shall be reviewed to the guidance of Regulatory Guide 1.200 Rev. 0 for a PRA which meets Capability Category 2 for the supporting requirements of the ASME internal events at power PRA standard.

Deviations from these capability categories relative to the [risk-managed technical specifications] RMTS program shall be justified and documented. NEI 06-09 further clarifies that, [t]he PRA shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

LAR Attachment 5 identifies two items to be completed prior to implementation for the RICT program to satisfy the guidance that the PRA reflect the as-built, as-operated plant and that the PRA technical adequacy is acceptable.

Item #1 of LAR Attachment 5, Table A5-1 states:

NSPM shall ensure that the fire PRA model used for the RICT Program reflects the as-built, as-operated plant using the same fire PRA model used to support National Fire Protection Association (NFPA) 805 implementation for both PINGP units prior to implementation of the RICT Program.

The meaning of the phrase using the same fire PRA model is not clear to NRC staff. NRC staff observes that the fire PRA used to support the NFPA 805 application did not reflect the as-built, as-operated plant, but rather credited plant modifications and implementation items that NSPM committed to complete prior to implementation of the NFPA 805 program. If not all the NFPA 805 modifications and implementation items are completed prior to implementation of the RICT, then the fire PRA needs to be adjusted to reflect the as-built, as-operated plant.

Item #2 of LAR Attachment 5, Table A5-1 states: NSPM shall ensure that the High-High Containment Pressure signal input to the [main steam isolation valve] MSIV closure logic is modeled in the PINGP PRA prior to implementation of the RICT Program.

In light of these observations:

a) Confirm that implementation Item #1 of LAR Table A5-1 is to ensure that the fire PRA model used in the RICT calculations reflects the as-built, as-operated plant even if not all NFPA 805 plant modifications and implementation items are complete and adjust the wording in in Item #1 of LAR Table A5-1 accordingly.

b) If the cited implementation item is different from stated in part (a) above, then clarify what the item is and justify that the fire PRA sufficiently reflects the as-built, as-operated plant prior to implementation of the RICT program.

c) Confirm that implementation Item #2 of LAR Table A5-1 is to ensure that the High-High Containment Pressure signal input to the Main Steam Isolation Valve (MSIV) closure logic modeled in the internal events PRA model prior to implementation of the RICT Page 7 of 83

L-PI-20-026 NSPM Enclosure Program also applies to the fire PRA model and adjust the wording in Item #2 of LAR Table A5-1 accordingly.

d) If implementation item 2 is not meant to apply to the fire PRA, then explain why and justify that the fire PRA model will be sufficient to support the RICT program.

e) Table E2-1 in the LAR discusses the internal event finding SY-A17 that the PRA includes credit for the reactor coolant pump (RCP) abeyance seal. The finding is left open because an NRC accepted model for the Abeyance seal has not been developed.

The LAR reported in a sensitivity study that demonstrated that removing credit for the Abeyance seal in the internal events PRA has minimal impact on the RICT estimates.

The LAR discussion appeared to have been limited to the sensitivity study on only the internal events base PRA model. Non-SBO loss of cooling to the RCPs is seldom a significant contributor to internal event risk because multiple independent failures are usually needed. However, fire can potentially cause such multiple failures which can make a loss of RCP seal cooling a significant contributor in a Fire PRA. The RICT estimates in the sensitivity study reported in the LAR also assume that only the SSCs related to each LCO are not available. During operations, RICT estimates are based on the as-operated plant which could include other SSCs being unavailable. The unavailability of other SSCs can have a significant impact on the risk profile of the plant and, therefore the sensitivity of the results to the RCP abeyance seal model.

Therefore:

i. Clarify how the abeyance seal is currently credited in the PRA model-of-record and whether that credit will be retained in the Real Time Risk (RTR) model that will be used to calculate RICTs. If the credit for the abeyance seal will be used in the RTR model to calculate RICTs, provide the following additional information:

ii. Confirm that this sensitivity study reported in the LAR recalculated the reported RICTs after removing credit for the abeyance seal from both the internal event and the fire PRAs. If credit was not removed from the PRA, provide the sensitivity of the Abeyance seal to the estimated RICTs after removing its credit from both PRAs.

iii. Provide an evaluation of the impact of crediting the Abeyance seal on the RICTs for credible combinations of LCOs (i.e., when multiple SSCs are unavailable). If the credit for the Abeyance seal can have more than a negligible impact on credible RICT combinations (i.e., is a key source of uncertainty), explain how this key source of uncertainty will be evaluated and dispositioned in the RICT calculations. If this key source of uncertainty will not be evaluated and dispositioned consistent with guidance in NUREG-1855, justify the proposed disposition.

Page 8 of 83

L-PI-20-026 NSPM Enclosure NSPM Response to RAI 2.a The fire PRA model used in the CRM model will reflect the as-built, as-operated plant. All committed NFPA 805 modifications will be installed by the end of Q3 2020, which is prior to the requested approval of this application.

NSPM Response to RAI 2.b Not applicable - see response to RAI 2.a.

NSPM Response to RAI 2.c The High-High Containment Pressure signal input to the MSIV closure logic will not be included in the fire PRA model.

NSPM Response to RAI 2.d Implementation item 2 is not meant to apply to the fire PRA because there is no accident sequence in the fire PRA that would result in High-High Containment Pressure and require credit for automatic MSIV closure. Fire accident sequences can result in spurious or consequential opening of steam generator pressure operated relief valves (PORVs) or steam dumps, which may require MSIV closure to mitigate the event, but will not increase containment pressure because the releases are outside of the containment. Fire accident sequences can also cause spurious actuations of pressurizer PORVs or head vents or RCP seal failure that result in a loss of coolant accident (LOCA), all of which have the potential to increase containment pressure but do not require MSIV closure to mitigate the event. In both the described conditions the High-High Containment Pressure MSIV closure signal would not be applicable because it would not support mitigation of the event.

In a postulated case where both spurious operations (i.e. steam release and LOCA) occur simultaneously, credit for the high-high containment pressure signal for MSIV closure would not be appropriate because it would credit one spurious operation to allow the MSIV closure signal to be generated to mitigate the other spurious operation.

NSPM Response to RAI 2.e RAI 2.e.i The current PRA models of record credit the abeyance RCP seal. However, both the internal events and fire PRA models are being updated to support implementation of the RICT program. The update removes credit for the abeyance RCP seal from both the internal events and fire PRA models and the abeyance RCP seal will not be credited in the CRM model used for calculation of RICTs. However, the RCP abeyance seal may be credited at some point in the future and will be done so in a manner that is consistent with established processes for maintaining PRA models.

Page 9 of 83

L-PI-20-026 NSPM Enclosure RAI 2.e.ii The abeyance sensitivity study described in the LAR removed credit for the abeyance RCP seal from both the internal events and fire PRAs when calculating the updated sample RICT values.

RAI 2.e.iii This source of uncertainty will not be evaluated and dispositioned because credit for the abeyance RCP seal is being removed from both the internal events and fire PRA models as part of the updates to support the RICT Program. Therefore, this source of uncertainty is no longer applicable.

RAI 3 - Total Risk Estimates Against RG 1.174 Guidelines RG 1.174 provides the risk acceptance guidance for total core damage frequency (CDF) (1E-04 per year) and LERF (1E-05 per year). LAR, Enclosure 4, Table E5-1 shows that the total CDF for PINGP, Unit 1 is 8.22E-05 per year and for PINGP, Unit 2 is 8.16E-05 per year based on the baseline Model of Record (MOR) PRAs. NRC staff notes that implementation item No. 1 identified in LAR Attachment 5, Table A5-1 ensures that the fire PRA used for the RICT program reflects the as-built, as-operated plant. If an NFPA 805 plant modification or NFPA 805 implementation item has not yet been implemented, then credit for that plant modification or implementation item should be removed from the fire PRA prior to it being used in the RICT program in order to reflect the as-built, as-operated plant. If this PRA adjustment is required it could result in an increase in the total CDF and LERF for PINGP.

In addition, based on RG 1.174 and Section 6.4 of NUREG-1855, Revision 1, for a Capability Category II risk evaluation, the mean values of the risk metrics (total and incremental values) need to be compared against the risk acceptance guidelines. The mean values referred to are the means of the probability distributions that result from the propagation of the uncertainties on the PRA input parameters and model uncertainties explicitly reflected in the PRA models. In general, the point estimate CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state of knowledge correlation (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines). Enclosure 4 of the LAR shows that for PINGP, Units 1 and 2, the CDF values begin to approach the RG 1.174, Revision 3 guidelines for total CDF and LERF without considering the risk increase due to SOKC and the potential need to remove credit for an NFPA 805 plant modifications or implementation items that are not yet implemented. Therefore, an increase in CDF and LERF due to SOKC could possibly impact the conclusions of this application by increasing the PINGP total CDF and LERF values above the RG 1.174 risk acceptance guidelines.

Provide the estimated total CDF and LERF estimates for each hazard modelled with a PRA model that includes the contribution from the SOKC to confirm that the RG 1.174 risk Page 10 of 83

L-PI-20-026 NSPM Enclosure guidelines for total CDF and LERF (i.e., CDF < 1E-04 and LERF < 1E-05 per year) for using a RICT program are met.

NSPM Response to RAI 3 As described in Section 2.0 of Enclosure 2 of the LAR, the peer reviews conducted for both the internal events and fire PRAs demonstrated that these PRAs met the Capability Category II requirements of the ASME/ANS PRA Standard (Reference 4), concerning proper consideration of SOKC impacts on the point estimate results. In addition, a parametric uncertainty analysis has been performed for both internal events and fire PRA models of record which considers correlation of like events. This parametric uncertainty is documented in the associated quantification notebook for each model. The parametric uncertainty considers the impact of uncertainty on random equipment failures, HRA, special basic events, initiator frequency (including fire initiators), and circuit failure mode likelihood analysis (CFMLA).

The parametric uncertainty results show that the calculated mean CDF/LERF values are quite close to the point estimate values. This provides additional confidence that the sum of the risks from all hazards, including the seismic penalty factor, remains below the RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis Revision 2 (Reference 5), thresholds. Significant contributions to the SOKC, such as Interfacing System Loss of Coolant Accident (ISLOCA) check valves, already consider the effects of correlation for the second valve failure.

Table 3.1: PINGP Point Estimates Point Estimate Values Revision 5.3 Model of Record (MOR) Revision 5.3 MOR Internal Events Fire PRA Point Seismic Penalty Total Point Top Event Point Estimate Estimate Factor1 Estimate Unit 1 CDF 1.28E-05 6.64E-05 4.88E-07 7.97E-05 Unit 2 CDF 1.25E-05 6.61E-05 4.88E-07 7.91E-05 Unit 1 LERF 2.15E-07 9.64E-07 2.37E-07 1.42E-06 Unit 2 LERF 1.86E-07 9.27E-07 2.37E-07 1.35E-06 Note:

1. The seismic penalty factors shown are the updated values presented in the response to RAI 12.

Page 11 of 83

L-PI-20-026 NSPM Enclosure Table 3.2: PINGP Mean Values Mean Values Revision 5.3 MOR Internal Events Revision 5.3 MOR Seismic Penalty Top Event Mean Fire PRA Mean Factor1 Total Mean Unit 1 CDF 1.36E-05 6.65E-05 4.88E-07 8.06E-05 Unit 2 CDF 1.27E-05 6.63E-05 4.88E-07 7.95E-05 Unit 1 LERF 2.26E-07 9.66E-07 2.37E-07 1.43E-06 Unit 2 LERF 1.90E-07 9.28E-07 2.37E-07 1.36E-06 Note:

1. The seismic penalty factors shown are the updated values presented in the response to RAI 12.

RAI 4 - Evaluation of Common Cause for Planned Maintenance NEI 06-09, Revision 0-A, states that no common cause failure (CCF) adjustment is required for planned maintenance. The NRC SE related to NEI 06-09, Revision 0 Section 2.2, states that, specific methods and guidelines acceptable to the NRC staff are [] outlined in RG 1.177 for assessing risk-informed TS changes. The NRC SE, Section 3.2, further states that consistency with the guidance of RG 1.174, Revision 1, and RG 1.177, Revision 1, is achieved by evaluation using a comprehensive risk analysis, which assesses the configuration-specific risk by including contributions from human errors and common cause failures.

The guidance in RG 1.177, Revision 1, Section 2.3.3.1, states that, CCF modeling of components is not only dependent on the number of remaining in-service components but is also dependent on the reason components were removed from service (i.e. whether for preventative or corrective maintenance). In relation to CCF for preventive maintenance, the guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states:

If the component is down because it is being brought down for maintenance the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant.

The LAR does not discuss how CCFs are treated in the PRA models for planned maintenance.

Therefore, address the following:

Page 12 of 83

L-PI-20-026 NSPM Enclosure a) Explain how CCFs are included in the PRA model (e.g., with all combinations in the logic models as different basic events or with identification of multiple basic events in the cut sets);

b) Explain how the quantification and/or models will be changed when, for example, one train of a 3x100 percent train system is removed for preventative maintenance and describe how the treatment of CCF meets the guidance in RG 1.177, Revision 1, or meets the intent of this guidance when quantifying a RICT.

NSPM Response to RAI 4.a Common cause basic events are explicitly modeled in the PRA fault tree, with each specific combination of events modeled in addition to the independent failure basic events. The process is in compliance with RG 1.200. CCF event probabilities are calculated using the multiple Greek letter (MGL) method. The MGL modeling approach is described in NUREG/CR-5485 and NUREG/CR-6268. The data used to develop the CCF parameter values is periodically updated by the NRC through its research organization with the latest available information presented in NRC, CCF Parameter Estimations 2012, November 11, 2013.

NSPM Response to RAI 4.b The treatment of common cause failure (CCF) for TSTF-505 program will be in accordance with the approach described in NEI 06-09. For planned RICTs (e.g., to perform preventive maintenance tasks), no changes in CCF factors would be made in the configuration risk management (CRM) model.

RG 1.177, Revision 1, Section A-1.3.2.2, describes different processes for adjustment of the CCF events when a component is taken down for preventive maintenance than as described for failure of a component. For maintenance, RG 1.177 describes a process where the common cause factor group is changed to reduce the group size to eliminate the component that is out of service. In the example provided in RG 1.177 for a two-train system, the CCF event can be set to zero for PMs because the CCF group of 2 events becomes a group of 1 event (i.e. no CCF possible). This is done so that the model represents the unreliability of the remaining component only, and not the common cause multiplier. This process has the effect of reducing the number of potential CCF events in the model for the affected groups.

The NSPM approach retains the CCF events as-is when a component is taken OOS for maintenance. This approach results in a conservative RICT because the CCF event(s) are retained as-is instead of reducing the number of CCF combinations, and therefore the total CCF probability, for the affected CCF group in the model.

RAI 5 - Common Cause Modeling for Emergent Conditions According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified Page 13 of 83

L-PI-20-026 NSPM Enclosure to reflect the reduced number of available components in order to properly model the as-operated plant. Attachment 2 of the LAR provides the proposed changes to the TSs. Part (d) to TS 5.5.18, Programs and Manual, insert states:

For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Regarding option 1 cited above, provide the following:

a) Describe and justify how the numerical adjustment for increased possibility of CCF will be performed, or b) Confirm that numerically accounting for the increased possibility of CCF in the RICT calculation will be performed in accordance with RG 1.177, Revision 1.

NSPM Response to RAI 5.a See response to RAI 5.b.

NSPM Response to RAI 5.b It is anticipated that both options will be available during the implementation of an emergent RICT, however, if option 1 described above is used in lieu of the option to implement common cause RMAs for a technical specification equipment failure, the increased CCF probability for remaining in-service components in a common cause group will be calculated in accordance with RG 1.177, Revision 1. The probability for the existing CCF events for the common cause group will be re-calculated by dividing by the probability of the failed component. This has the effect of raising the probability of all of the affected CCF events to account for the failed parent event.

RAI 6 - Design Basis Success Criteria and RICT estimates TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493) does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE) in the RICT Program.

Page 14 of 83

L-PI-20-026 NSPM Enclosure Additionally, the guidance in Item 11 in Section 2.3 of TSTF-505, Revision 2, states that The traveler will not modify Required Actions for systems that do not affect core damage frequency (CDF) or large early release frequency (LERF) or for which a RICT cannot be quantitatively determined. LAR Enclosure 1, Table E1-1 appears to include several TS LCO Conditions that could represent TS loss of function because the Condition allows a configuration that does not meet the design basis success criteria indicated in Table E1-1. LAR Enclosure 1, Table E1-1 summarizes how the PRA success criteria differ from the design basis success criteria. In certain instances, it is unclear if the design basis success criteria can be satisfied in all the conditions for which a RICT is proposed. Therefore, address the following:

a. TS LCO 3.6.3.A and 3.6.3.C in Table E1-1 both include in the Comments column that,

[o]nly penetrations that can contribute to LERF are modeled. Will a RICT be applied to penetrations that do not contribute to LERF and, if so, how is the RICT calculated consistent with the guidance in TSTF-505, Revision 2?

b. TS LCO 3.7.1 in Table E1-1 indicates that the design basis success criterion is Five of five MSSVs per SG, and that the PRA success criterion is One of five MSSVs per SG when associated [SG] PORV and steam dump not available. Clarify why one MSSV inoperable is not a loss of TS specified safety function. If it is a loss of TS specified safety function clarify why a RICT can be applied to the condition.

c. TS LCO 3.6.5: Table E1-1 states for these LCO Condition C and Condition D that the LCO 3.6.5 Containment Spray (CS) and Cooling Systems function is not modeled in the PRA because it has been screened out based on hydraulic analysis. TS LCO 3.6.5.C and 3.6.5.D in Table E1-1 state that the containment cooling fan coil units are not modeled in the PRA. The additional discussion in section 2.6 states that, [a]dverse impacts caused by operation of the CS system are considered; such as increased Refueling Water Storage Tank (RWST) depletion rate during ECCS injection, potential for spurious operation and subsequent loss of RWST inventory after a fire initiating event, and potential failure of 4 kV bus load-rejection sequence if the CS breaker fails to open on demand. The two statements appear contradictory, one that adverse impacts are modeled while the other that nothing is modeled in the PRA. Therefore, address the following:

i. Clarify what is actually modeled in the PRA for these systems and which end states are affected by the modelled equipment (i.e., CDF, LERF, etc.).

ii. Summarize the minimum equipment needed to fulfill the design basis function(s) and confirm that a RICT is not applied to any loss of function condition.

iii. Explain how the change-in-risk will be calculated for a RICT when a CS train, containment fan coil units, or CS actuation channel is taken out of service, given that the CS function does not contribute to CDF or LERF. If no RICT calculation will be performed, then explain what RICT will be assumed for the cited LCO Conditions.

Page 15 of 83

L-PI-20-026 NSPM Enclosure iv. Describe the hydraulic analysis mentioned in Table E1-1 that is the basis used to justify that the CS and Cooling Systems success or failure have no impact which sequences contribute to LERF.

v. Justify that the results of the hydraulic analysis are applicable to the PINGP regardless of configurations that are allowed by the RICT program.

NSPM Response to RAI 6.a A RICT will be applied to non-modeled containment penetrations that are screened due to small size. Non-modeled containment penetrations that are screened due to their small size do not contribute to LERF because the release will be too small to be considered large. Mapping will be added to the CRM model to allow operators to enter the LCO and take affected equipment OOS, but there will be no change in risk specific to the screened penetrations themselves. The RICT will be calculated based on the delta-risk associated with the plant state during the period of time that LCO 3.6.3.A or 3.6.3.C is active. If no other equipment is OOS at the time, the delta-risk will be based on the CDF and LERF seismic penalty factors alone. If other equipment is OOS, delta-risk will increase and the RICT will decrease commensurate with the increase in risk.

A RICT will not be applied to any non-modeled penetrations that are large enough to result in a large early release when open but are screened due to being locked closed. These penetrations could have a non-zero impact on LERF but are not directly considered in the model, because they have been screened out. If these screened penetrations are added to the model in a future update, a RICT can then be applied and delta-risk would be calculated normally.

NSPM Response to RAI 6.b Five of five MSSVs per SG are required in a trip from full power with no other means of steam relief for a short period of time when decay heat load is highest. This success criterion has been confirmed and a single MSSV OOS would represent a loss of TS specified safety function during the period of highest decay heat load. Therefore, TS 3.7.1 has been removed from the requested scope of the RICT program and from the revised Table E1-1, Table E1-2, and TS markups in Attachments 1, 2, and 3, respectively, of this Enclosure.

NSPM Response to RAI 6.c RAI 6.c i The containment cooling function is not modeled in the PRA. Neither the Containment Spray (CS) pumps nor containment Fan Coil Units (FCU) are credited to provide any mitigating function for either CDF or LERF in either the internal events or fire PRA models.

The potential adverse consequences of operation of the CS pumps described in the LAR are included in the model for completeness. While the analysis described in RAI 6.c.iv shows that Page 16 of 83

L-PI-20-026 NSPM Enclosure the containment cooling function is not required to prevent core damage sequences from progressing to a large and early release, initial successful operation of the system could impact other credited PRA functions such as AC bus load reject/restore or containment isolation if subsequent failures occur. In addition, any successful operation of the system impacts the timing for transfer to recirculation so that decrease in timing is considered for conservatism where appropriate.

The potential decreased timing for transfer to recirculation and failure of AC bus load reject/restore caused by CS pump breaker failure to open impact CDF. Failure of the CS pump suction/discharge flowpath to isolate after successful pump trip has no impact on CDF, but can impact LERF by creating a release path from the CS header to the Auxiliary Building.

RAI 6.c.ii The design success criteria described in Table E1-1 of the LAR for LCO 3.6.5 is incorrect. The minimum equipment to fulfill the TS-specified safety function is as follows:

One of two CS trains and one of four FCUs.

Each CS train consists of a containment spray pump, spray headers, nozzles, valves, and piping.

The four available FCUs are split into two trains with two FCUs per train. Each individual FCU consists of a fan coil unit and associated ductwork. The FCUs are normally cooled by non-safeguards chilled water but are cooled by the cooling water system during accident operations and during normal winter operation.

RAI 6.c.iii Mapping will be added to the CRM model to allow operators to enter the LCO and take the equipment OOS. There will be no change in risk specific to the CS or FCU components or actuation circuitry. The RICT will be calculated based on the delta-risk associated with the plant state during the period of time that the applicable LCO is active. If no other equipment is OOS at the time, the delta-risk will be based on the CDF and LERF seismic penalty factor alone. If other equipment is OOS, delta-risk will increase and the RICT will decrease commensurate with the increase in risk.

RAI 6.c.iv The analysis initially screened each plant damage state from the level 1 analysis to determine which states cannot be impacted by success or failure of CS pumps or FCUs. Based on the initial screening, containment bypass events such as ISLOCA and SGTR were screened out.

Additionally, plant damage states involving SBO with no AC power recovery were screened out because no power would be available to operate CS pumps or FCUs.

Page 17 of 83

L-PI-20-026 NSPM Enclosure After the initial screening was performed, MAAP cases for the remaining LERF end-states were reviewed to determine cases to be re-run with and without containment cooling. The chosen cases were re-run in MAAP with and without credit for FCUs. If CS actuation was expected based on analysis results, the cases were also re-run with and without CS. Results of each original and sensitivity case were reviewed to determine if the LERF criteria were met.

In all cases, the original LERF end-state conclusion would not have changed due to operation of CS or FCUs.

The analysis also performed a review of non-LERF end states to determine if success or failure of CS or FCUs would have impacted the conclusion that the end state did not result in a LERF. This review was a combination of quantitative sensitivity studies and qualitative review of results. This review also concluded that the original non-LERF end state conclusion would not have changed.

RAI 6.c.v The analysis presented in RAI 6.c.iv was based on evaluation of each potential core damage state that could occur. Changes in plant configuration during operation do not change the potential accident sequences and classes evaluated in the PRA. These configuration changes only make certain core damage states more or less likely to occur. Equipment OOS may cause a core damage sequence to change from one plant damage state to another relative to the base case. Therefore, the analysis is applicable to all configurations allowed by the RICT program.

RAI 7 - PRA Model Uncertainty Analysis Results The NRC staff SE for NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

During the audit, NRC staff reviewed the uncertainty analyses which consisted of (1) analysis of internal events PRA assumptions and sources of uncertainty, (2) analysis of fire PRA assumptions and sources of uncertainty, and (3) evaluation of key assumptions and sources of PRA modeling uncertainty specifically for the RICT program. The evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program concluded that there were no sources of uncertainty that needed to be included in the RICT LAR. However, during NRC review, NRC staff noted a few identified sources of uncertainty that appear to have the potential to impact the RICT calculations. Therefore, address the following:

a) The PINGP, Units 1 and 2, analysis of internal events PRA assumptions and sources of uncertainty identifies the applicability of component type data and the applicability of Page 18 of 83

L-PI-20-026 NSPM Enclosure generic data as potential sources of modelling uncertainty. The analysis concludes that these are not really sources of uncertainty because the best available data sources were used. The primary source of generic failure rates, probabilities and distribution parameters used was NUREG-6928 (ADAMS Accession No. ML070650650), but secondary sources were also used including Utility Calculation Notes. Concerning the use of Utility Calculation Notes, it is not clear to NRC staff what information is contained in these calculation notes used to support the PRA models. NRC staff observes that the failure rates for non-typical equipment can be a source of uncertainty because it may require the use of surrogate data or engineering judgement. Therefore, address the following:

i. Explain what information is contained in the Utility Calculation Notes, and how it was used to support the development of component failure probabilities. Include explanation of whether this source of uncertainty is caused by non-typical equipment and whether engineering judgement was used to determine a failure probability for certain components. Also, include examples of how failure rates were determined for non-typical equipment not listed is NUREG/CR-6928.

ii. Justify your treatment of the potential sources of uncertainty cited above and explain or demonstrate why they have no impact on the RICT calculations.

iii. If in response to part (ii) above it cannot be justified that your treatment of these uncertainties has no impact on the RICT program, then explain how these uncertainties will be treated in the RICT program. Include discussion of any additional Risk Management Actions (RMAs) that would be implemented.

b) The PINGP, Units 1 and 2, analysis of fire PRA assumptions and sources of uncertainty indicates that components without cable routing are assumed failed unless further analysis was performed to assure systems are not compromised by the transient fire.

The analysis concludes that this assumption is not a source of uncertainty because it is industry practice. However, it is not clear to NRC staff how many or which components and systems are assumed to be failed in fire scenarios because of the lack of cable tracing. NRC staff notes that even though this modelling treatment produces a conservative estimation of fire CDF and LERF it can underestimate the change-in-risk determined in the RICT calculations by masking risk which results in the underestimation of associated completion times. In a RICT calculation, if an SSC is part of a system not credited in the fire PRA or it is supported by a system that is not credited, then the risk-increase due to taking that SSC out of service is masked. It is not clear to NRC staff that the cited assumption has no impact on the RICT program.

Therefore, address the following:

i. Identify the systems or components that are assumed to always be failed (or are not included) in the fire PRA due to lack of cable tracing.

ii. Justify that exclusion of credit for the SSCs identified in part (i) above have an inconsequential impact on the RICT calculations. Include discussion about whether Page 19 of 83

L-PI-20-026 NSPM Enclosure the risk associated with an SSC in the RICT program can be masked because the SCC (or a system that supports the SSC) is not credited (or not fully credited) in the fire PRA.

iii. As an alternative to part (ii), above, propose a mechanism to ensure that a sensitivity study is performed for the RICT calculations for applicable SSCs which accounts for the impact on the RICT of the non-conservative PRA treatment (i.e., that the SCC is failed or not included in the PRA model). The proposed mechanism should also ensure that any additional risk from correcting the false assumption that the SSC is always failed is either accounted for in the RICT calculation or is compensated for by applying additional RMAs during the RICT.

c) The PINGP, Units 1 and 2, evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program indicates that diversion flow paths were not modelled for the Residual Heat Removal (RHR) system. The analysis identified the following sources of flow diversion that were identified in the report were (1) failure of the RHR heat exchanger crosstie valves that diverts flow to the safety injection (SI) crossover and CS suction lines, (2) failure of the RHR heat exchanger crosstie valves that diverts flow to the letdown line, and (3) failure of the Component Cooling (CC) pumps that diverts flow back through the CC pump. The analysis determined the impact of these failures to be negligible because the failure of an RHR train is dominated by other train failures (by more than 2 orders of magnitude) and concluded that there is no impact from this source of uncertainty on the RICT calculations. NRC staff notes that the cited failures may have the potential to cause impacts on the plant besides RHR flow diversion and that there is a possibility that the cited failures can in the same accident scenario also contribute to the functional failure of other systems such as SI, CS, and the CC system. Also, NRC notes that modelling treatments that have only a small impact on overall CDF and LERF can potentially have a more significant impact for particular configurations allowed under the RICT program. In light of these observations, address the following:

i. Explain what impact the cited failures that create RHR diversion flow paths have on interfacing systems such as the SI, CS, and the CC system and whether those failures could contribute to the same accident scenario.

ii. Justify that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths will have no impact on calculated RICTs including RICTS associated with RHR, SI, CS, and the CC system. One way to justify this uncertainty is to perform a sensitivity showing that the impact of the calculated RICT is minimal for configurations allowed under the RICT program.

iii. If in the response to part (ii) above, it cannot be justified that the uncertainty associated with excluding the cited failures which create RHR diversion flow paths have no impact on the RICT program, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

Page 20 of 83

L-PI-20-026 NSPM Enclosure d) The PINGP, Units 1 and 2 evaluation of key assumptions and sources of PRA modeling uncertainty for the RICT program indicates that external vessel cooling is credited to prevent core melt from escaping the vessels based on realistic MAAP modelling. In this case, it is not clear to NRC staff what is meant by realistic MAAP modelling.

Provide a description of the MAAP modelling, assumptions, and results that justifies this credit. Alternatively, summarize the scenarios affected by this assumption and provide a sensitivity study showing that this source of uncertainty has no impact on the RICT calculations by removing credit for external vessel cooling to prevent core melt escaping the vessels.

NSPM Response to RAI 7.a RAI 7.a.i Utility Calculation Notes pertain to documentation in the PRA Data Notebook that provides the basis for failure and unavailability estimates for basic events that could not be mapped to NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants (Reference 6). These failure and unavailability estimates are based on plant specific data when NUREG/CR-6928 was not available or did not accurately reflect the PINGP operational strategies, or from other non-NUREG/CR-6928 sources. For each event, the PRA Data Notebook lists the data source (Utility Calculation Note or PRA Calculation) along with the point estimate and error factors used.

Examples of the Utility Calculation Notes or PRA Calculation Documents, including details on the data analysis development, are provided below:

The consequential LOOP and non-recovery probabilities from NUREG/CR-6890, Volume 1, Reevaluation of Station Blackout Risk at Nuclear Power Plants (Reference 7), NUREG-1784, Operating Experience Assessment - Effects of Grid Events on Nuclear Power Plant Performance (Reference 8), and EPRI Interim Technical Report (issued September 2009) (Reference 9).

Plant specific availability factors and conditional probability of the second unit online for dual unit initiators. The value was based on review of the PINGP Outage Log.

Water Treatment unavailability value was based on review of plant-specific Operator Logs.

Containment leakage greater than 100 La was based on EPRI TR-1018243, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A (Reference 10), and plant-specific Integrated Leak Rate Test results.

Probability of high debris condition on Plant Screenhouse (PSH) normal and safeguards traveling screens. The value was based on plant specific weather data and historical events.

Page 21 of 83

L-PI-20-026 NSPM Enclosure

The probability of Condensate Polishing being in-service was derived from interviews with the system engineer and review of past operation of the system following a refueling outage.

Maintenance and Personnel Airlock unavailability (not closed due to personnel egress) was based on estimates of normal containment entry events during at-power condition.

The probability of various combinations of letdown orifices in-service was based on review of plant-specific Operator Logs and the plant computer system.

The probability that the Condenser Makeup control valve is open due to low level in the condenser causing a potential Condensate Storage Tank (CST) flow diversion. The value was based on plant specific data and interview with operations.

The failure probability of the pressurizer heaters was based on plant-specific data from Maintenance Rule Database and Operator Logs.

Random IA and SA pipe breaks are calculated by conservatively applying water piping failure rates from NUREG/CR-6928 and using plant specific piping data.

The non-NUREG/CR-6928 data sources include other NUREGs or NRC documents, as well as EPRI reports and Owners Group documents and are presented in Table 7-1. The implementation of the component failure data from the non-NUREG/CR-6928 data sources follows the PRA data analysis processes per the ASME/ANS PRA Standard. The methodology developed by the Owners Group was followed as prescribed in the report with appropriate adjustments to account for PINGP specific design and characteristics.

Table 7-1: PINGP Component Failure Data Sources (Other than NUREG/CR-6928)

Reference Name Title Purpose in Model WCAP-16882-NP, PRA Modeling of Debris-Induced Failure Used for debris-induced loss of Revision 1 of Long Term Core Cooling via RHR Net Positive Suction Head Recirculation Sumps (NPSH) for sump plugging probabilities for various size LOCAs WCAP-16341-P, Simplified Level 2 Modeling Guidelines Used for Containment Event Tree Revision 0 WOG PROJECT: PA-RMSC-0088 Failure Probabilities/Level 2 Modeling WCAP-15831-P-A, WOG Risk-Informed Anticipated Used for ATWS Assessment for the Revision 2 Transient Without SCRAM (ATWS) interval values for primary Assessment and Licensing pressurize relief Implementation Process WCAP-16175-P-A, Model for Failure of RCP Seals Given Used for Flowserve three-stage Revision 0 Loss of Seal Cooling in CE NSSS Reactor Coolant Pump (RCP) seal Plants failure probabilities NRC SPAR Model NRC Standardized Plant Analysis Risk Used for probability of a Pressurizer Page 22 of 83

L-PI-20-026 NSPM Enclosure Table 7-1: PINGP Component Failure Data Sources (Other than NUREG/CR-6928)

Reference Name Title Purpose in Model (PINGP) (SPAR) models. PORV lifting following a transient event RSC Generic Ricky Summitt Consulting Generic Used for ATWS Mitigation System Component Failure Component Failure Rate Database, Actuating Circuitry/Diverse SCRAM Rate Database 1998 System (AMSAC/DSS) input logic card logic card failure probability INPO EPIX Database Institute of Nuclear Power Operations Used for Service Water (Cooling (INPO) - Equipment Performance and Water) Emergency Intake Line Information Exchange (EPIX) System plugging failure rate EGG-SSRE-8875 Idaho National Laboratory (INL) - Used for relay spuriously energizes Generic Component Failure Data Base failure rate For Light Water And. Liquid Sodium Reactor PRAs, February 1990.

WSRC-TR-93-262, Westinghouse Savannah River Used for Service Water (Cooling Revision 1 Company, Savannah River Site Generic Water) Traveling Screen Fails To Data Base Development (U), 1998 Run (FTR) and Fails To Start (FTS) failure rates (from Table 1e - Motor)

RAI 7.a.ii Per the ASME/ANS PRA Standard, if neither a plant-specific nor generic parameter is available, the use of expert judgment is acceptable if the rationale for choosing the parameter is documented. In addition, using other industry sources is also an acceptable approach.

For the Data Analysis, there are special events or basic events that are not associated with a generic or Bayes updated type code from NUREG-6928, but were derived from other industry sources. These include basic events associated with sump plugging, containment event tree failure probabilities, mechanical binding of the control rods, RCP seal failure rates, and ATWS assessment that are supported by generic industry references (e.g., WCAPs). Other NRC documents (i.e., SPAR model for PINGP) were used to determine other special events probabilities.

In addition, there were a few type codes that used other references (EPIX, INL, and Savannah River Site) to determine component failure rates since they were either not included in the NRC component failure data sheets used at the time of the PINGP data analysis update or the alternate reference was an appropriate substitute.

Given that appropriate alternative references (NUREGs, WCAPs, EPRI, EPIX, INEL and other NRC documents) were used for the basic events instead of NUREG/CR-6928, this approach does not create an additional source of uncertainty for the PRA. The approach used is consistent with typical PRA industry practices.

Page 23 of 83

L-PI-20-026 NSPM Enclosure A review of the current NUREG/CR-6928 NRC Component Failure Database (2015) was performed to determine if any of the component failure modes listed in Table 7-2 are included.

The NRC Database does not include data for relay spurious energizing and plugging of the CW emergency intake line failure events. Therefore, the data sources associated with these failure modes (EGG-SSRE-8875 and INPO EPIX Database, respectively) are appropriate substitutes.

The NRC Database does include data for the traveling screen fail to run and fail to start. The traveling screen failure rates used in the PINGP model are higher than those in the NRC Database. Therefore, the RICT calculations will be conservative using the data from WSRCTR-93-262 for these failure modes. In addition, the failure probability of the AMSAC/DSS input logic card could use a failure event from the NUREG/CR-6928 (2015 Component Failure Data) that has a higher probability. This will be assessed as part of the sensitivity study described below.

There were other special events basic events that were derived by PRA Calculation documentation or Utility Calculation Notes. As discussed in RAI 7.i, several of these calculations used plant specific data to determine unavailability or failure probabilities for various plant systems.

A sensitivity case was performed for several of the special events (that were based on plant specific data) documented in Utility Calculation Notes or PRA Calculation Documents. The special events probabilities were increased by a factor of three (3) for the sensitivity study to account for the uncertainty related to plant-specific data in order to determine the impact on the RICT calculations.

Special events associated with system alignments or plant availability factors (related to online availability factor and conditional probability of the second unit online for dual unit initiators) that are not expected to change significantly over the continued operation of the plant were not included in this sensitivity case. As mentioned above, one component failure from Table 7-2 (failure probability of the AMSAC/DSS input logic card) was included in the sensitivity case since the failure rate from NUREG/CR-6928 (2015 Component Failure Data) is available and has a higher failure rate. The special events that were included in the sensitivity case are listed in Table 7-2 along with the adjustment factor or revised failure probability.

Table 7-2: RICT Calculation Sensitivity Adjustment for Data Uncertainty Special Event Adjustment Factor or Probability Used Water Treatment Unavailability 3 Probability of High Debris Condition on PSH Normal and 3 Safeguard Traveling Screens Probability of Containment Leakage Greater than 100 La 3 Probability of Condensate Polishing In-service 3 Probability of Maintenance and Personnel Airlock Not 3 Closed Due to Personnel Egress Page 24 of 83

L-PI-20-026 NSPM Enclosure Table 7-2: RICT Calculation Sensitivity Adjustment for Data Uncertainty Special Event Adjustment Factor or Probability Used Probability of Condenser Makeup Control Valve Open 3 Failure Probability of Pressurizer Heaters 3 Failure Probability a AMSAC/DSS Input Logic Card 1.70E-03/demand (NUREG/CR-6928 (2015), ACT-FC)

The sensitivity study re-calculated the sample RICT values for all OOS equipment cases while applying the increased event probabilities listed in Table 7-2. The results showed that the impact on calculated RICT cases was small. The majority of the RICT cases were the same duration in days. A few RICT cases (five) changed by 1 day. Two of the changes were associated with RICT cases that had RICT values greater than or equal to 25 days (TS 3.4.11.B - Unit 1 and TS 3.7.8.A - Unit 1), resulting in a maximum decrease on the order of ~4%.

The other three RICT cases were associated with shorter time periods. Two RICT cases changed by just over 8% (TS.3.7.5.A - Unit 2 and TS.3.7.5.B - Unit 2) with corresponding RICT changes of 1 day each. The other RICT case LCO action statement changed by just over 11% (TS.3.7.8.B - Unit 2) with corresponding RICT change of 1 day. The decrease in these three RICTs is driven by the basic events in Table 7-2 that had their probabilities increased by a factor of three. This is a conservative assumption. The estimates associated with these events are based on plant specific data and it is not expected that the inaccuracy of the calculated failure probability would be as high as a factor of three. Any actual deviation of the plant-specific data from the current estimates would result in a smaller change in RICT values.

This sensitivity study shows that the data uncertainty for specific failure rates in the PRA model are not key sources of uncertainty with respect to RICT calculations.

RAI 7.a.iii As stated above in the response to RAI 7.a.ii, the sensitivity study shows that the data uncertainty for specific failure rates in the PRA model are not key sources of uncertainty with respect to RICT calculations. Therefore, no additional RMAs are needed.

NSPM Response to RAI 7.b The SSCs assumed to be failed in the fire PRA are as follows:

Main Feedwater (MFW): All fires are assumed to be loss of feedwater transients in the current model of record and the model used for sample RICT calculations. During model assembly the fire initiators are inserted into the PRA model and associated with the internal events loss of feedwater initiator. Use of this initiator causes MFW to be failed and conservative timing for steam generator depletion to be used in the model.

Page 25 of 83

L-PI-20-026 NSPM Enclosure

Station and Instrument Air: Cable selection for the components in this system has been performed and is included in the model. However, the system is assumed failed by default due to concerns over high fire temperatures melting the solder joints in the air distribution headers. The system is credited for scenarios only after a review is performed to show that high fire temperatures will not impact the air distribution headers.

AC panels 3133, 3143, 4133, and 4143: These non-safety related panels are located in the service building. Their only function in the PRA model is to provide power to the AMSAC system. They are assumed failed due to lack of cable tracing.

AC Buses 11, 12, 21, and 22: These AC buses support MFW and RCP operation and are assumed failed due to lack of cable tracing. As described previously, the MFW system is assumed failed based on the use of the loss of feedwater initiating event to map fire initiators to the PRA model. Continued RCP operation supports normal pressurizer spray in the PRA model.

Old Screenhouse Well Pump: This pump provides the normal non-safeguards bearing water supply to the 22 diesel-driven cooling water pump (DDCLP), the CW pumps, and the 11 & 21 CL Pumps. This pump is assumed failed due to lack of cable tracing. All of the pumps in question have the capability to utilize the CL system for bearing water injection. The PRA model considers this backup bearing water source so the assumed failure of the well pump is not a significant contributor to risk.

Part of the PRA model development process per the ASME/ANS PRA Standard is to review the results. The PRA standard requires review of significant and non-significant accident sequences / cutsets and identification of significant contributors to CDF. This process is also followed when developing the fire PRA. Any significant drivers to risk are investigated to determine if significant conservatisms exist that adversely impact the results. These reviews have shown that these SSCs have not had a significant impact on the total CDF/LERF results.

The SSCs in question are not associated with LCOs in-scope for the RICT program and assuming their failure will not have a significant impact on results for in-scope LCOs.

An additional sensitivity study was performed to quantify the impact of the IA system assumed failure. This sensitivity study removed the assumed failure of the system for the fire PRA and re-quantified the average maintenance model. Random failure of IA system components were allowed but no fire related failure mapping was included. Therefore, the results of the sensitivity represent the upper bound on the potential decrease in CDF and LERF to be expected if the IA system was fully credited in the fire PRA. Results showed that CDF and LERF decreased by less than 1% if the IA system was credited. This small total risk change shows that impact on the RICT calculations would be negligible.

Page 26 of 83

L-PI-20-026 NSPM Enclosure NSPM Response to RAI 7.c Each of the three potential diversion pathways is discussed separately below.

1. Failure of the RHR Exchanger Cross-tie Valves that Divert Flow to the SI Crossover and CS Suction Lines RHR Heat Exchanger Cross-tie Valves Flow Diversion to SI Suction Lines:

Refer to Figure 7-1 for the SI diversion path discussion and Figures 7-2 and 7-3 for the CS diversion path discussions. These drawings represent Unit 1; however, the arrangement for Unit 2 is similar. For SI, the pathway involves spurious transfer open of a MOV (one per RHR Heat Exchanger) of a normally closed valve that has its power removed. The probability of one MOV transferring open (less than 1E-06 over a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period) is more than two orders of magnitude lower than the dominant contributors to failure in each RHR train. Therefore, it is appropriate to exclude the flow diversion from the RHR model.

In addition, in the event an MOV was to transfer open when the RHR system was in service for injection, recirculation or Shutdown Cooling Mode (SDC) mode; the water will still be injected into the RCS through the SI lines via the cold leg. Transferring open of the SI Pump Crossover Piping will not result in unavailability of the SI Pump since the line supplies suction to the SI pumps.

Figure 7-1: RHR Diversion to SI (Unit 1 Shown)

Loop A M Orifice SI-9-2 SI-16-5 11 LOOP A ~ I RWST COLD LEG MV-32070 I SI-15-6 SI-4-1

~:

M M SI-13-1 LOOP B COLD LEG SI-9-1 SI-16-4 SI-15-7 MV-32073 SI-10-1 MV-32162 SI-1-1 M Loop B Orifice SI PUMP 11 M MV-32068 SI-14-1 MV-32079 SI-14-2 SI-16-3 SI-15-5 SI-4-2 M MV-32163 M

TO REACTOR VESSEL INJECTION MV-32080 MV-32074 SI-13-2 SI-10-2 TO RHR SI PUMP 12 M PUMP SUCTION SI-16-1 SI-16-2 1/8" ORIFICE SI-21-1 SI-15-3 SI-15-4 M M TEST LINE RETURN SI-20-16 MV-32203 MV-32202 Legend RHR Injection Flow Path MV-32206 MV-32207 (N.C., Breaker Open)

M M (N.C., Breaker Open)

RHR/SI Sump Recirculation Suction Flow Path Transfers OPEN Transfers OPEN FROM RHR HEAT EXCHANGER Page 27 of 83

L-PI-20-026 NSPM Enclosure RHR Heat Exchanger Cross-tie Valves Flow Diversion to CS Suction Lines:

For CS, there are two potential diversion pathways in this system. The first is potential diversion of RHR flow to the CS spray header if the CS system is also running in RWST injection mode during an event. Figure 7-2 illustrates the potential pathway. The RHR heat exchanger cross-connect valves (MV-32096 and MV-32097) are normally-closed MOVs with power removed. If one of these valves transferred open, a portion of the RHR flow would be directed to the suction of the operating CS pump, therefore directing that flow through the spray header. The failure probability for a closed MOV to transfer open is less than 1E-06 over a 24-hour period. This probability is more than 2 orders of magnitude less than other causes for failure of each RHR train (e.g., RHR pump failures). In addition, plant operators could close the affected CS pump discharge MOV (MV-32103 or MV-32105) to terminate the flow diversion. Lastly, if the CS system is not running, the CS pump discharge MOVs would already be closed, making this diversion pathway extremely unlikely. Note also that potential flow diversion of RHR flow from the CS pump discharges through each pumps recirculation lines (through normally blocked and tagged closed valves CS-11, CS-12, CS-24-1, and CS-24-2) can be excluded. The failure probability for a closed manual valve to transfer open is ~2E-06 over a 24-hour period, making this flow diversion pathway unlikely compared to failure of each RHR/CS Train. The impact of these RHR diversions on CS operation would be negligible since any diverted RHR water would be supplied to the CS spray header.

Page 28 of 83

L-PI-20-026 NSPM Enclosure Figure 7-2: RHR Diversion Through CS Spray Header (Unit 1 Shown)

CS 10 CS 9 CS-18 CS-19 UNIT 1 REACTOR BUILDING MV-32103 MV-32105 (Normally Closed)

CS-11 (Normally Closed)

Transfers OPEN CS-12 Transfers OPEN M M OR OR Fails to CLOSE Fails to CLOSE

11 #12 CS-24-2 CS-24-1 CONTAINMENT CONTAINMENT SPRAY PUMP SPRAY PUMP From M M From RHR HEAT RHR HEAT CAUSTIC EXHANGER ADDITION EXHANGER 11 PIPELINE 12 MV-32096 MV-32097 (N.C., Breaker Open)

(N.C., Breaker Open)

Transfers OPEN CS-16 CS-17 Transfers OPEN MV-32098 MV-32099 M M (N.O., Breaker Open) (N.O., Breaker Open)

VC-1-1 To Unit 1 Charging VC-2-2 CS-15 M Pumps

11 REFUELING WATER STORAGE TANK MV-32060 The second type of diversion would be backflow from the RHR cross-tie valves back to the RWST via the CS suction check valves (CS-16 and CS-17). These diversion paths are illustrated in Figure 7-3. If the CS system is running in RWST injection mode, these check valves would be open to provide flow to the CS pumps. If either MV-32096 or MV-32097 transferred open (a <1E-06 probability as noted above) and the check valves failed to re-close

(~2E-4/demand), then some portion of the RHR flow through the failed MOV could be diverted to the RWST. If the CS system is not operating, then check valves would already be closed, and the probability of them failing to remain closed is even lower (~2E-7 over 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

There also exists a potential diversion of RHR flow from the CS pump suction piping through the Caustic Addition injection line. The CA system includes a check valve (e.g., CA-11-1) at Page 29 of 83

L-PI-20-026 NSPM Enclosure the discharge of the Caustic Addition Standpipe. If the CS system is running in RWST injection mode, this check valve would be open to provide flow to the CS pumps. If either MV-32096 or MV-32097 transferred open (a <1E-06 probability as noted above) and the check valve failed to re-close (~2E-4/demand), then some portion of the RHR flow through the failed MOV could be diverted to the Caustic Addition Standpipe and the Surge Tank. If the CS system is not operating, then the check valve would already be closed, and the probability of it failing to remain closed is even lower (~2E-7 over 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

Operation of the CS System in the Recirculation Mode is not directed in the plant Emergency Operating Procedures (EOPs) and this mode of operation does not need to be analyzed for RHR flow diversion. CS recirculation mode is a general option in the SAMG document but this is not applicable to PRA success criteria or LERF accident sequences. In recirculation mode, the RWST supply MOVs would already be closed; therefore the potential for RWST diversion is even less likely than during injection mode.

Based on the above discussion, non-modeling of these RHR diversion failure modes is justified on the basis of low probability of occurrence of each pathway. The potential for inter-system impacts as a result of each diversion pathway is also negligible.

Page 30 of 83

L-PI-20-026 NSPM Enclosure Figure 7-3: RHR Diversion Through CS RWST Supply Lines (Unit 1 Shown)

Legend:

Condition #1: CS operating in Injection Mode taking suction from RWST. (MV-32098, MV-LS. zszszs 4 1 32099, CS-16 and CS-17 are OPEN) and (MV-X LS.ZSZSZS 4 32096 and MV-32097 are

¥ CLOSED) z CS 10 CS 9 z

Condition #2: CS Not in service. (MV-32103, MV-32105, MV-32096 and CS-18 CS-19 MV-32097, CS-16 and UNIT 1 CS-17 are CLOSED)

REACTOR BUILDING MV-32103 MV-32105 CS-11 M M (OPEN-Cond #1) CS-12 (OPEN-Cond #1)

(CLOSED-Cond #2)

11 #12 CS-24-2 CS-24-1 CONTAINMENT CONTAINMENT SPRAY PUMP SPRAY PUMP From M M From RHR HEAT RHR HEAT CAUSTIC EXHANGER ADDITION EXHANGER 11 MV-32096 PIPELINE MV-32097 12 (N.C., Breaker Open) (N.C., Breaker Open)

Transfers OPEN CS-16 CS-17 Transfers Open (Cond #1 and #2)

Fails to CLOSE - Cond #1 (Cond #1 and #2)

Catastrophic Failure (Cond #1 and #2)

MV-32098 M M MV-32099 (N.O., Breaker Open) (N.O., Breaker Open)

VC-1-1

. To Unit 1 Charging CS-15 VC-2-2 M Pumps

11 REFUELING WATER STORAGE TANK MV-32060

2. Failure of the RHR Heat Exchanger Cross-tie Valves that Diverts Flow to the Letdown Line The description of this diversion path was stated incorrectly in the sources of uncertainty evaluation for RICT impacts. Figure 7-4 illustrates the diversion path for Unit 1 (Unit 2 is similar). The screened diversion path is a 2 line located inside containment that is used to support purification of the RCS during shutdown conditions and allows letdown flow during plant heatup. It is connected to the 6 Loop B RCS low pressure injection line.

Flow diversion through the valve isolating this line from Chemical Volume Control System (CVCS) (MV-32234) is screened out due to low probability. The MOV is normally closed and must fail to remain closed (~8E-07 over a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period). This failure probability is more than Page 31 of 83

L-PI-20-026 NSPM Enclosure two orders of magnitude less than other failures for the RHR flowpath (e.g., failure of RHR pump 12). Under accident conditions (i.e., when Containment Isolation (CI) and Safety Injection (SI) signals are present), the letdown containment isolation valve would close on the CI signal, providing isolation of this diversion pathway. Failure to close of the containment isolation valve further reduces the probability of this pathway occurring to a negligible value.

Therefore, this flow diversion path is appropriately screened from the model. There would be no intersystem impacts of concern (i.e., RHR impacts on CVCS or vice versa).

Figure 7-4: RHR Flow Diagram (Unit 1 Shown)

SI(A) SI(B)

Legend MV-32206 MV-32207 11 RWST (N.C., Breaker Open)

RHR Injection Flow Path (N.C., Breaker Open) M M Transfers OPEN Transfers OPEN RHR Shutdown Cooling Flow Path M M M M RHR/SI Sump Recirculation Flow Path CS(A) CS(B) SUMP B MV-32096 MV-32097 MV-32075 MV-32077 SI-1-1 (N.C., Breaker Open) (N.C., Breaker Open)

Transfers OPEN Transfers OPEN From SI RHR Minimum Flow Recirculation Line M Pumps RH-5-1 M RHR HX11 Reactor RH-1-4 RH-2-2 SI-7-1 MV-32084 Vessel Nozzle A SI-9-6 SI-9-4 MV-32064 RH-10-2 CV-31235 RH-3-4 From SI Pumps M RHR RH-1-2 Reactor RH-2-6 RH-2-4 PUMP 11 Vessel Nozzle B RH-3-2 SI-9-5 SI-9-3 MV-32065 M

Letdown CV-31237 Line RH-3-1 (CVCS) CV-31339 MV-32234 Fails to CLOSE Transfers OPEN RH-2-5 RH-2-3 From RHR ACCUM B M PUMP 12 RH-1-1 RCS Cold Leg B SI-6-2 MV-32066 RH-10-1 CV-31236 RH-1-3 RH-2-1 RH-3-3 RHR HX12 M RCS PZR PT-420 RHR Minimum Flow Recirculation Line SI-7-2 MV-32085 RH-5-2 M M M M RCS Hot Leg A SUMP B MV-32164 MV-32165 MV-32076 MV-32078 M M RH-8-1 RCS Hot Leg B MV-32230 MV-32231

3. CC Diversion through a Non-operating CC Pump Figure 7-5 illustrates the relevant portions of the Unit 1 CC system (Unit 2 is similar). The diversion of concern is possible flow through a failed CC system pump in an event in which a Safety Injection (SI) signal is not actuated. Diversion in this case would be via the open safeguards isolation valves (MV-32120 and MV-32121) if one of the CC pumps stopped running and the discharge check valve for that pump (CC-3-1 or CC-3-2) failed to close. Any significant diversion would be indicated to the plant operators by multiple parameters and could be terminated by closing MV-32120 or MV-32121. However, operator action is not considered in this evaluation.

It should be noted that flow diversion is modeled directly for initiating events that actuate an SI signal due to the increased loads on the system caused by the RHR heat exchangers. The CC Page 32 of 83

L-PI-20-026 NSPM Enclosure flow diversion modeling includes the Unit 1 CC header isolation valves Fail to Close (MV32120 and MV-32121) as well as operator response.

In the event of such a flow diversion, the diversion path would be through the CCW surge tank lines (through MV-32200 and MV-32201) to the suction of the operating CC pump. In order for this CC flow diversion to occur, a failure of one CC pump to run (~1E-4 over a 24-hour period) and failure of its check valve to close (~2E-4/demand)) must occur resulting in a failure probability of ~2E-08. Given the low probability of occurrence of this failure is more than 2 orders of magnitude lower than the dominant failure mode for a train of CC, it is appropriate to screen this flow diversion. As CC is a closed system, there would be no intersystem impacts (beyond the negligible decrease in CC flow to cooling loads supported by the CC system).

Figure 7-5: Simplified CC System Flow Diagram (Unit 1 shown)

To Spent Fuel Pit Heat To Steam Generator Cooling Water Exchanger Blowdown Sample Component Component Cooling CC 1-8 Cooling Surge Heat Exchanger 12 MV-32121 M CC-1-6 To Non Tank 11 Safeguards CC-1-5 Cooling Water Loads MV-32120 M CC-1-4 CC 1-7 MV-32267 M ECCS Loads - Train B CC-19-1 CC-1-3 Component Cooling Heat Exchanger 11 CS Pump Cooler Safety Injection Pump Heat CC-30-11 CC-30-12 CC-61-1 Exchanger ECCS Loads - Train A MV-32266 CC-3-2 CC-3-1 M

RHR Pump CS Pump Cooler Residual Heat Removal Pump Component Component Safety Injection Pump Heat Heat Exchanger Cooling Cooling Exchanger Pump 11 CC-61-2 Pump 12 Residual Heat Exchanger RHR Pump Residual Heat Removal Pump CC-1-2 CC-1-1 Heat Exchanger M

Residual Heat Exchanger M

MV-32201 MV-32200 MV-32089 M M MV-32091 CC-1-12 CC-1-11 CC-5-1 CC-3-3 CC-18-2 CC-18-1 CC-1-9 From:

Non Safeguards Loads CC-14-5 CC-29-2 SG Blowdown Sample Reactor Coolant SFP Heat Exchanger Pump Seal 11 CC-1-10 CC-14-6 CC-29-1 Reactor Coolant CC-3-4 Pump Seal 12 CC-5-2 NSPM Response to RAI 7.d A steady state heat transfer calculation was performed to demonstrate that the heat transfer through the vessel wall was shown equal to more than one quarter of the decay heat at two hours, as discussed in the LERF notebook (Reference 11). The notebook also documents best-estimate MAAP analyses that were performed to validate that core debris would be cooled if the RWST contents were discharged into containment. As was assumed in the individual plant examination (Reference 16), a 0.1 vessel failure probability was conservatively Page 33 of 83

L-PI-20-026 NSPM Enclosure assumed in the LERF notebook given that the lower portion of the reactor vessel was adequately submerged.

Typically, PWR LERF is dominated by containment bypass scenarios such as ISLOCA and SGTR. A review of the LERF results in the internal events quantification notebook (Reference 12) confirms that is the case. The dominant accident classes (comprising over 99%

of the LERF results) either do not assume that ex-vessel cooling is possible or assume that such cooling has failed. Table 7-1 below shows the Unit 1 results (Unit 2 has the identical sequences, but the LERF contribution varies slightly in some cases).

Table 7-1: PINGP Unit 1 Sequences Sequence Frequency % of Total LERF Sequence Description (Reference 11) 1NOSBOCET-018 9.24E-08 43.0% Non-SBO event with containment isolation failure; ex-vessel cooling not credited 1NOSBOCET-019 6.48E-08 30.2% Non-SBO event with containment bypass; ex-vessel cooling not credited 1SBOCET-014 3.37E-08 15.7% SBO event with containment bypass; ex-vessel cooling not credited 1NOSBOCET-010 1.51E-08 7.0% Non-SBO event with Thermally-induced SGTR; ex-vessel cooling not credited 1SBOCET-013 6.06E-09 2.8% SBO event with containment isolation failure; ex-vessel cooling not credited 1NOSBOCET-017 2.56E-09 1.2% Non-SBO event with low RCS pressure; ex-vessel cooling is credited, but does not arrest core melt 1NOSBOCET-014 3.03E-10 0.1% Non-SBO event with pressure-induced SGTR; ex-vessel cooling not credited 1SBOCET-007 4.95E-11 0.02% SBO event with thermally-induced SGTR; ex-vessel cooling not credited These results demonstrate that credit for ex-vessel cooling has a small impact on LERF for PINGP. As such, this phenomenon will not impact the LERF portions of the RICT calculations.

RAI 8 - TSTF 505 - Modelling of Instrumentation and Controls NEI 06-09 state, concerning the quality of the PRA model, that RG 1.174, Revision 1, and RG 1.200, Revision 1 define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

Based on documentation in the LAR, it is not clear to the NRC staff whether instrumentation and control (I&C) is always modeled in sufficient detail to support implementation of TSTF-505, Revision 2. The following additional information is requested:

Page 34 of 83

L-PI-20-026 NSPM Enclosure

a. Explain how I&C is modeled in the PRA. Include (1) the scope of the I&C equipment that is explicitly included (e.g., bistables, relays, sensors, integrated circuit cards), (2) description of the level of detail that is modeled (e.g., are all channels of an actuation circuit modeled?), (3) discussion of what data and whether plant specific data is used, and (4) discussion of the associated TS functions for which a RICT could be applied.

b. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation and that sensitivity studies should be used to develop appropriate compensatory RMAs.

Regarding digital I&C, NRC staff notes the lack of consensus industry guidance for modeling these systems in plant PRAs to be used to support risk-informed applications.

In addition, known modeling challenges exist such as the lack of industry data for digital I&C components, the difference between digital and analog failure modes, and the complexities associated with modeling software failures including common cause software failures. Given these needs and challenges, if the modeling of digital I&C system is included in the RTR model, then address the following:

i. Provide the results of a sensitivity study on the SSCs in the RICT program demonstrating that the uncertainty associated with modeling digital I&C systems have inconsequential impact on the RICT calculations.

ii. Alternatively, identify which LCOs are determined to be impacted by the digital I&C system modeling for which RMAs will be applied during a RICT. Explain and justify the criteria used to determine what level of impact to the RICT calculation require additional RMAs.

NSPM Response to RAI 8.a Each circuit is designed as a current loop. With the exception of CS initiation which must energize to trip, loss of power to the current loop causes bistables in the loop to go to their tripped position. Each instrument loop modeled in the PRA includes the transmitter and multiple bistables (depending on functions/setpoints). Each bistable feeds train-specific relays that make up the logic (i.e. 1/2, 2/3, or 2/4) that actuates the signal in question. The logic relays actuate one or more master relays, which subsequently actuate one or more slave relays that actuate the components in question.

For each modeled I&C function, all channels are modeled in the PRA.

Page 35 of 83

L-PI-20-026 NSPM Enclosure NUREG/CR-6928 is used for the generic data. For some risk-significant components, plant-specific data has been used to perform Bayesian update.

TS functions for which a RICT could be applied are described in the revised Table E1-1 in of this Enclosure.

NSPM Response to RAI 8.b RAI 8.b.i PINGP is designed with an analog protection and analog reactor trip system. Digital equipment installed at PINGP includes the feedwater control system for power operation, AMSAC/DSS, and the safeguards bus load sequencers.

For the feedwater control system, the safeguards (feedwater isolation, steam generator water level reactor trip) functions remain analog and are not impacted by the digital components. The digital components related to feedwater are not controlled by TS LCOs and therefore no sensitivity study will be performed because the TS related equipment remains analog.

The AMSAC/DSS system does not include any SSCs governed by the RICT Program.

Therefore, no sensitivity study has been performed for the AMSAC/DSS system.

The safeguards bus load sequencers are each based on a programmable logic controller (PLC). Each load sequencer is modeled as a single basic event for each bus. Common cause is modeled between groups of 2, 3, and 4 load sequencers. A sensitivity study was performed where the load sequencer individual and CCF events were increased by a factor of three to account for the potential for uncertainty related to digital equipment failure rates and the increased potential for common cause failures. This sensitivity study re-calculated the RICT values for all OOS equipment cases while applying the increased event probabilities. The results showed that the impact on RICTs for the OOS equipment cases was small. RICTs for most cases were the same duration in days. RICTs for a few cases changed by 1 day. All RICT changes were <4%, except for cases for two LCO action statements that changed by just over 10% (TS 3.7.7.A and TS 3.7.8.b) with corresponding RICT changes of 0.6 days each.

This sensitivity shows that the bus load sequencer individual and common cause failure rates are not key sources of uncertainty with respect to RICT calculations.

RAI 8.b.ii Not applicable - see response to RAI 8.b.i.

RAI 9 - Credit for FLEX Equipment and Actions The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of challenges to incorporating FLEX equipment and Page 36 of 83

L-PI-20-026 NSPM Enclosure strategies into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2.

With regards to equipment failure probability, in the May 30, 2017 memo, the NRC staff concludes (Conclusion 8):

The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA Standard as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.

With regards to human reliability analysis (HRA), NEI 16-06 Section 7.5 recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as: debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses; and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. In the May 30, 2017 memo, the NRC staff concludes (Conclusion 11):

Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, [Human Error Probabilities] HEPs associated with actions for which the existing approaches are not explicitly applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

With regard to uncertainty, Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties should be considered in application of the PRA base model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions.

Uncertainty exists in PRA modeling of FLEX, related to the equipment failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities. Therefore, FLEX modeling assumptions could be key assumptions and sources of uncertainty for RICTs proposed in this application.

The LAR does not address whether FLEX equipment or actions have been credited in the PRA models. The NRC staff notes that the LAR Enclosure 4, Section 3.2 refers to post-Fukushima FLEX mitigating strategies now in place., but provides no additional information about if, and how, FLEX equipment is modeled in the PRA. To understand the credit that will be taken for FLEX equipment and actions in the RICT Program, address the following separately for the internal events PRA, internal flooding PRA, and fire PRA:

Page 37 of 83

L-PI-20-026 NSPM Enclosure a) Discuss whether NSPM has credited FLEX equipment or mitigating actions in the PINGP internal events, including internal flooding, or fire PRA models.

If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested, and the remainder of this question is not applicable.

b) Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

c) Regarding the credited equipment:

i. Discuss whether the credited equipment (regardless of whether it is portable or permanently-installed) are like other plant equipment (i.e. SSCs with sufficient plant specific or generic industry data).

If all credited FLEX equipment is similar to other plant equipment credited in the PRA (i.e. SSCs with sufficient plant-specific or generic industry data), responses to items ii and iii below are not necessary.

ii. Discuss the data and failure probabilities used to support the modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

iii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact on RICT due to FLEX equipment data and failure probabilities. Part of the response include the following:

1. Justify values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Describe how the results of the sensitivity studies will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

d) Regarding HRA, address the following:

i. Discuss whether any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06.

Page 38 of 83

L-PI-20-026 NSPM Enclosure If any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and Sections 7.5.5 of NEI 16-06, answer either item ii or iii below:

ii. Perform, justify and provide results of LCO specific sensitivity studies that assess impact from the FLEX independent and dependent HEPs associated with deploying and staging FLEX portable equipment on the RICTs proposed in this application.

Part of the response include the following:

1. Justify independent and joint HEP values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results;

3. Discuss composite sensitivity studies of the RICT results to the operator action HEPs and the equipment reliability uncertainty sensitivity study provided in response to RAI APLA 13.c.iii.

4. Describe how the source of uncertainty due to the uncertainty in FLEX operator actions HEPs will be addressed in the RICT program. Describe specific RMAs being proposed, and how t these RMAs are expected to reduce the risk associated with this source of uncertainty.

iii. Alternatively, to item d.ii) above, provide information associated with the following items listed in supporting requirements (SR) HR-G3 and HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard to support detailed NRC review:

1. the level and frequency of training that the operators and/or non-operators receive for deployment of the FLEX equipment (performance shaping factor (a)),

2. performance shaping factor (f), regarding estimates of time available and time required to execute the response,

3. performance shaping factor (g) regarding complexity of detection, diagnosis and decision making and executing the required response,

4. Performance shaping factor (h) regarding consideration of environmental conditions, and

5. Human action dependencies as listed in SR HR-G7 of the ASME/ANS RA-Sa-2009 PRA Standard.

e) The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression Page 39 of 83

L-PI-20-026 NSPM Enclosure sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

Provide an evaluation of the model changes associated with incorporating FLEX mitigating strategies, which demonstrates that none of the following criteria is satisfied:

(1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

NSPM Response to RAI 9 NSPM has not credited FLEX equipment or mitigating actions for RICT calculations using the PINGP internal events, internal flooding, or fire PRA models. In the future, once the issues identified in the NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (Reference 13) are resolved, FLEX equipment and strategies may be incorporated into the PRA models and used in the RICT Program in accordance with the NRC-accepted resolution.

RAI 10 - Application Specific Model CDF/LERF LAR Enclosure 5, Table E5-2 presents the CDF and LERF values for the baseline application specific model. It appears to NRC staff that the application specific model does not represent a specific configuration or an average configuration. Accordingly, explain why the CDF and LERF values from the baseline application specific model are presented in the LAR and how this model is defined.

NSPM Response to RAI 10 NSPM uses a living model concept for updates to the PRA. If PRA changes are implemented that are determined to meet certain cumulative thresholds (e.g. MSPI Birnbaum, delta-CDF/LERF) or if a significant impact to a PRA application is predicted based on either a qualitative or quantitative review, the current living model is documented and quantified as an application specific model. The newly documented model is then used to update impacted applications as needed.

The application specific model results provided in the LAR represented the most up to date average-maintenance model PRA results for both the internal events and fire PRA models at the time of LAR submission. Since these average-maintenance model results were more recent than the model of record and the application specific model was used as a starting point to develop the model used for sample RICT calculations, the application specific model results were included in the LAR for completeness. For calculation of sample RICT values, the application-specific models were converted to zero maintenance models with the unit availability factors set to 1.0.

Page 40 of 83

L-PI-20-026 NSPM Enclosure RAI 11 - Joint Human Error Probability Guidance in NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), (Table 2-1) April 2005, (ADAMS Accession No. ML051160213) recommends joint human error probability (HEP) values should not be below 1E-05. Table 4-3 of EPRI 1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, provides a lower limiting value of 1E-06 for sequences with a very low level of dependence. The NRC staff notes that underestimation of minimum joint probabilities could result in non-conservative RICTs of varying degrees for different inoperable SSCs.

In PRA RAI 02.a (ADAMS Accession No. ML15089A157) during the NFPA-805 LAR review, the NRC staff requested additional information with respect to the minimum for joint HEPs used in the fire PRA. The response to PRA RAI 02.a (ADAMS Accession No. ML15714A139),

indicated that it updated the FPRA to use no joint HEP value below 1.0E-05. The response to PRA RAI 02.a, stated that adequate justification for the future use of any value less than 1.0E-05 in the fire PRA will be provided.

TSTF-505 evaluations use the fire PRA and the internal events PRA. The LAR does not provide information about whether and, if so what, minimum joint HEP values are currently assumed in the internal events PRA. Considering these observations:

a. Clarify if the NFPA-805 fire PRA will be used for TSTF-505 calculations. If not, respond to the following question for fire PRAs joint HEPs below 1.0E-5 in addition to the requested information for internal event joint HEPs below 1.0E-6.

b. Explain what minimum joint HEP value was assumed in the internal events PRA.

c. If a minimum joint HEP value less than 1E-6 was used in the internal events PRA, then provide a description of the sensitivity study that was performed and the quantitative results that justify that the minimum joint HEP value has no impact on the RICT application.

d. If, in response part (c), it cannot be justified that the minimum joint HEP value has no impact on the application, confirm that each joint HEP value used in the internal events PRA below 1E-6 includes its own separate justification that demonstrates the inapplicability of the EPRI 1021081 lower value guideline (i.e., using such criteria as the dependency factors identified in NUREG-1921 to assess level of dependence). Provide an estimate of the number of these joint HEP values below the guideline values of 1.0E-6 for the internal events PRA, discuss the range of values, and provide at least two different examples, separately for the internal events and the fire PRA, where this justification is applied.

Page 41 of 83

L-PI-20-026 NSPM Enclosure NSPM Response to RAI 11.a The NFPA 805 fire PRA model will be used for TSTF-505 calculations. The fire PRA model was updated to support the NFPA 805 modification reduction LAR (Reference 14) after the response to RAIs (Reference 15) was submitted (NFPA 805 RAI response to PRA RAI 02.a).

During that fire PRA model update, the joint HEP floor was lowered to 1E-06 and justification for use of 1E-06 was added to the Fire Quantification Notebook. This justification included a review of human failure events (HFE) combinations to determine if any below 1E-05 were either >1% of CDF or in the top 95% of results. The review showed that there were a number of combinations that met this criteria. Each combination that met the criteria was reviewed to determine if it was based on the correct dependence. Combinations that had dependence that was not correct due to software limitations were justified for their acceptability and documented in the notebook.

NSPM Response to RAI 11.b The internal events PRA utilizes a minimum joint HEP value of 1E-06.

NSPM Response to RAI 11.c Not applicable - see response to RAI 11.b.

NSPM Response to RAI 11.d Not applicable - see response to RAI 11.b.

RAI 12 - Bounding Seismic LERF Estimate Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the [Risk Managed Technical Specifications] RMTS program, and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated Risk-Informed Completion Time (RICT). The NRC staffs safety evaluation for NEI 06-09 states that [w]here [probabilistic risk assessment] PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT.

A seismic PRA model is not available for PINGP, Units 1 and 2, and the seismic hazard cannot be screened out for the RICT application. Section 3 of Enclosure 4 to the LAR stated that a seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) penalty was determined for this application using the current PINGP, Units 1 and 2, seismic hazard curve developed in response to Recommendation 2.1 of the Near-Term Task Force (NTTF) (ADAMS Accession No. ML14086A628). Section 3.1 of Enclosure 4 to the LAR stated that the total PINGP SCDF is estimated to be 3.0E-06 per year using PINGP, Units 1 and 2, high confidence of low probability of failure (HCLPF), the spectral ratios in the safety assessment for GI-199 (ADAMS Accession No. ML100270639), and the hazard curves Page 42 of 83

L-PI-20-026 NSPM Enclosure developed in response to Recommendation 2.1 of NTTF (ADAMS Accession No. ML14086A628). It is unclear to the NRC staff why the spectral ratios determined from the IPEEE submittals in GI-199 were used in this application, instead of developing them from the more recent hazard curves developed in response to Recommendation 2.1 of NTTF to determine the SCDF estimate.

Details of the approach for determining the seismic LERF penalty are provided in LAR , Section 3.3 using the Conditional Large Early Release Probability (CLERP) for internally initiated events with some adjustment (i.e., the contribution of certain containment bypass events that would not be expected from a seismic event were not included in the CLERP). The LAR states that the CLERP determined using this approach was chosen as an adequately conservative estimate. As noted earlier, the NEI 06-09, Revision 0-A, as well as the corresponding NRC staff SE, calls for a bounding analysis. In addition, NRC staff observes that LERF-to-CDF ratio for seismic events can be significantly higher than the same ratio for internal events due to the unique nature of seismically-induced failures. It is unclear that the selected CLERP of 5% can be considered as a bounding value for use in the RICT calculation.

a) Update the total PINGP, Units 1 and 2, SCDF using spectral ratios developed from the current PINGP, Units 1 and 2, seismic hazard curve in the response to Recommendation 2.1 of NTTF or provide justification on why using the GI-199 spectral ratios instead of the more recent seismic hazard curves is acceptable.

b) Justify that the seismic LERF penalty provided in the submittal to support RICT calculations for the PINGP, Units 1 and 2, is bounding. Include rationale that deriving seismic LERF-to-CDF ratio using the internal events LERF-to-CDF ratio is bounding for seismically induced events, given that internal events random failures do not capture seismically-induced failures that may uniquely contribute to LERF.

c) If the approach to estimating the seismic LERF penalty cannot be justified as bounding for this application in response to part (b) above, then provide, with justification, the bounding seismic LERF penalty for use in RICT calculations.

NSPM Response to RAI 12 Subsequent to the submittal of the LAR, the approach used to calculate the seismic penalty values for CDF and LERF was updated using a more refined methodology that considered the NTTF seismic spectra and a more detailed method for estimating the seismic LERF penalty.

The revised evaluation results in a reduction in the proposed seismic CDF penalty; however, the updated seismic LERF to CDF ratio is now approximately 48%. The information provided here replaces the information in provided in Section 3.0 of Enclosure 4 of the LAR.

3.0 Conservative Seismic Analysis This section presents a conservative analysis of the potential seismic impact for inclusion in the decision-making process, as a seismic PRA (SPRA) is not available for PINGP. The Page 43 of 83

L-PI-20-026 NSPM Enclosure process for analyzing an unscreened external hazard without the use of a full PRA involves the following three steps:

1. Estimate Conservative Seismic CDF (SCDF) Contribution

2. Evaluate Potential Risk Increases Due to Out of Service Equipment

3. Estimate Conservative Seismic LERF (SLERF) Contribution Conservatively Estimate Seismic CDF A seismic PRA is not developed for PINGP. PINGP performed the equivalent of a reduced-scope seismic margins assessment (SMA) for its Individual Plant Examination for External Events (IPEEE) (Reference 16), with an additional focus on a few components, in accordance with Supplement 5 of Generic Letter 88-20 (Reference 17). The seismic hazard for the PINGP site was re-evaluated in 2014 and provided to the NRC (Reference 18). The site safe shutdown earthquake (SSE) is documented in this report as 0.12 g. For screening purposes, a Ground Motion Response Spectrum (GMRS) was developed and a probabilistic seismic hazard analysis (PSHA) was completed using the Central and Eastern United States Seismic Source Characterization (CEUS-SSC) for nuclear facilities and the updated EPRI Ground-Motion Model (GMM). For both the 1 to 10 Hz response spectrum and for higher frequencies

(>10 Hz), the SSE bounds the GMRS, therefore no further evaluation was performed. The NRC concurred that the reevaluated seismic hazard is bounded by the plants existing design-basis SSE and that no further responses or regulatory actions associated with Phase 2 of Near-Term Task Force (NTTF) Recommendation 2.1 "Seismic" were required for PINGP (Reference 19).

Therefore, an alternative approach is taken to conservatively estimate SCDF based on the current PINGP seismic hazard curve and assuming the seismic capacity of a component whose seismic failure would lead directly to core damage. This approach to estimation of the SCDF uses the plant- level high confidence of low probability of failure (HCLPF) seismic capacity obtained from Table C-2 of Reference 20 and convolves the corresponding failure probabilities as a function of seismic hazard level with the seismic hazard curve (Reference 18) and spectral ratios developed from Reference 18. This is a commonly used approach to estimate SCDF when a seismic PRA is not available; see Section 10-B.9 of the ASME/ANS PRA Standard (Reference 4). This approach is consistent with approaches that have been used in other regulatory applications.

Convolving the same PINGP plant-level HCLPF seismic capacity (0.28g), composite variability (c of 0.4), with the new site-specific hazard estimates for plants in the CEUS (Reference 18) and spectral ratios developed from Reference 18, the corresponding SCDFs were calculated using CAFTA 6.0b and FRANX 4.2 for the peak ground accelleration (PGA) hazard, as well as the 10 Hz, 5 Hz and 1 Hz spectral frequency hazard curves. Based on these calculations, the 10 Hz seismic hazard curve produces the highest SCDF and is controlling. The total PINGP SCDF is 4.88E-7 per year based on the PINGP 10 Hz seismic hazard curve. This SCDF value will be used as the conservative estimate of instantaneous SCDF (ICDFseismic) for the TSTF505 submittal RICT calculations.

Page 44 of 83

L-PI-20-026 NSPM Enclosure Evaluate Potential Seismic Risk Increase Due to Out-of-Service Equipment The approach taken in the computation of SCDF assumes that the SCDF can be based on the likelihood that a single seismic-induced failure leads to core damage. This approach is conservative and implicitly relies on the assumption that seismic-induced failures of equipment show a high degree of correlation (i.e., if one SSC fails, all similar SSCs will also fail). Direct use of this assumption in evaluating the risk increase from out-of-service equipment could lead to an underestimation of the change in risk. However, if one were to assume no correlation at all in the seismic failures, then the seismic risk would be lower than the risk predicted by a fully correlated model. It should be noted, however, that the change in risk using the un-correlated model with a redundant piece of important equipment out of service would be equivalent to that predicted by the correlated model.

If the industry-accepted approach (Reference 20) of correlation is assumed, the conditional core damage frequency given a seismic event will remain unaltered whether equipment is out of service or not. Thus, the risk increase due to out of service equipment cannot be greater than the total SCDF calculated by the conservative method used in Reference 21. That is, for the PINGP site, the delta SCDF from equipment out of service cannot be greater than 4.88E7 per year.

To summarize the above considerations:

The baseline seismic risk in this approach is assumed to be zero, whereas there will always be some level of baseline seismic risk for a zero-maintenance plant configuration. Therefore, the incremental seismic risk (configuration seismic risk -

baseline seismic risk) will always be overstated using a seismic penalty based on the total estimated seismic risk.

The limiting HCLPF approach assumes that a failure of a component with seismic capacity at that HCLPF leads directly to core damage (CD). However, even common failure of a given set of components (e.g., all emergency diesel generators (EDGs))

would not lead directly to CD, especially in light of the post-Fukushima FLEX mitigating strategies now in place. In reality, there are few SSCs whose failure would lead to seismic CD with any significant frequency. Examples could be important structures, or the reactor pressure vessel, or distributed systems such as all cable trays or all piping systems.

In a seismic PRA, seismic impacts to similar components (e.g., all the EDGs for a given unit) are typically assumed to be correlated unless there are reasons to justify not correlating. Correlation has the effect of introducing common cause impacts. So, if one train of emergency AC power fails seismically, both trains are modeled as likely to fail given the same seismic event. So, in general, most seismic impacts would effectively be equivalent to TS loss of function.

Given the above, the use of a seismic penalty based on assuming seismic core damage given the plant -level HCLPF is appropriate.

Page 45 of 83

L-PI-20-026 NSPM Enclosure Note that there is another significant conservatism inherent in this approach in addition to the above considerations. In determining the SCDF to be used in the RICT calculations, the full annual seismic hazard has been used. Since the maximum RICT backstop is 30 days, accounting for the full hazard introduces more than a factor of 10 increase in the calculated SCDF.

Conservatively Estimate SLERF Contribution The SLERF was conservatively estimated by including the containment fragility in the convolution calculations. The seismic capability of the containment for PINGP was evaluated in the IPEEE (Reference 16). The IPEEE concluded that there are no containment-related seismic vulnerabilities. The PINGP IPEEE confirmed, in Sections A.2.6, A.2.7, and Page A-5, that the containment SSCs required to respond to seismic events could be screened at the IPEEE screening level of 0.3g based on the walkdowns conducted. Convolving the same PINGP plant-level HCLPF seismic capacity (0.28g), composite variability (c of 0.4) and the plant limiting HCLPF for containment integrity (0.3g), with the new site-specific hazard estimates for plants in the CEUS and spectral ratios developed from Reference 18, the corresponding SLERFs were calculated using CAFTA 6.0b and FRANX 4.2 for the PGA hazard, as well as the 10 Hz, 5 Hz and 1 Hz spectral frequency hazard curves. The non-seismic conditional large early release probability is calculated as the ratio of the internal events LERF and the internal event CDF. Based on Table E5-1, the internal events LERF is 2.15E-07 per year and the internal events CDF is 1.28E-05 per year. This yields a non-seismic conditional large early release probability of 1.68E-02. The SLERF for each seismic interval is the product of the seismic initiating event frequency, the CCDP for each seismic interval, and the sum of the seismic and non-seismic conditional large early release probability. Based on these calculations, the 10 Hz seismic hazard curve produces the highest SLERF and is controlling. The total PINGP SLERF is 2.37E-07 per year based on the 10 Hz seismic hazard curve. This SLERF value will be used as the conservative estimate of instantaneous SLERF (ILERFseismic) for the TSTF-505 submittal RICT calculations.

Conclusion The above analysis provides the technical basis for addressing the seismic-induced core damage risk for PINGP by reducing the ICDP/ILERP criteria to account for a conservative estimate of the configuration risks due to seismic events.

The RICT and RMAT calculations are based on the discussion provided above. The actual RICT and RMAT calculations performed by (the PINGP Configuration Risk Management Tool are based on adding an incremental 4.88E-07 per year SCDF contribution and a corresponding 2.37E-07 per year SLERF contribution to the configuration-specific delta CDF and delta LERF attributed to internal and fire events contributions. This is accomplished by adding these seismic contributions to the instantaneous CDF/LERF whenever a RICT is in effect. This method ensures that an incremental seismic CDF/LERF equal to the conservative SCDF/SLERF is added to internal and fire events incremental CDF/LERF contribution for every RICT occurrence.

Page 46 of 83

L-PI-20-026 NSPM Enclosure RAI 13 - Screening the External Flooding Hazard Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that

[o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including external flooding. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program.

LAR Enclosure 4, Table E4-2 indicates that criterion PS1 (design basis hazard cannot cause a core damage accident) was used to screen the external flooding hazard and states based on the flood hazard reevaluation report (FHRR) and a follow-up focused evaluation for PINGP that concluded external flooding does not challenge the current licensing basis or plant safety systems. LAR Table E4-2 states that during local intense precipitation (LIP) the site has effective flood protection through the determination of Available Physical Margin and the reliability of protection features. NRC staff notes that the June 2014 staff assessment report on the flooding walkdown report (ADAMS Accession No. ML14148A477) states that a deficiency in the flood response was initially identified related to the power supply for needed portable sump pumps to ensure their functionality in case of loss of off-site power during the event. If the reliability of the flood response is dependent on systems and SSCs such as power supply and distribution, then the reliability of flood response could potentially be impacted by plant configuration. In light of these observations, it is unclear to the staff whether the licensees screening of external flooding risk from the RICT program has adequately considered the reliability of protective features considering the plant configuration.

Identify the protective features credited for screening the external flooding hazard and justify that screening of the external flooding hazard considering the reduced reliability/availability of those protection features due to plant configuration. Alternatively, describe how the risk associated with the external flooding hazard is considered in the RICT program.

NSPM Response to RAI 13 As noted in the PINGP IPEEE (Reference 16) and re-confirmed during the NTTF re-examination of external hazards (Reference 22), plant features credited for protection from external flooding consist of permanent plant features, such as building walls, doors, and flood bulkheads, as well as the inherent elevation of the plant site. None of these features are proposed for inclusion in the RICT program. Some temporary equipment is relied on if needed, such as stop logs, berms, and sandbags, which can be erected if needed well within the timeframe in which they would be required (i.e., to mitigate a slowly-developing flood resulting from excessive Mississippi River flow); however, none of these items are within the scope of Technical Specifications (and hence not subject to RICT).

Page 47 of 83

L-PI-20-026 NSPM Enclosure As an additional protective measure, the plant has available portable sump pumps that could be deployed by operations personnel to address localized water accumulation events on an as-needed basis. Any such local accumulations would not be of sufficient magnitude to impact the plants key safety functions. Minor water intrusion may occur due to wave run-up action if flood water levels are at the probable maximum flood height for the site. One portable sump pump is staged in the emergency diesel generator D5/D6 area; all of the other pumps are deployed to areas that do not contain safety-related equipment.

The NRC staff assessment cited in this question identified a possible issue with not being able to use these portable pumps in scenarios in which offsite power is lost. PINGP procured portable sump pumps and portable generators that would be able to function during a loss-of-offsite power event. In addition, a site operating procedure (Abnormal Procedure AB-4, "Flood") was revised to describe the process for deploying the sump pumps. Therefore, this identified issue was resolved.

Based on the re-evaluation of external flooding hazards performed in response to the post-Fukushima orders (Reference 23), which identified no new vulnerabilities to extreme external flooding events, the robust design of flood protection features, and the slow developing nature of the flood event, it remains appropriate to screen external flooding hazards from consideration for the RICT program.

RAI 14 - Screening of Snowfall Risk Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that

[o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

LAR Enclosure 4, Section 4 concludes that external hazards other than seismic events can be screened from consideration in the RICT program including snow. The LAR also states that hazards are evaluated for plant configurations allowed under the RICT program. LAR , Table E4-2, indicates that criterion C1 (event damage potential is less than events for which plant is designed) and criterion C4 (event is included in the definition of another event) was used to screen the snow hazard. The LAR further states that the design basis roof live load is 50 pounds per square foot (psf) and the maximum recorded snowfall from a single storm in Minnesota occurred near Finland, Minnesota and measured 46.5 inches with an estimated weight of 46.5 psf, which is within the design basis. Considering the small margin between the design basis roof live load and the maximum recorded snowfall, it is unclear to the staff whether the risk of this hazard is adequately considered for this application[.]

In light of these observations, justify the screening of risk associated with snowfall from the application by showing that the occurrence frequency of snowfall events that could challenge the plant is low.

Page 48 of 83

L-PI-20-026 NSPM Enclosure NSPM Response to RAI 14 Industry practice in PRA is to assume that design limits have been properly calculated and that plant structures have been constructed to meet those limits. Postulating failure at or near a design basis limit in the PRA would be a very conservative assumption, as actual failure would be expected at a value significantly beyond the design limit.

The quoted maximum snowfall accumulation presented in LAR Enclosure 4 is for Finland, MN, which is located in the extreme northern part of the state near the Lake Superior shoreline.

That area receives far more snowfall than the Red Wing, MN area near where PINGP is located. As noted in Chapter 2.3.2 of the PINGP USAR, the maximum snowfall accumulation in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recorded in Red Wing is 19.9 inches in January of 1982. Snowfall averages about 44 inches per year. A conservative estimate for the weight of one inch of snow would be 1.75 pounds per square foot (based on 62.4 lb/cu ft of water with a moisture density of 33%). This value for an approximate 20 inch snowfall is well below the 50 psf design limit for the PINGP safety-related structures. Therefore, the screening of snowfall events from consideration in the RICT program is appropriate.

RAI 15 - Real-Time Risk Model Regulatory Position 2.3.3 of RG 1.174 states that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

Section 4.2 of NEI 06-09 describes attributes of the configuration risk management tool (CRM).

A few of these attributes are listed below:

Initiating events accurately model external conditions and effects of out-of-service equipment.

Model translation from the PRA to a separate CRM tool is appropriate; CRM fault trees are traceable to the PRA. Appropriate benchmarking of the CRM tool against the PRA model shall be performed to demonstrate consistency.

Each CRM application tool is verified to adequately reflect the as-built, as-operated plant, including risk contributors which vary by time of year or time in fuel cycle or otherwise demonstrated to be conservative or bounding.

Application specific risk important uncertainties contained in the CRM model (that are identified via PRA model to CRM took benchmarking) are identified and evaluated prior to use of the CRM tool for RMTS applications.

Page 49 of 83

L-PI-20-026 NSPM Enclosure

CRM application tools and software are accepted and maintained by and appropriate quality program.

The CRM tool shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant.

Seasonal or time-in-operating cycle variations must be either conservatively assessed or properly quantified for the conditions. of the LAR describes the attributes of the RTR, or CRM, tool, for use in RICT calculations at PINGP, Units 1 and 2. The LAR explains that the internal flood model is integrated into the internal events PRA model, but the fire PRA model is maintained as a separate model. The LAR also describes several changes made to the internal events and fire PRA models to support calculation of configuration-specific risk and mentions approaches for ensuring the fidelity of the RTR to the PRAs including RTR maintenance, documentation of changes, and testing. With regards to development and application of the RTR model, address the following:

a) NEI 06-09 Section 2.3.4 states:

If the PRA model is constructed using data points or basic events that change as a result of time of year or time of cycle (examples include moderator temperature coefficient, summer versus winter alignments for HVAC, seasonal alignments for service water), then the RICT calculation shall either 1) use the more conservative assumption at all time, or 2) be adjusted appropriately to reflect the current (e.g.,

seasonal or time of cycle) configuration for the feature as modeled in the PRA.

Explain how any changes in environmental conditions due to seasonal variations are accounted for in the CRM model for use in RICT calculations. Include discussion of impacts on the plant response model (e.g., temperature impact on system success criteria) and on initiator frequency (e.g. impact on LOOP frequency). Also, include discussion of the bases for not modelling the potential impact of seasonal variations on systems included in the PRAs (e.g., Use of analyses such of GOTHIC (General Purpose Thermal-Hydraulic Analysis) to determine the impact of ambient air temperature on system success, and the use of Risk Management Actions).

b) Confirm that out-of-service equipment will be properly reflected in the CRM model initiating event models as well as in the system response models.

c) Describe the process that will be used to maintain the accuracy of any pre-solved cutsets with changes in plant configuration.

Page 50 of 83

L-PI-20-026 NSPM Enclosure NSPM Response to RAI 15.a Cycle or seasonal based variations are accounted for in the CRM model by utilizing automatic features such as calculation of the operating cycle time or through alignments / activities that are manually applied by users. These features include the following:

Running / Not running status of CL pumps, which varies throughout the year. The CL system is operated with one, two, or three pump operation depending on river temperature and system demand.

Traveling screen fine versus coarse mode for the plant screenhouse, which varies throughout the year based on environmental permit requirements.

Cycle time based adjustment of unfavorable exposure time, which varies the success criteria for pressure relief during an ATWS depending on the current point in the operating cycle.

Outside grid impacts such as transmission lines out of service (OOS) and/or switchyard maintenance that could result in a higher LOOP frequency is accounted for by increasing the LOOP frequency in the CRM model when these activities are in-progress.

These cycle or yearly based variations are updated as needed to reflect the current plant condition. Therefore, the NEI 06-09 criteria are met.

There are no outside air temperature considerations that impact the PRA. Active cooling is credited in the main control room based on the results of a GOTHIC heatup analysis that showed it was required to maintain habitability. The CRM model alignments include the running/not running status of the equipment required to maintain control room habitability.

In other areas such as the Safeguards Screenhouse, Auxiliary Building (safeguards areas),

and Turbine Building (safeguards areas) a series of best-estimate heatup analyses have been performed to show that the remainder of HVAC systems are not required. These analyses utilized conservative outside air temperature inputs based on a high confidence interval statistical analysis of historical temperatures. Since the analysis used conservative inputs for the entire year temperature range, the conclusion is valid for all points in the year regardless of outside air temperature and no seasonal variations are required in the PRA model.

In addition to these numerical adjustments, the impact of severe weather and/or adverse grid condition is evaluated through use of importance measures for the current configuration.

Important equipment is evaluated with respect to the LOOP initiators and RMAs are evaluated and applied if necessary.

NSPM Response to RAI 15.b Initiating events that are not point estimates (i.e., Support System Initiating Events (SSIE)) are dynamically calculated in the CRM model. The SSIE fault tree contains both initiating (i.e.,

trigger) events and mitigating events for the systems in question and both events are logically equivalent to each other. When equipment is taken OOS the mitigating event(s) for the Page 51 of 83

L-PI-20-026 NSPM Enclosure equipment are set to a probability of 1.0. This has the effect of failing that equipment for both the SSIE model and any other function of that equipment within the remainder of the PRA model.

NSPM Response to RAI 15.c No pre-solved cutsets will be used in the NSPM CRM model used for RICT calculations.

RAI 16 - PRA Model Uncertainty Analysis Process The NRC staff SE to NEI 06-09, Revision 0, specifies that the LAR should identify key assumptions and sources of uncertainty and to assess and disposition each as to their impact on the RMTS application.

NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Main Report," dated March 2017 (ADAMS Accession No. ML17062A466) presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainties for the internal events and fire PRAs was performed using the guidance in NUREG-1855, Revision 1. The LAR explains that to identify key assumptions and sources of PRA modeling uncertainty (1) the internal events and fire PRA models and notebooks were reviewed for plant-specific issues and (2) generic sources of uncertainty identified in Electric Power Research Institute (EPRI) Technical Report (TR) -1016737 and 1026511 were also reviewed for applicable issues. The LAR concludes for both the internal events and fire PRAs that no specific uncertainty issues have been identified that would impact the RICT application, and no candidate key assumption and sources of uncertainty were presented in the LAR.

Based on the discussion in the LAR, it is not clear to NRC staff what specific process and criteria were used to screen uncertainties from an initial comprehensive list of assumptions and sources of PRA modeling uncertainty (including those associated with plant specific features, modeling choices, and generic industry concerns), in order to conclude that no uncertainty issues could impact the RICT calculations. It is also not clear whether certain key assumptions and sources of uncertainty were initially identified but found to be unimportant through use of sensitivity studies per guidance described in LAR Enclosure 9, Section 1.0.

Therefore, address the following:

a) Describe the specific PINGP process used to screen uncertainties from the initial comprehensive lists of PRA uncertainties (including those associated with plant specific features, modeling choices, and generic industry concerns), in order to eventually conclude that the uncertainty issues could not impact the RICT calculations.

Page 52 of 83

L-PI-20-026 NSPM Enclosure b) Include description of the criteria that was used to screen down from a comprehensive listing of sources of uncertainty to a smaller set of key candidate assumptions and sources of uncertainty; and also describe the criteria used to justify that none of the key candidate assumptions and sources of uncertainty could have an impact on the RICT calculations. As part of this description, explain whether use of the results of sensitivity studies were included as part of the criteria that was used.

c) Include description of plant or PRA procedures, practices or processes that are used to support the identification and dispositioning PRA modelling uncertainty concerns (e.g., a PRA change database).

NSPM Response to RAI 16.a The evaluation of sources of uncertainty for the RICT application built upon the activities performed in support of the PINGP application for implementation of 10 CFR 50.69 (Reference 24). However, it was recognized that the impacts of any uncertainties on the RICT application could differ from those evaluated for the 10 CFR 50.69 application. In particular, RICT calculations involve primarily delta-risk evaluations, whereas 10 CFR 50.69 categorization evaluations rely on risk ranking of structures, systems, and components (SSCs) in the plant.

The process used to evaluate sources of uncertainty for the RICT application follows the guidance illustrated in Figure 4-1 of EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments (Reference 25). The sources of uncertainty evaluation for the baseline internal events PRA considers both plant-specific sources of uncertainty and the generic uncertainties identified in EPRI TR-1016737. During the development of the 10 CFR 50.69 LAR, the sources of uncertainty notebook (Reference 26) for the internal events/internal flood PRA model for the current model of record, Revision 5.3 (Reference 27) was reviewed to collect a listing of all sources of uncertainty that were identified as having potential impacts on the base PRA model or risk-informed applications. If the sources of uncertainty notebook already provided a justification that the model uncertainty need not be evaluated further as a potential source of uncertainty for the base model or for applications (e.g., negligible contribution, best-estimate modeling, etc.), then those model uncertainties were not considered further. This information represents the input from the base model assessment as shown in Figure 4-1. It should be noted that the additional lists of potential generic sources of uncertainty from Table A-4 of EPRI TR1016737 were also considered in the sources of uncertainty notebooks for both the internal events and fire PRAs.

The potential uncertainty items noted in Table A-3 of EPRI TR1016737 overlap some of the issues already shown in Table A-4 or evaluated in the base model evaluation of sources of uncertainty. Other items in Table A-3 are noted as being adequately assessed through the industry peer review process or are properly modeled in the PRA. Lastly, some items are not applicable to PINGP (e.g., BWR-specific issues, digital I&C, credit for use of portable equipment, use of alternate injection systems, etc.). Application-specific uncertainties, as shown in Figure 4-1, are addressed in Section 4.0 of LAR Enclosure 9.

Page 53 of 83

L-PI-20-026 NSPM Enclosure Twenty-four significant assumptions and uncertainties were identified from the internal events PRA model for consideration for RICT impacts for the Revision 5.3 model. An additional source of uncertainty (RCP Seal LOCA Treatment) that was dispositioned as not a source of uncertainty in the PRA notebook was retained for RICT-specific consideration given NRC questions that were raised during the 10 CFR 50.69 LAR review concerning the seal LOCA treatment in the PRA (i.e., use of Flowserve N-9000 abeyance seal model).

It should be noted that some of the data tables in Appendix A of the sources of uncertainty notebook that included the summary listing of potential sources of uncertainty for the various PRA technical elements included items that had been subsequently eliminated in the current model of record (e.g., modeling or documentation enhancements were made to resolve the identified uncertainty). While selected entries in the Appendix A tables did not reflect the current PRA model, the tables in Appendix B that document the final list of characterized uncertainties (which were used as input to the RICT-specific evaluation) represent the uncertainties noted in the current model of record, Revision 5.3.

The fire PRA sources of uncertainty were re-evaluated in response to RAIs generated during the NRC review of the PINGP 10 CFR 50.69 LAR, and an updated sources of uncertainty notebook was prepared (Reference 27). The updated fire PRA sources of uncertainty evaluation compiled and characterized plant-specific assumptions and associated sources of model uncertainty as well as the generic sources of uncertainty presented in EPRI TR1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (Reference 28), based on the most recent fire model update.

Using an approach similar to that used for the internal events PRA uncertainty review, the list of assumptions and sources of uncertainty that were identified as potentially impacting the baseline PRA or risk-informed applications were compiled for evaluation for impacts upon the calculation of RICTs. Twelve relevant sources of uncertainty from the fire PRA model were identified.

A total of 37 candidate sources of uncertainty (25 from internal events/internal flooding PRA and 12 from fire PRA) were then evaluated for their specific impacts on the calculation of RICTs (Reference 29). The calculation of a RICT is based on Incremental Core Damage Probability (ICDP) and Incremental Large Early Release Probability (ILERP). These are delta-risk measures that evaluate the change in risk over the baseline zero maintenance risk for the plant. In reviewing each of the candidate sources of uncertainty for the internal events/internal flooding and fire PRAs, the following considerations were applied to determine if a RICT impact could exist:

Candidate uncertainties that were subsequently determined to be resolved in the current model of record, either through modeling improvements to eliminate the uncertainty or by the inclusion of a documented basis in the PRA notebooks (e.g.,

demonstration that the probability of the item of concern can be screened in accordance with the guidance provided in the ASME/ANS PRA Standard (Reference 4) or that the impact on the baseline PRA model results is negligibly small), are not considered as key Page 54 of 83

L-PI-20-026 NSPM Enclosure sources of uncertainty for the RICT Program (9 of the 37 candidate sources were screened using this criterion).

Candidate uncertainties that were examined via sensitivity studies to confirm that the impact on baseline CDF and LERF are negligibly small are not considered as key sources of uncertainty for the RICT Program (6 of the 37 candidate sources of uncertainty were screened using this criterion).

Candidate uncertainties that are represented through conservative PRA modeling that would result in more limiting RICTs than would be calculated using best estimate modeling (e.g., assuming whole room burns in the fire PRA for fire areas with low risk significance) are not considered as key sources of uncertainty for the RICT program (4 of the 37 candidate sources of uncertainty were screened using this criterion).

Candidate uncertainties that were demonstrated to not be uncertainties through the use of deterministic analyses (e.g., MAAP or other thermal-hydraulic analyses, battery load calculations, etc.) are not considered as key sources of uncertainty for the RICT Program (2 of the 37 candidate sources of uncertainty were screened using this criterion).

Candidate uncertainties that were identified, but for which current industry-accepted approaches were used, are not considered as key sources of uncertainty. This is consistent with the ASME/ANS PRA Standard definition of a source of modeling uncertainty which states: a source is related to an issue in which there is no consensus approach or model and where the choice of approach or model is known to have an effect on the PRA model. A number of these candidates were derived from the EPRI list of generic PRA uncertainties (15 of the 37 candidate sources of uncertainty were screened using this criterion).

Candidate uncertainties that would not have an impact on the CDF and LERF metrics used to calculate RICTs (e.g., post-accident containment phenomenology that could impact late releases from containment) (1 of the 37 candidate sources of uncertainty was screened using this criterion).

As a result of this comprehensive review of potential uncertainties generally following the guidance provided in NUREG-1855 Revision 1, none of the 37 items were identified as having a significant impact on the RICT calculations, as documented in Prairie Island RICT Evaluation of Open F&Os and Uncertainties (Reference 29).

NSPM Response to RAI 16.b As described in RAI 16.a, specific criteria were used to assess each source of uncertainty from the baseline PRA models.

Page 55 of 83

L-PI-20-026 NSPM Enclosure Quantitative evaluations or thermal-hydraulic studies were performed to determine whether the source of uncertainty was key for the base PRA for the RICT application. Quantitative or thermal-hydraulic evaluations were performed to disposition the following uncertainties:

An assumption that low pressure RHR piping will always rupture upon exposure to RCS pressure was determined to have a negligible impact on baseline CDF and LERF.

Non-modeling of tripping of the Circulating Water pumps on low water level in the intake bay was determined to have a negligible impact on baseline CDF and LERF.

Uncertainty concerning the use of screening human error probabilities in a Loss of Circulating Water event was determined to have a negligible impact on CDF and LERF.

A conservative assumption concerning mission times for an MOV in an interfacing systems LOCA pathway was determined to have a negligible impact on CDF and a conservative impact on LERF. The LERF impact would result in calculation of conservative RICT values.

For an EPRI generic uncertainty associated with battery depletion, realistic battery load calculations were performed to confirm that the PRA assumptions were appropriate.

For the uncertainty associated with ex-vessel cooling, specific MAAP evaluations were previously performed to demonstrate that ex-vessel cooling was conservatively modeled (see response to RAI 7.d)

Uncertainty concerning credit for the RCP abeyance Seals was determined to have a negligible impact on CDF and LERF.

An uncertainty noted in the fire PRA concerning the assumption that instrument air was always failed in fire events due to the presence of soldered piping connections was determined to have a negligible impact on CDF and LERF.

NSPM Response to RAI 16.c As previously discussed in the PINGP LAR to adopt TSTF-425, "Relocate Surveillance Frequencies to Licensee Control - Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b" (Reference 30), NSPM employs a multi-faceted, structured approach in establishing and maintaining the technical adequacy and plant fidelity of the PRA models for its nuclear generation sites. This approach includes a proceduralized PRA maintenance and update process, as well as the use of independent peer reviews. The following information describes this approach as it applies to the PINGP PRA.

The NSPM risk management process ensures that the applicable PRA model is an accurate reflection of the as-built and as-operated plants. This process includes a governing Corporate Directive (CD 5.7, "Probabilistic Risk Assessment Standard" (Reference 31)) and subordinate Page 56 of 83

L-PI-20-026 NSPM Enclosure implementing procedures. The NSPM PRA maintenance and update process is described in the following procedures:

FP-PE-PRA-01, PRA Change Database Use and Application Guide (Reference 32),

which addresses the following elements:

o Identifies and tracks ongoing evaluation of plant changes and collecting new information including identified errors in the PRA model, Peer Review Findings and suggestions.

o Qualification of PRA personnel o Documentation of disposition of PRA impacts (PRA Change Database)

FP-PE-PRA-02, PRA Guideline for Model Maintenance and Update (Reference 33),

which addresses the following elements:

o Maintenance and update of the PRA to be consistent with the as-built, as-operated plant, including closure of peer review findings o Consideration of the cumulative impact of pending changes on the PRA o Impact of plant changes on the PRA models o Control of software used for the PRA models o Documentation of the PRA Maintenance and Update process The overall model update process, including FP-PE-PRA-01 and FP-PE-PRA-02, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files.

PRA Change Database Forms A PRA Change Form is stored electronically in the PRA Change Database (PCD), governed by procedure FP-PE-PRA-01 (Reference 32). A PCD is created for all issues that are identified that could impact the PRA model, including resolving concerns associated with modelling assumptions and uncertainties. Each open PCD Form documents details of each identified issue, evaluates the risk impact of that specific issue, and identifies affected PRA systems, analyses, and risk-informed applications.

During resolution of the PCD issue, the preparer will follow model revision instructions delineated in FP-PE-PRA-02 (Reference 33) and revise the appropriate portions of the PRA model or documentation to address the issue. A summary of the resolution of the issue is documented in the PCD form under the Actual Solution section. As appropriate, the preparer will include which methodology was chosen and why, if there were any additional details of the problem discovered during resolution, a summary of areas of the model that were revised (i.e.

Feedwater fault trees), etc. At a minimum, all points addressed in the Detailed Problem Description, Proposed Solution, or Risk Level Description should be addressed. In addition, Page 57 of 83

L-PI-20-026 NSPM Enclosure the PCD form section related to Affected Applications, Model Revision number and Record of Analysis will be filled in as necessary.

The reviewer of the PCD form will review the Affected Applications, Model Revision number and Record of Analysis sections for completeness and accuracy to ensure that the solution addressed the problem and to verify that the change was incorporated and documented in accordance with the ASME/ANS PRA Standard (Reference 4).

RAI 17 - Loss of Function TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493), does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be operable) in the risk informed completion time program.

Based on the design success criteria provided in the license amendment request Enclosure 1, Table E1-1, it appears that some LCO Conditions and/or Required Actions may constitute a loss of function. Provide a basis for why the following does not constitute a loss of function, or alternatively, remove it from the scope of the risk informed completion time program.

1. TS 3.3.1, Reactor Trip System (RTS) Instrumentation

Required Action M.1 o The option of calculating a RICT is applied to the action to restore channel to OPERABLE status (for Condition M, One Reactor Coolant Pump Breaker Open channel inoperable). This appears to be a loss of function when greater than the P7 interlock and less than the P-8 interlock.

Required Action O.1 (previously N.1 before insertion of new Conditions N & P) o Place channel in trip (for Condition O, One Turbine Trip channel inoperable). This appears to be a loss of function for instrument 14.b, Turbine Stop Valve Closure.

2. TS 3.3.2, Engineered Safety Features Actuation System (ESFAS) Instrumentation

Required Action B.1 o The option of calculating a RICT is applied to the action to restore channel or train to OPERABLE status (for Condition B, One channel or train inoperable). This appears to be a loss of function for instrument 2.a, Containment Spray Manual Initiation.

Required Action F.1 o The option of calculating a RICT is applied to the action to restore channel or train to OPERABLE status (for Condition F, One channel or train inoperable). This appears to be a loss of function for instrument 4.a, Steam Line Isolation Manual Initiation.

3. TS 3.3.4, 4 kV Safeguards Bus Voltage Instrumentation

Required Action C.5 o The option of calculating a RICT is applied to the action to restore automatic load sequencer to OPERABLE status (for Condition C, Required Action and associated Page 58 of 83

L-PI-20-026 NSPM Enclosure completion time of Condition A or B not met, or Function a or b or both with three channels per bus inoperable, or one required automatic load sequencer inoperable).

This appears to be a loss of function for the Condition when Function a or b or both with three channels per bus inoperable.

4. TS 3.7.8, Cooling Water (CL) System

Required Action A.1 o The option of calculating a RICT is applied to the action to restore one safeguards CL pump to OPERABLE status (for Condition A, No safeguards CL pumps OPERABLE for one train). This appears to be a loss of function as Updated Final Safety Analysis Report Section 6.2.2.1.3 states:

For post-DBA recirculation flow, two of the three safeguards Cooling Water pumps (two diesel driven and one motor driven) are started.

However, only one Cooling Water pump is required to operate during the recirculation phase to cool the recirculation flow and containment atmosphere in the unit suffering the accident and provide the necessary cooling for the other unit.

NSPM Response to RAI 17.1 Required Action M.1 This condition is a loss of function when thermal power is greater than the P-7 interlock and less than the P-8 interlock. Therefore, the TS markup has been updated to add a note to Condition M excluding the use of RICT in this condition. See Attachment 3 to this Enclosure for the revised TS markups that supersede those provided in Attachment 1 of the LAR.

Required Action O.1 The design success criteria described in Table E1-1 of the LAR for the TS 3.3.1 Condition O, Turbine Trip Function is incorrect. The minimum equipment to fulfill the TS specified safety function and revised design success criteria is as follows:

Two of two Turbine Stop Valve Closure channels or two of three Low Autostop Oil Pressure channels when above the P-9 interlock.

It is correct that with one channel of the Turbine Stop Valve Closure indication inoperable (and not in a trip condition), that the two of two logic for that input from the turbine trip to the reactor trip would be inoperable. However, the revised design success criteria described above clarifies that either the Turbine Stop Valve Closure channels OR the Low Autostop Oil pressure channels are sufficient to cause the reactor trip based on turbine trip. Therefore, the Low Autostop Oil pressure channels provide the redundant and diverse reactor trip signal in the event that the turbine throttle valve indications are inoperable.

Page 59 of 83

L-PI-20-026 NSPM Enclosure The PRA model supporting RICT includes explicit modeling of both the throttle valves and the Low Autostop Oil pressure switches, along with the associated logic components necessary for the reactor trip signal following a turbine trip.

See Attachment 1 to this Enclosure for the revised Table E1-1 that reflects this correction and supersedes that provided in Enclosure 1 of the LAR.

NSPM Response to RAI 17.2 Required Action B.1 The TS design success criteria for the CS Manual Initiation function is two of two CS Manual Initiation channels. Therefore, TS Condition B (one channel or train inoperable) does represent a loss of function for the CS Manual Initiation function. The TS markup has been updated to exclude the use of RICT for the CS Manual Initiation function and Table E1-1 has been revised for TS 3.3.2 Condition B. See Attachments 1 and 3 to this Enclosure for the revised Table E1-1 and TS markups, which replace Table E1-1 in Enclosure 1 and Attachment 1 of the LAR, respectively.

Required Action F.1 The design success criteria for TS 3.3.2 Condition F was incorrectly specified in Table E1-1 of of the LAR. The design success criteria for TS 3.3.2, Condition F is:

One of two Manual Initiation channels (switches and associated logic).

Isolation of the main steam lines provides protection in the event of a steam line break (SLB) inside or outside containment. Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one steam generator, at most. For an SLB upstream of the MSIV, inside or outside of containment, closure of the non-return check valve (NRCV) or the MSIV limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident.

A single inoperable MSIV closure switch will not prevent isolation of the affected SG from the non-affected SG because, at minimum, the NRCV will protect for breaks upstream of the MSIV and the one operable MSIV closure switch will protect for breaks downstream of the MSIV.

Therefore, TS 3.3.2 Condition F does not represent a loss of TS function for steam line isolation and no changes are necessary to the proposed TS markups for TS 3.3.2 Condition F.

NSPM Response to RAI 17.3 When three channels of Function a and Function b are inoperable on one bus, this loss of instrumentation would prevent the automatic load sequencer on that bus from sensing the undervoltage or degraded voltage condition. This has the effect of rendering the automatic load sequencer on the affected bus inoperable and TS 3.3.4 Condition C would be entered for the affected automatic load sequencer.

Page 60 of 83

L-PI-20-026 NSPM Enclosure If three channels of Function a and Function b were also inoperable on the other bus for the same unit, this would render the automatic load sequencer for the other bus inoperable.

While the loss of instrumentation function in this condition appears to be allowed by TS 3.3.4 Condition C, this condition also results in both automatic load sequencers simultaneously inoperable. In that condition, the statement one required automatic load sequencer inoperable is not met and Condition D is required to be entered. Therefore, application of a RICT is not allowed for Function a or b or both with three channels per bus when that condition results in a loss of function (i.e. when inoperability impacts both buses). Therefore, no changes are necessary to the proposed TS markups for TS 3.3.4 Condition C.

NSPM Response to RAI 17.4 The design and operation of the CL system was described in more detail in the response to RAI 1.a. One-half of essential services for each unit is supplied from each CL header. A single CL pump can provide sufficient cooling to support one unit during the injection and recirculation phases of a postulated loss of coolant accident plus sufficient cooling to maintain the second unit in a safe shutdown condition.

One of two trains of CL is required to meet the TS design function. Each diesel-driven cooling water pump (DDCLP) feeds its applicable trains header and the 121 Motor-Driven Cooling Water Pump (MDCLP) can be aligned as a backup to either DDCLP. Therefore, the design success criteria for the CL pumps is one of two DDCLPs (or 121 MDCLP if aligned as a safeguards replacement) as stated in the updated Table E1-1. This success criteria ensures that at least one of two headers will be supplied with sufficient flow for all hot shutdown / post-accident loads for both units.

The condition of no safeguards CL pumps operable for one train represents the condition where one train is inoperable, but the other train is operable with its applicable safeguards pump operable. Therefore, TS 3.7.8 Condition A is not a loss of function and no changes are necessary to the proposed TS markups for TS 3.7.8 Condition A.

RAI 18 - Instrument and Controls (I&C) Defense-in-Depth In Section 3.1.2.3 Evaluation of Instrumentation and Control Systems of the TSTF-505 Revision 2 Model safety evaluation (SE) (ADAMS Accession No. ML18267A259), the NRC clarifies, in part, that the basis of the staffs safety evaluation is to consider a number of potential plant conditions allowed by the new TSs and to consider what redundant or diverse means were available to assist the licensee in responding to various plant conditions. The TSTF-505 Revision 2 Model SE states, in part, that at least one redundant or diverse means (e.g., other automatic features or manual action) to accomplish the safety functions (e.g.,

reactor trip, safety injection, or containment isolation) remain available during the use of the risk-informed completion time (RICT).

Page 61 of 83

L-PI-20-026 NSPM Enclosure RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Licensing Basis, states, in part, that the licensee should assess whether the proposed license basis (LB) change meets the defense-in-depth principle by not over-relying on programmatic activities as compensatory measures associated with the change in the LB. RG 1.174 also elaborates that human actions (e.g., manual system actuation) are considered as one type of compensatory measure.

RG 1.177, An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications, describes the regulatory position with respect to defense-in-depth (including diversity).

In Section 3.0, Evaluation of Instrumentation and Control Systems of Enclosure 1 of the LAR, the functional units are listed for both the Reactor Trip System (RTS) and the Engineered Safety Features Actuation System (ESFAS). For RTS Instrumentation in Section 3.1, of the LAR the licensee states that The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS. The LAR lists all the trip inputs but does not describe the diversity and defense-in-depth associated with each plant limiting condition/event. Similarly, for the ESFAS Instrumentation in Section 3.2 of the LAR, the licensee lists the different inputs through which the actuation occurs; however, the LAR does not describe the diversity and defense-in-depth associated with each limiting condition/event.

The NRC staff notes that for both RTS and ESFAS, the LAR does not provide adequate information to verify at least one redundant or diverse means will remain available to accomplish the intended safety functions of proposed instrumentation and control (I&C) TS with RICT in the LAR.

In light of these observations:

a) Describe other means that exist to initiate the safety function for each plant accident condition/event that the identified I&C TS function in the LAR is currently designed to address. The evaluation of diverse means should identify the conditions that each functional unit responds to, and for each condition, other means (e.g., diversity, redundancy, or operator actions) that can be used.

b) In Section 3.0 of the LAR Enclosure 1, for both RTS and ESFAS systems LAR lists several manual actuations as diverse means for each affected I&C safety function.

Confirm that these manual actuations are defined in the PINGP, Units 1 and 2, operation procedures to which the operators are trained.

NSPM Response to RAI 18.a From Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2 Page 62 of 83

L-PI-20-026 NSPM Enclosure (Reference 5), Section 2.1.1, defense-in-depth consists of a number of elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o Current Technical Specifications reflect this balance by allowing one sensor module or channel of a function to be placed in bypass or trip, while preserving the fundamental safety function of the RTS or ESFAS. Bypassing an inoperable channel does not affect the number of channels required to provide the safety function. Even in the TS Condition for 2 channels in a function inoperable, the fundamental safety function is preserved , since 2 operable channels remain in the function.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when 1 or 2 channels of an RTS or ESFAS Function are inoperable. The remaining operable channels for that function are fully capable of performing the safety function of RTS or ESFAS.

Systematic redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

o System redundancy, independence and diversity remain the same as in the as-designed condition. The number of operable functions has not been decreased (diversity), the number of minimum operable channels to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one channel inoperable.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common cause failure for the RTS or ESFAS Functions. It may allow the Completion Time to be extended for 1 or 2 channels in a Function to be inoperable prior to placing the channel in trip. Placing the channel in trip fulfils one of the two required channels in trip needed to perform the safety function.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the Conditions listed in the Technical Specifications, a potential extension of the Completion Time does not change any personnel actions required when the TS Condition is entered. Therefore, no change to the possibility of a human error is introduced, and no change to the defenses against that potential human error have been altered.

Page 63 of 83

L-PI-20-026 NSPM Enclosure

The intent of the plant's design criteria is maintained.

o The design criteria of the RTS or ESFAS is maintained as reflected in the USAR 7.4.1 and 7.4.2. Redundancy, diversity of signal and independence of trip channel functions are maintained with the requested change. The change requested in the LAR does not physically change the RTS or ESFAS systems in any way. It only allows additional time, under certain low risk conditions in accordance with the RICT Program, to perform Required Actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in RG 1.174, Revision 2, are met.

Tables 18-1 and 18-2 provide the diverse RTS and EFSAS equipment available to respond to each accident condition. Not all equipment is assumed or credited in the PINGP USAR Chapter 14 analysis of records for conservative modeling reasons, however, all equipment has been confirmed to be available and useable in case of any event.

Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips Manual Reactor Trip Reactor a. Automatic Actuation 1) Two Manual Reactor Trip Trip Failed from one Reactor Switches Trip Function 2) Two Reactor Trip Breakers in each Train

3) Diverse Automatic Reactor Trip Functions

4) AMSAC Manual Initiation

5) Two Manual SI Initiation Switches Power Range, High Reactor a. Feedwater system 1) Automatic Protection Neutron Flux Trip malfunctions that result a. Power Range, Low Neutron in a decrease in Flux feedwater temperature. b. Overtemperature T USAR 14.4.6 c. Overpower T

2) Manual Trip

b. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, Low Neutron in an increase in Flux feedwater flow. b. Overtemperature T USAR 14.4.6 c. Overpower T

2) Manual Trip

c. Excessive Load Increase 1) Automatic Protection Incident a. Overtemperature T USAR 14.4.7 b. Overpower T

2) Manual Trip

d. Loss of Coolant Accident 1) Automatic Protection Page 64 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips USAR 14.6 a. Power Range, Low Neutron Flux

b. Low Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Coolant Flow - Low

e. High Containment Pressure

2) Manual Trip

e. Chemical and Volume 1) Automatic Protection Control System a. Overtemperature T Malfunction b. Overpower T USAR 14.4.4 2) Manual Trip

f. RCCA Ejection 1) Automatic Protection USAR 14.5.6 a. Power Range, Low Neutron Flux

2) Manual Trip

g. RCCA Withdrawal at 1) Automatic Protection Power a. Power Range Neutron Flux USAR 14.4.2 Rate, High Positive Rate

b. Overtemperature T

c. Overpower T

d. High Pressurizer Pressure

e. High Pressurizer Level

2) Manual Trip

h. RCCA Withdrawal from 1) Automatic Protection Subcritical a. Power Range, Low Neutron USAR 14.4.1 Flux

b. Source Range Flux

c. Intermediate Range Flux

2) Manual Trip

i. Rupture of a Steam 1) Automatic Protection Pipe a. Overpower T USAR 14.5.5 b. Low Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip Power Range, Low Reactor a. Feedwater system 1) Automatic Protection Neutron Flux Trip malfunctions that result a. Power Range, High Neutron in a decrease in Flux feedwater temperature. b. Overtemperature T USAR 14.4.6 c. Overpower T Page 65 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips

2) Manual Trip

b. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, High Neutron in an increase in Flux feedwater flow. b. Overtemperature T USAR 14.4.6 c. Overpower T

2) Manual Trip

c. Loss of Coolant 1) Automatic Protection Accident a. Power Range, High Neutron USAR 14.6 Flux

b. Low Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Coolant Flow - Low

e. High Containment Pressure

2) Manual Trip

d. RCCA Ejection 1) Automatic Protection USAR 14.5.6 a. Power Range, High Neutron Flux

2) Manual Trip

e. RCCA Withdrawal from 1) Automatic Protection Subcritical a. Power Range, High Neutron USAR 14.4.1 Flux

b. Source Range Flux

c. Intermediate Range Flux

2) Manual Trip

f. Start-up of Inactive 1) Automatic Protection Reactor Coolant Loop a. Overpower T USAR 14.4.5 2) Manual Trip Power Range Reactor a. RCCA Misalignment 1) Automatic Protection Neutron Flux Rate, Trip (Dropped Rod) a. Overtemperature T High Positive Rate USAR 14.4.3 b. Overpower T

c. Low Pressurizer Pressure

2) Manual Trip Power Range Reactor a. RCCA Misalignment 1) Automatic Protection Neutron Flux Rate, Trip (Dropped Rod) a. Overtemperature T High Negative Rate USAR 14.4.3 b. Overpower T

c. Low Pressurizer Pressure

2) Manual Trip Intermediate Range Reactor a. RCCA Withdrawal from 1) Automatic Protection Neutron Flux Trip Subcritical a. Source Range Flux Page 66 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips USAR 14.4.1 b. Power Range, Low Neutron Flux

c. Power Range, High Neutron Flux

2) Manual Trip Source Range Reactor a. RCCA Withdrawal from 1) Automatic Protection Neutron Flux Trip Subcritical a. Intermediate Range Flux USAR 14.4.1 b. Power Range, Low Neutron Flux

c. Power Range, High Neutron Flux

2) Manual Trip Overtemperature T Reactor a. Chemical and Volume 1) Automatic Protection Trip Control System a. Power Range, High Neutron Malfunction Flux USAR 14.4.4 b. Overpower T

2) Manual Trip

b. RCCA Misalignment 1) Automatic Protection (Dropped Rod) a. Power Range Neutron Flux USAR 14.4.3 Rate, High Negative Rate

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overpower T

d. Low Pressurizer Pressure

2) Manual Trip

c. Excessive Load 1) Automatic Protection Increase Incident a. Power Range, High Neutron USAR 14.4.7 Flux

b. Overpower T

2) Manual Trip

d. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, Low Neutron in a decrease in Flux feedwater temperature. b. Power Range, High Neutron USAR 14.4.6 Flux

c. Overpower T

2) Manual Trip

e. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, High Neutron in an increase in Flux feedwater flow. b. Power Range, Low Neutron USAR 14.4.6 Flux Page 67 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips

c. Overpower T

2) Manual Trip

f. Loss of External 1) Automatic Protection Electrical Load a. High Pressurizer Pressure USAR 14.4.9 b. High Pressurizer Level

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

g. Loss of Normal 1) Automatic Protection Feedwater a. High Pressurizer Pressure USAR 14.4.10 b. High Pressurizer Level

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

h. RCCA Withdrawal at 1) Automatic Protection Power a. Power Range, High Neutron USAR 14.4.2 Flux

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overpower T

d. High Pressurizer Pressure

e. High Pressurizer Level

2) Manual Trip

i. Steam Generator Tube 1) Automatic Protection Rupture a. Low Pressurizer Pressure USAR 14.5.4 b. Reactor Trip on Turbine Trip

2) Manual Trip Overpower T Reactor a. Chemical and Volume 1) Automatic Protection Trip Control System a. Power Range, High Neutron Malfunction Flux USAR 14.4.4 b. Overtemperature T

2) Manual Trip

a. RCCA Misalignment 1) Automatic Protection (Dropped Rod) a. Power Range Neutron Flux USAR 14.4.3 Rate, High Negative Rate

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overtemperature T

d. Low Pressurizer Pressure

2) Manual Trip Page 68 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips

b. Excessive Load 1) Automatic Protection Increase Incident a. Power Range, High Neutron USAR 14.4.7 Flux

b. Overtemperature T

2) Manual Trip

c. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, High Neutron in a decrease in Flux feedwater temperature. b. Power Range, Low Neutron USAR 14.4.6 Flux

c. Overtemperature T

2) Manual Trip

d. Feedwater system 1) Automatic Protection malfunctions that result a. Power Range, High Neutron in an increase in Flux feedwater flow. b. Power Range, Low Neutron USAR 14.4.6 Flux

c. Overtemperature T

2) Manual Trip

e. RCCA Withdrawal at 1) Automatic Protection Power a. Power Range, High Neutron USAR 14.4.2 Flux

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overtemperature T

d. High Pressurizer Pressure

e. High Pressurizer Level

2) Manual Trip

f. Rupture of a Steam 1) Automatic Protection Pipe a. Power Range, High Neutron USAR 14.5.5 Flux

b. Low Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

g. Start-up of Inactive 1) Automatic Protection Reactor Coolant Loop a. Power Range, Low Neutron USAR 14.4.5 Flux

2) Manual Trip Low Pressurizer Reactor a. RCCA Misalignment 1) Automatic Protection Pressure Trip (Dropped Rod) a. Power Range Neutron Flux USAR 14.4.3 Rate, High Negative Rate Page 69 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overtemperature T

d. Overpower T

2) Manual Trip

b. Loss of Coolant 1) Automatic Protection Accident a. Power Range, High Neutron USAR 14.6 Flux

b. Power Range, Low Neutron Flux

c. Steam Generator Water Level

- Low Low

d. Reactor Coolant Flow - Low

e. High Containment Pressure

2) Manual Trip

c. Steam Generator Tube 1) Automatic Protection Rupture a. Overtemperature T USAR 14.5.4 b. Reactor Trip on Turbine Trip

2) Manual Trip

d. Rupture of a Steam 1) Automatic Protection Pipe a. Power Range, High Neutron USAR 14.5.5 Flux

b. Overpower T

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip High Pressurizer Reactor a. Loss of External 1) Automatic Protection Pressure Trip Electrical Load a. Overtemperature T USAR 14.4.9 b. High Pressurizer Level

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

b. Loss of Normal 1) Automatic Protection Feedwater a. Overtemperature T USAR 14.4.10 b. High Pressurizer Level

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

c. RCCA Withdrawal at 1) Automatic Protection Page 70 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips Power a. Power Range, High Neutron USAR 14.4.2 Flux

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overtemperature T

d. Overpower T

e. High Pressurizer Level

2) Manual Trip Pressurizer Water Reactor a. Loss of External 1) Automatic Protection Level - High Trip Electrical Load a. Overtemperature T USAR 14.4.9 b. High Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

b. Loss of Normal 1) Automatic Protection Feedwater a. Overtemperature T USAR 14.4.10 b. High Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Reactor Trip on Turbine Trip

2) Manual Trip

c. RCCA Withdrawal at 1) Automatic Protection Power a. Power Range, High Neutron USAR 14.4.2 Flux

b. Power Range Neutron Flux Rate, High Positive Rate

c. Overtemperature T

d. Overpower T

e. High Pressurizer Pressure

2) Manual Trip Reactor Coolant Reactor a. Loss of All AC Power to 1) Automatic Protection Flow - Low Trip the Station Auxiliaries a. Steam Generator Water Level (LOOP) - Low Low USAR 14.4.11 b. Reactor Coolant Pump Undervoltage / Breaker Position

c. Reactor Coolant Pump Underfrequency / Breaker Position

2) Manual Trip

b. Loss of Coolant 1) Automatic Protection Accident a. Power Range, High Neutron Page 71 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips USAR 14.6 Flux

b. Power Range, Low Neutron Flux

c. Low Pressurizer Level

d. Steam Generator Water Level

- Low Low

e. High Containment Pressure

2) Manual Trip

c. Loss of Reactor Coolant 1) Automatic Protection Flow a. Reactor Coolant Pump USAR 14.4.8 Undervoltage / Breaker Position

b. Reactor Coolant Pump Underfrequency / Breaker Position

c. Reactor Trip on Turbine Trip

2) Manual Trip

d. Locked Pump Rotor 1) Manual Trip USAR 14.4.8.2 Loss of Reactor Reactor a. Loss of All AC Power to 1) Automatic Protection Coolant Pump - Trip the Station Auxiliaries a. Steam Generator Water Level Underfrequency / (LOOP) - Low Low Breaker Position USAR 14.4.11 b. Reactor Coolant Flow - Low

c. Reactor Coolant Pump Undervoltage / Breaker Position

2) Manual Trip

b. Loss of Reactor Coolant 1) Automatic Protection Flow a. Reactor Coolant Flow - Low USAR 14.4.8 b. Reactor Coolant Pump Undervoltage / Breaker Position

c. Reactor Trip on Turbine Trip

2) Manual Trip Loss of Reactor Reactor a. Loss of All AC Power to 1) Automatic Protection Coolant Pump - Trip the Station Auxiliaries a. Steam Generator Water Level Undervoltage on (LOOP) - Low Low 4 kV Buses 11 and USAR 14.4.11 b. Reactor Coolant Flow - Low 12 (21 and 22) c. Reactor Coolant Pump Underfrequency / Breaker Position

2) Manual Trip

b. Loss of Reactor Coolant 1) Automatic Protection Page 72 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips Flow a. Reactor Coolant Flow - Low USAR 14.4.8 b. Reactor Coolant Pump Underfrequency / Breaker Position

c. Reactor Trip on Turbine Trip

2) Manual Trip Steam Generator Reactor a. Loss of Normal 1) Automatic Protection Water Level - Low Trip Feedwater a. Overtemperature T Low USAR 14.4.10 b. High Pressurizer Level

c. High Pressurizer Pressure

d. Reactor Trip on Turbine Trip

2) Manual Trip

b. Rupture of a Steam 1) Automatic Protection Pipe a. Power Range, High Neutron USAR 14.5.5 Flux

b. Overpower T

c. Low Pressurizer Pressure

d. Reactor Trip on Turbine Trip

2) Manual Trip Turbine Trip Reactor a. Loss of Reactor Coolant 1) Automatic Protection Trip Flow a. Reactor Coolant Pump Flow -

USAR 14.4.8 Low

b. Reactor Coolant Pump Undervoltage / Breaker Position

c. Reactor Coolant Pump Underfrequency / Breaker Position

2) Manual Trip

b. Loss of External 1) Automatic Protection Electrical Load a. Overtemperature T USAR 14.4.9 b. High Pressurizer Pressure

c. High Pressurizer Level

d. Steam Generator Water Level

- Low Low

2) Manual Trip

c. Loss of Normal 1) Automatic Protection Feedwater a. Overtemperature T USAR 14.4.10 b. High Pressurizer Pressure

c. High Pressurizer Level

d. Steam Generator Water Level

- Low Low

2) Manual Trip Page 73 of 83

L-PI-20-026 NSPM Enclosure Table 18-1: RPS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips

d. Steam Generator Tube 1) Automatic Protection Rupture a. Overtemperature T USAR 14.5.4 b. Low Pressurizer Pressure

2) Manual Trip

e. Rupture of a Steam 1) Automatic Protection Pipe a. Power Range, High Neutron USAR 14.5.5 Flux

b. Overpower T

c. Low Pressurizer Pressure

d. Steam Generator Water Level

- Low Low

2) Manual Trip Safety Injection Reactor a. Loss of Coolant 1) Automatic Reactor Protection Input from Trip Accident a. Power Range, High Neutron Engineered Safety USAR 14.6 Flux Feature Actuation b. Power Range, Low Neutron System Flux

c. Low Pressurizer Pressure

d. Steam Generator Water Level

- Low Low

e. Reactor Coolant Low Flow

f. High Containment Pressure

2) Manual Trip

b. Rupture of a Steam 1) Automatic Reactor Protection Pipe a. Overpower T USAR 14.5.5 b. Low Pressurizer Pressure

c. Steam Generator Water Level

- Low Low

d. Power Range, High Neutron Flux

e. Reactor Trip on Turbine Trip

2) Manual Trip

c. Loss of Normal 1) Automatic Reactor Protection Feedwater a. Overtemperature T USAR 14.4.10 b. High Pressurizer Pressure

c. High Pressurizer Level

d. Steam Generator Water Level

- Low Low

e. Reactor Trip on Turbine Trip

2) Manual Trip Page 74 of 83

L-PI-20-026 NSPM Enclosure Table 18-2: ESFAS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips High Containment Safety a. Loss of Coolant 1) Automatic Reactor Protection Pressure Injection Accident a. Pressurizer Low Pressure USAR 14.6 2) Manual Safety Injection

b. Rupture of a Steam Pipe 1) Automatic Protection USAR 14.5.5 a. Low Pressurizer Pressure

b. Low Steam Line Pressure

2) Manual Safety Injection

c. Loss of Normal 1) Automatic Protection Feedwater a. Low Pressurizer Pressure USAR 14.4.10 2) Manual Safety Injection Pressurizer Low Safety a. Loss of Coolant 1) Automatic Protection Pressure Injection Accident a. High Containment Pressure USAR 14.6 2) Manual Safety Injection

b. Rupture of a Steam Pipe 1) Automatic Protection USAR 14.5.5 a. High Containment Pressure

b. Low Steam Line Pressure

2) Manual Safety Injection

c. Loss of Normal 1) Automatic Protection Feedwater a. High Containment Pressure USAR 14.4.10 2) Manual Safety Injection Steam Line Low Safety a. Rupture of a Steam Pipe 1) Automatic Protection Pressure Injection USAR 14.5.5 a. High Containment Pressure

b. Low Pressurizer Pressure

2) Manual Safety Injection High-High Containment a. Rupture of a Steam Pipe 1) Manual Containment Spray Containment Spray USAR 14.5.5 Pressure

b. Loss of Coolant 1) Manual Containment Spray Accident USAR 14.6 Containment a. Rupture of a Steam Pipe 1) Manual Containment Isolation Isolation USAR 14.5.5

b. Loss of Coolant 1) Manual Containment Isolation Accident USAR 14.6 Steam Line a. Rupture of a Steam Pipe 1) Automatic Protection Isolation USAR 14.5.5 a. High-High Steam Flow Coincident with High Steam Flow and Low-Low Tavg

b. High-High Steam Flow Page 75 of 83

L-PI-20-026 NSPM Enclosure Table 18-2: ESFAS Actuation Instrument Diversity Safety Function Function Plant Condition/Accident Diverse Reactor Trips Coincident with Safety Injection

2) Manual Steam Line Isolation

b. Loss of Coolant 1) Manual Steam Line Isolation Accident USAR 14.6 High Steam Flow Steam Line a. Rupture of a Steam Pipe 1) Automatic Protection Coincident with SI Isolation USAR 14.5.5 a. High Containment Pressure and Coincident with b. High-High Steam Flow Low-Low Tavg Coincident with Safety Injection

2) Manual Steam Line Isolation High-High Steam Steam Line a. Rupture of a Steam Pipe 1) Automatic Protection Flow Coincident Isolation USAR 14.5.5 a. High Containment Pressure with SI b. High-High Steam Flow Coincident with High Steam Flow and Low-Low Tavg

2) Manual Steam Line Isolation High-High Steam Feedwater a. Anticipated Transient 1) AMSAC - Auto and Manual Generator Water Isolation and Without SCRAM initiation Level Turbine Trip USAR 14.8 2) Diverse Scram from Rod Control

3) Manual Feedwater Isolation and Turbine Trip Steam Generator Auxiliary a. Loss of Normal 1) Automatic Protection Low-Low Water Feedwater Feedwater a. Trip of Both MFW Pumps Level Initiation USAR 14.4.10 b. AMSAC initiation

2) Manual Auxiliary Feedwater Initiation Undervoltage on 4 Auxiliary a. Loss of All AC Power to 1) Automatic Protection kV Buses 11 and 12 Feedwater the Station Auxiliaries a. Steam Generator Water Level (21 and 22) Initiation (LOOP) - Low Low USAR 14.4.11 2) Manual Auxiliary Feedwater Initiation Trip of Both MFW Auxiliary a. Loss of Normal 1) Automatic Protection Pumps Feedwater Feedwater a. Steam Generator Water Level Initiation USAR 14.4.10 - Low Low

2) Manual Auxiliary Feedwater Initiation NSPM Response to RAI 18.b Manual actions are defined in procedures to which PINGP operators are trained.

Page 76 of 83

L-PI-20-026 NSPM Enclosure RAI 19 - Design Success Criteria for TS 3.8.1 In Table E1-1 of Enclosure 1 of the LAR, the licensee stated that the design success criteria (DSC) for TS 3.8.1, Condition C - Two paths inoperable, are one qualified path to the grid for one safeguards bus. Describe the three independent paths/circuits with sufficient detail for the staff to understand how each path/circuit satisfies the design success criteria in terms of independence and capacity.

NSPM Response to RAI 19 The design success criteria for TS 3.8.1 was incorrectly specified in Table E1-1 of Enclosure 1 of the LAR. The design success criteria for T.S. 3.8.1, conditions A, B, C, and D is:

One of two paths between the transmission grid and onsite 4kV Safeguards Distribution System or one of two diesel generators capable of supplying the onsite 4kV Safeguards Distribution System.

Offsite power is supplied to the unit switchyard from the transmission network by five transmission lines. From the switchyard, electrically and physically separated paths provide AC power, through step down station auxiliary transformers, to the 4 kV safeguards buses. A path consists of all breakers, transformers, switches, cabling, and controls required to transmit power from the offsite transmission network to the safeguards buses. Each emergency diesel generator provides the third AC power source for each 4kV safeguards bus. The combination of multiple paths to the grid for each bus, emergency diesel generator for each bus, and two separate buses ensures the required independence and redundancy to ensure an available source of power.

See Attachment 1 to this Enclosure for the revised Table E1-1 that reflects this correction and supersedes that provided in Enclosure 1 of the LAR.

RAI 20 - RICT Estimates for Electrical TSs The LAR proposes a new TS requirement 5.5.18 Risk Informed Completion Time Program.

The proposed TS 5.5.18 states that This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, Risk-Managed Technical Specifications (RMTS) Guidelines. NEI 06-09-A, Revision 0, states the following regarding high risk configurations:

RMTS evaluations shall evaluate the instantaneous core damage frequency (CDF), instantaneous large early release frequency (LERF). If the SSC inoperability will be due to preplanned work, the configuration shall not be entered if the CDF is evaluated to be greater or equal than 10-3 events/year or the LERF is evaluated to be greater or equal to 10-4 events/year. If the SSC inoperability is due to an emergent event, if these limits are exceeded, the plant Page 77 of 83

L-PI-20-026 NSPM Enclosure shall implement appropriate risk management actions to limit the extent and duration of the high risk configuration.

NEI 06-09, Revision 0-A, prohibits voluntary entry into a high risk configuration but it allows entry in such configurations due to emergent events with implementation of appropriate risk management actions.

Table E1-2 of Enclosure 1 of the LAR provides RICT estimates for TS actions proposed to be in the scope of the RICT program. However, RICT estimates for TS 3.8.4.B, 3.8.4.C, 3.8.9.A, and TS 3.8.9.B are not provided. In addition, Note #2 of Table E1 2 states:

Several quantification results exceed the risk cap level of 1E-03 (CDF) or 1E-04 (LERF). Those LCOs are listed as No Entry given the quantified risk. However, it is possible that the LCO could be entered for a partial failure and would result in lower quantified risk. In a lower risk condition, entry into the RICT Program would be allowed.

This note appears to be inconsistent with NEI 06-09, Revision 0-A, which states that involuntary RICT entries into conditions of high instantaneous CDF or LERF would be also prohibited.

Address the following:

a) Clarify the intent of Note #2 and how NEI 06-09, Revision 0-A, will be followed regarding involuntary entries into high risk configurations.

b) Discuss the risk management actions that would be implemented for these TS conditions.

c) Provide RICT estimates for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B.

d) Note #2 states, it is possible that the LCO could be entered for a partial failure and would result in lower quantified risk. Provide a description of potential partial failures for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B.

NSPM Response to RAI 20.a The requirements of NEI 06-09 will be followed regarding involuntary entries into high risk configurations.

Note 2 was intended to explain that the calculated RICT estimate was conservative for the configuration and that less significant trains or sub-components within scope for the LCO could result in inoperable equipment but with a lower calculated risk, depending on what equipment was out of service.

Page 78 of 83

L-PI-20-026 NSPM Enclosure The RICT estimate for TS 3.8.4.B was based on the worst case of the four safeguards batteries out of service. The calculated risk varied significantly between the trains / units due to asymmetries in the PRA model caused by plant design. For example, the A train battery on both units exceeded the risk cap but the B train battery would have allowed a voluntary RICT entry. The worst case result was provided in the LAR.

The RICT estimates for TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B were calculated based on taking the main 4kV bus or DC panel out of service. The TSs in question apply to multiple components within the AC and DC distribution systems. A bus, MCC, or panel downstream of the main bus/panel would likely result in lower calculated risk because less equipment would be impacted. In this case, voluntary entry into a RICT may be possible depending on the magnitude of the calculated risk.

NSPM Response to RAI 20.b Risk-management actions implemented for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B would be dependent on the configuration at the time and which train/unit was impacted by the inoperable equipment. RMAs would include actions similar to those specified in LAR Enclosure 12 and would be very similar for all four LCOs due to the risk significance of the components involved.

TS 3.8.4.B (11 Battery inoperable example) RMAs:

Perform a walkdown to validate standby/readiness condition of the B train ECCS components for Unit 1.

Perform a walkdown and validation of both 11 & 12 AFW trains to validate standby/readiness condition.

Perform a walkdown of and confirm availability of applicable suppression, detection and fire barriers for Fire Area 20 (Unit 1 4.16 kV Safeguards Switchgear Bus 16)

Notify the transmission system operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Defer planned maintenance or testing.

TS 3.8.4.C and TS 3.8.9.B (DC Panel 11 inoperable example) RMAs

Perform a walkdown to validate standby/readiness condition of the B train ECCS components for Unit 1.

Perform a walkdown and validation of the 12 AFW train to validate standby/readiness condition.

Perform a walkdown of and confirm availability of applicable suppression, detection and fire barriers for the following Fire Areas:

o Fire Area 20 (Unit 1 4.16 kV Safeguards Switchgear Bus 16) o Fire Area 58 (Auxiliary Building Ground Floor)

Notify the transmission system operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Page 79 of 83

L-PI-20-026 NSPM Enclosure

Defer planned maintenance or testing.

TS 3.8.9.A (Bus 15 inoperable example) RMAs

Perform a walkdown to validate standby/readiness condition of the B train ECCS components for Unit 1.

Perform a walkdown and validation of the 12 AFW train to validate standby/readiness condition.

Perform a walkdown of and confirm availability of applicable suppression, detection and fire barriers for the following Fire Areas:

Fire Area 20 (Unit 1 4.16 kV Safeguards Switchgear Bus 16)

Fire Area 58 (Auxiliary Building Ground Floor)

Notify the transmission system operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Defer planned maintenance or testing.

NSPM Response to RAI 20.c RICT estimates have been re-calculated using the updated seismic penalty factor specified in RAI 12 and to support comparison to the sensitivity study described in RAI 8.b.i. The updated RICT estimates for TS 3.8.4.B, TS 3.8.4.C, TS 3.8.9.A, and TS 3.8.9.B are shown in the revised Table E1-2 provided in Attachment 2 to this Enclosure, which replaces Table E1-2 in the LAR.

NSPM Response to RAI 20.d See RAI 20.a for a clarification of the intent of Note 2.

RAI 21 - Electrical RMAs As part of its evaluation, the NRC staff reviews the proposed RMA examples for reasonable assurance that the RMAs are considered to monitor and control risk and to ensure adequate defense-in depth. The RMA examples should be TS condition specific. Provide RMA examples for the electric power systems TS conditions (TS 3.8.1, TS 3.8.4, and TS 3.8.9) described in the LAR.

NSPM Response to RAI 21 RMA examples for TS 3.8.1 were provided in Enclosure 12 of the LAR for the D1 EDG inoperable.

RMA examples for TS 3.8.4 were provided in Enclosure 12 of the LAR for the 11 Battery Charger inoperable. See RAI 20.b for additional examples of RMAs for the 11 Battery and DC Panel 11 inoperable.

Page 80 of 83

L-PI-20-026 NSPM Enclosure RMA examples for TS 3.8.9 were provided in RAI 20.b for both Bus 15 and DC Panel 11 inoperable.

3.0 REFERENCES

1. Letter (L-PI-19-031) from NSPM to the NRC, License Amendment Request:

Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF505, Revision 2, Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4b, dated December 16, 2019 (ADAMS Accession No. ML19350C188)

2. Letter from the Technical Specification Task Force (TSTF) to the NRC, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, Revision 2, dated July 2, 2018 (ADAMS Accession No. ML18183A493)

3. Email from the NRC to NSPM, Request for Additional Information RE: Prairie Island license amendment request to adopt TSTF-505 (EPID: L2019-LLA-0283), dated July 7, 2020 (ADAMS Accession No. ML20192A144)

4. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

5. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated May 2011 (ADAMS Accession No. ML100910006)

6. NRC Report NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, dated February 2007 (ADAMS Accession No. ML070650650)

7. NRC Report NUREG/CR-6890, Volume 1, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004, dated December 2005 (ADAMS Accession No. ML060200477)

8. NRC Report NUREG-1784, Operating Experience Assessment - Effects of Grid Events on Nuclear Power Plant Performance, dated December 2003 (ADAMS Accession No. ML033530400)

9. EPRI Interim Technical Report, Treatment of Loss of Offsite Power (LOOP) in Probabilistic Risk Assessments: Technical Basis and Guidelines, dated September 2009

10. EPRI Topical Report TR-1018243, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, Revision 2-A, dated October 31, 2008 Page 81 of 83

L-PI-20-026 NSPM Enclosure

11. NSPM PRA Document PRA-PI-LE, LERF Notebook Limited Level 2 (LERF) PRA, Revision 5.3, dated November 2017

12. NSPM PRA Document PRA-PI-QU, PRA Level 1 Quantification, Revision 5.3, dated November 2017

13. NRC Memorandum, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis, dated May 30, 2017 (ADAMS Accession No. ML17031A269)

14. Letter (L-PI-18-005) from NSPM to the NRC, License Amendment Request to Revise License Condition Associated with Implementation of NFPA 805, dated May 18, 2018 (ADAMS Accession No. ML18138A402)

15. Letter (L-PI-15-052) from NSPM to the NRC, License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactors -

Response to Request for Additional Information Day Responses (TAC Nos.

ME9734 and ME9735), dated June 19, 2015 (ADAMS Accession No. ML15174A139)

16. NSPM Report NSPLMI-96001, Prairie Island Nuclear Generating Plant Individual Plant Examination of External Events (IPEEE), NSPLMI-96001, Revision 1, dated September 1998

17. NRC Generic Letter GL 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f) (Generic Letter No. 88-20), dated November 23, 1988 (ADAMS Accession No. ML031150465)

18. Letter (L-PI-14-028) from NSPM to the NRC, PINGP Seismic Hazard and Screening Report (CEUS Sites), Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident, dated March 27, 2014 (ADAMS Accession No. ML14086A628)

19. Letter from the NRC to NSPM, Prairie Island Nuclear Generating Plant, Units 1 and 2 -

Staff Assessment of Information Provided Pursuant to Title 10 of the Code of Federal Regulations Part 50, Section 50.54(f), Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force (NTTF) Review of Insights from the Fukushima Dai-ichi Accident and Staff Closure of Activities Associated with NTTF Recommendation 2.1, Seismic (TAC Nos. MF3784 and MF3785, dated December 15, 2015 (ADAMS Accession No. ML15341A162)

20. NRC Generic Issue 199 (GI-199) Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, Safety/Risk Assessment, dated August 2010 (ADAMS Accession No. ML100270639)

Page 82 of 83

L-PI-20-026 NSPM Enclosure

21. Letter from EPRI to NEI, Fleet Seismic Core Damage Frequency Estimates for Central and Eastern U.S. Nuclear Power Plants Using New Site-Specific Seismic Hazard Estimates, dated March 11, 2014 (ADAMS Accession No. ML14080A589)

22. NSPM Calculation V.SPA.18.011, Prairie Island Re-Examination of External Events Evaluation in the IPEEE, Revision 0, dated June 6, 2018

23. NSPM letter (L-PI-16-039) to the NRC, Prairie Island Nuclear Generating Plant, Units 1 and 2, Response to March 12, 2012, Request for Information Enclosure 2, Recommendation 2.1, Flooding, Required Response 2, Flood Hazard Reevaluation Report, dated May 9, 2016 (ADAMS Accession No. ML16133A041)

24. Letter (L-PI-18-012) from NSPM to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, dated July 20, 2018 (ADAMS Accession No. ML18204A393)

25. EPRI Technical Report TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, dated December 2008

26. NSPM PRA Document PRA-PI-UN, Uncertainty Notebook, Revision 5.3, dated November 2017

27. NSPM PRA Document FPRA-PI-UNC, Uncertainty and Sensitivity Notebook, Revision 5.3, dated April 2019

28. EPRI Technical Report TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, dated December 2012

29. NSPM Calculation V.SPA.19.013, Prairie Island RICT Evaluation of Open F&Os and Uncertainties, Revision 1, dated August 21, 2020

30. Letter (L-PI-18-002) from NSPM to the NRC, License Amendment Request: Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated March 15, 2018 (ADAMS Accession No. ML18074A308)

31. NSPM Corporate Directive, CD 5.7, Probabilistic Risk Assessment Standard, Revision 5, dated June 2015

32. NSPM Fleet Procedure, FP-PE-PRA-01, PRA Change Database Use and Application Guide, Revision 9, dated October 2017

33. NSPM Fleet Procedure, FP-PE-PRA-02, PRA Guideline for Model Maintenance and Update, Revision 17, dated January 2017 Page 83 of 83

ENCLOSURE, ATTACHMENT 1 PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 Response to Request for Additional Information Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b UPDATED TABLE E1-1 (19 Pages Follow)

L-PI-20-026 NSPM Enclosure, Attachment 1 Revised Table E1-1 Table E1-1 provided with the LAR has been updated to reflect changes due to specific RAI responses in the preceding sections of the Enclosure. One additional change was made to 3.4.11.B design success criteria to align with the current licensing basis.

Changes from the version included in the LAR have been identified by change bars.

Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.1.B One Manual Two Manual Reactor Yes Reactor Trip One of two Manual Same (Note 4)

Reactor Trip Trip channels Initiation Reactor Trip channels channel (Mode 1 & 2) inoperable.

3.3.1.D One Power Four Power Range Yes Reactor Trip Two of four Power Same (Notes 1 and 2)

Range Neutron Neutron Flux-High Initiation Range Neutron Flux-Flux channel channels High channels inoperable. (Mode 1 & 2)

Two of four Power Four Power Range Range Neutron Flux-Neutron Flux-Low Low channels channels (Mode 1, below P-10 & Two of four Power

2) Range Neutron Flux High Positive Rate Four Power Range channels Neutron Flux High Positive Rate channels Two of four High (Mode 1 & 2) Negative Rate channels Four Power Range Neutron Flux High Negative Rate channels (Mode 1 & 2)

Page 1 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.1.E One channel Four Overtemperature Yes Reactor Trip Two of four Same (Notes 1 and 2) inoperable. T channels Initiation Overtemperature T (Mode 1 & 2) channels Four Overpower T Two of four channels Overpower T (Mode 1 & 2) channels Three Pressurizer Two of three Pressure High channels Pressurizer Pressure (Mode 1 & 2) High channels Three Steam Generator Two of three Steam Water Level - Low Low Generator Water channels per SG (Mode Level Low-Low 1 & 2) channels on either SG 3.3.1.K One channel Four Pressurizer Yes Reactor Trip Two of four Same (Notes 1 and 2) inoperable. Pressure Low channels Initiation Pressurizer Pressure (Mode 1, above P-7) Low channels Three Pressurizer Water Two of three Level - High channels Pressurizer Water (Mode 1, above P-7) Level - High channels Three Reactor Coolant Two of three Reactor Flow - Low channels Coolant Flow - Low per SG (Mode 1, above channels on either P8) RCS loop 3.3.1.L One or both Two Under-frequency Yes Reactor Trip One of two Under- Same for Under-voltage channel(s) channels per 4 kV Bus Initiation frequency channels on Under-voltage; channels are Page 2 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments inoperable on (Buses 11/12 and two of two buses Under- modeled, are one bus. 21/22) frequency is logically (Mode 1, above P-8) One of two Under- not directly equivalent, and voltage channels on modeled. have the same Two Under-voltage two of two buses component channels per 4 kV Bus failure rate and 11 and 12 (21 and 22) can be used as (Mode 1, above P-7) a surrogate.

3.3.1.M One Reactor One RCP Breaker Open Yes Reactor Trip One of two RCP The PRA Coolant Pump channel per RCP Initiation Breaker position conservatively Breaker Open Breaker channels (above P8) assumes that channel (Mode 1, above P-7) two of two inoperable. OR logic is always applicable, Two of two RCP regardless of Breaker Position power level.

channels (between P7 and P-8) 3.3.1.O One Turbine Three Low Autostop Oil Yes Reactor Trip Two of three Low Same Trip channel Pressure channels Initiation Autostop Oil Pressure inoperable. (Mode 1, above P-9) channels Two Turbine Stop Valve OR Closure channels (Mode 1, above P-9) Two of two Turbine Stop Valve Closure channels 3.3.1.Q One train Two Trains of Safety Yes Reactor Trip One of two trains of SI Same inoperable. Injection (SI) Input from Initiation Input from ESFAS Page 3 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments ESFAS (Mode 1 & 2) One of two trains of RTS Automatic Trip Two trains of RTS Logic Automatic Trip Logic (Mode 1 & 2) 3.3.1.R One RTB train Two trains of Reactor Yes Reactor Trip One of two RTB trains Same (Note 5) inoperable. Trip Breakers and Initiation Bypass Breakers (Mode 1 & 2) 3.3.1.V One trip One Reactor Trip Yes Reactor Trip One trip mechanism Same (Note 4) mechanism Breaker Undervoltage Initiation Undervoltage inoperable for Mechanism and One and shunt trip one RTB. Shunt Trip Mechanism are within the per RTB component (Mode 1 & 2) boundary of the RTB, which is modeled.

3.3.2.B One channel or SI Function: Yes ESF Actuation SI Function: SI Function: Manual SI can train inoperable. Two SI Manual Initiation One of two SI Manual Same be used as a channels Initiation channels surrogate for (Mode 1 & 2) CI Function: Manual CI since CI Function: Not directly SI signal Containment Isolation One of two CI Manual modeled. generates CI (CI) Function: Initiation channels signal.

Two CI Manual Initiation channels (Mode 1 & 2) 3.3.2.C One train SI Function: Yes ESF Actuation SI Function: SI Function: Hydraulic Page 4 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments inoperable. Two SI Automatic One of two SI Same analysis has Actuation Logic trains Automatic Actuation been performed (Modes 1 & 2) Logic trains which shows that CS success CS Function: CS Function: CS Function: or failure does Two CS Automatic One of two SI Not directly not impact which Actuation Logic trains Automatic Actuation modeled. CS is sequences (Modes 1 & 2) Logic trains screened out contribute to of the PRA. LERF.

CI Function: CI Function:

Two CI Automatic One of two CI CI Function:

Actuation Logic trains Automatic Actuation Same (Modes 1 & 2) Logic trains 3.3.2.D One channel SI Function: Yes ESF Actuation SI Function: Same (Note 2) inoperable. Three High Containment SLI Two of three High The High-High Pressure channels AFW pump start Containment Pressure Containment (Mode 1 & 2) channels Pressure channels are not Three Pressurizer Low Two of three currently Pressure channels Pressurizer Low modeled in PRA, (Mode 1 & 2) Pressure channels but will be added prior to Three Steam Line Low Two of three Steam implementation Pressure channels per Line Low Pressure of the RICT steam line (Mode 1 & 2) channels per steam Program (see line Attachment 5 of Steam Line Isolation this LAR).

(SLI) Function: SLI Function:

Three High-High Two of three High-Containment Pressure High Containment Page 5 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments channels (Mode 1; Pressure channels Mode 2, except when both Main Steam One of two High Isolation Valves (MSIVs) Steam Flow channels are closed) per steam line coincident with SI Two High Steam Flow Function (see above) channels per steam line, and coincident with SI Function channels two of four Low-Low (see above), and four RCS Tavg channels Low-Low Reactor Coolant System (RCS) One of two High-High Tavg channels (Mode 1; Steam Flow channels Mode 2, except when per steam line both MSIVs are closed coincident with SI Function (see above)

Two High-High Steam Flow Channels per AFW Function:

steam line and SI Two of three Low-Low Function channels (see SG Water Level above) (Mode 1; Mode channels on one of 2, except when both two SGs.

MSIVs are closed)

Auxiliary Feedwater (AFW) Function:

Three Low-Low SG Water Level channels per SG (Mode 1 & 2)

Page 6 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.2.E One or more CS Function: Yes CS CS Function: CS Function: Hydraulic Containment Six (three sets of two) One of two High-High Not directly analysis has Pressure High-High Containment Containment Pressure modeled. CS is been performed channel(s) Pressure channels channels in three of screened out which shows inoperable. (Mode 1 & 2) three sets of the PRA. that CS success or failure does not impact which sequences contribute to LERF.

3.3.2.F One channel or SLI Function: Yes SLI SLI Function: Same train inoperable. Two Manual Initiation One of two Manual channels Initiation channels (Mode 1; Mode 2, (switches and except when both associated logic)

MSIVs are closed) 3.3.2.G One train SLI Function: Yes SLI and SLI Function: Same inoperable. Two trains of Automatic Feedwater One of two SI Actuation Relay Logic Isolation Automatic Actuation (Mode 1; Mode 2, Logic trains except when both MSIVs are closed) Feedwater Isolation Function:

Feedwater Isolation One of two SI Function: Automatic Actuation Two trains of Automatic Logic trains Actuation Relay Logic (Mode 1; Mode 2, except when all Main Feedwater Regulation Page 7 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Valves (MFRV) and MFRV bypass valves are closed and de-activated or isolated by closed manual valve) 3.3.2.H One channel Feedwater Isolation Yes Feedwater Feedwater Isolation Same inoperable. Function: Isolation Function:

Three High-High Steam Two of three High-Generator Water Level High SG Water Level channels per SG channels per SG (Mode 1; Mode 2, except when all Main Feedwater Regulation Valves (MFRV) and MFRV bypass valves are closed and de-activated or isolated by closed manual valve) 3.3.2.I One or both AFW Function: Yes AFW pump start AFW Function: Same channel(s) Two Undervoltage One of two inoperable on channels per 4 kV Bus Undervoltage one bus. (Buses 11/12 and channels on two of 21/22) two buses (Mode 1 & 2) 3.3.4.C One required One Automatic Load Yes 4 kV bus load One of two load Same automatic load Sequencer per 4 kV Bus shedding, sequencers for one of sequencer (Buses 11/12 and sequencing, and two 4kV Buses inoperable. 21/22) Diesel Generator (Mode 1 & 2) start Page 8 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.4.9.B One group of Two Groups of Yes RCS Subcooling One of two groups of One out of five Modeled for pressurizer safeguards powered Margin safeguards powered groups (two long-term heaters Pressurizer Heaters pressurizer heaters, safeguards secondary inoperable. (Mode 1 & 2) with a capacity of powered; three cooling success

>100kW non- only.

safeguards powered) of pressurizer heaters under normal conditions. If offsite power is lost, the PRA success criterion is the same as design success criterion.

3.4.11.B One PORV Two Pressurizer Power Yes RCS One of Two PORVs Same Manual PORV inoperable and Operated Relief Valves depressurization, operation not capable of (PORVs) feed and bleed credited for feed being manually (Mode 1 & 2) and bleed cycled. cooling and cooldown and depressurization after a small loss of coolant accident (SLOCA) or a Page 9 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments steam generator tube rupture (SGTR).

3.4.11.C One block valve Two Pressurizer PORV Yes Isolate Two PORV block Same inoperable. block valves associated valves closable (Mode 1 & 2) PORV 3.5.2.A One or more Two ECCS trains (SI Yes Emergency RCS With One Train Same trains and RHR in each train) makeup via Inoperable:

inoperable. (Mode 1 & 2) injection from the One of two SI pumps RWST to the and one of two RHR cold legs and pumps OPERABLE; upper plenum, and recirculation One or More Pumps from the Inoperable:

containment Two of two SI and/or sump to the two of two RHR upper plenum or pumps inoperable, but the SI pump with a capability suction. equivalent to 100%

of a single OPERABLE ECCS train.

3.6.2.C One or more Containment Airlocks Yes Containment One of two Same containment air (Mode 1 & 2) Integrity containment air lock locks inoperable doors closed with for reasons acceptable other than containment leakage Condition A or per LCO 3.6.1 B.

Page 10 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.6.3.A One or more Two containment Yes Containment One of two isolation Same, for Only penetration flow isolation valves per boundary and valves per penetration modeled penetrations that paths with one penetration minimization of penetrations. can contribute to containment (Mode 1 & 2) RCS inventory LERF are isolation valve loss modeled inoperable for reasons other than Condition D.

3.6.3.C One or more One containment Yes Containment One of one isolation Same Only penetration flow isolation valve per boundary and valve per penetration penetrations that paths with one penetration minimization of can contribute to containment (Mode 1 & 2) RCS inventory LERF are isolation valve loss modeled inoperable.

3.6.5.A One Two Containment Spray No Containment One of two None Hydraulic containment trains cooling via containment spray analysis has spray train (Mode 1 & 2) injection from the trains and one of four been performed inoperable. RWST to the containment fan coil to show that containment units (FCU) success or spray headers. failure does not impact which sequences contribute to LERF.

3.6.5.C One or both Two Containment Fan No Containment One of two None Hydraulic containment Coil trains (two FCUs cooling via heat containment spray analysis has cooling fan coil per train) transfer from the trains and one of four been performed unit(s) (FCU) in (Mode 1 & 2) atmosphere to containment fan coil to show that Page 11 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments one train the cooling water units (FCU) success or inoperable. system. failure does not impact which sequences contribute to LERF.

3.6.5.D One Two Containment Fan No Containment One of two None Hydraulic containment Coil trains (two FCUs cooling via heat containment spray analysis has cooling FCU in per train) transfer from the trains and one of four been performed each train (Mode 1 & 2) atmosphere to containment fan coil to show that inoperable. the cooling water units (FCU) success or system. failure does not impact which sequences contribute to LERF.

3.7.2.A One MSIV Two Main Steam Yes Isolate Main One of two MSIVs Same inoperable in Isolation Valves (MSIVs) Steam Lines MODE 1. (one MSIV per steam line)

(Mode 1; Mode 2 except when both MSIVs are closed) 3.7.4.A One SG PORV Steam Generator Power Yes Pressure relief One of two SG Pressure Relief:

line inoperable. Operated Relief Valves and plant PORVs The SG PORVs, (PORV) cooldown steam dump to (Mode 1 & 2) condenser, and MSSVs are all credited in the Page 12 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments PRA for steam relief to support secondary cooling.

Plant Cooldown:

The SG PORVs and steam dump to condenser are credited in the PRA for plant cooldown.

3.7.5.A One steam Two steam supplies to Yes Supply steam to One of two steam Same supply to the turbine driven AFW support TDAFW flowpaths from the turbine driven (TDAFW) pump pump operation SGs to the TDAFW AFW pump (Mode 1 & 2) pump inoperable.

3.7.5.B One AFW train Two AFW trains each Yes Supply One of two AFW trains Non-ATWS:

inoperable in comprised of one pump feedwater to (pumps or flow path) One of two MODE 1, 2, or 3 (one containing a motor steam supplying feedwater to AFW pumps for reasons driven AFW pump and generators to both SGs supplying other than the other a TDAFW remove RCS feedwater to Condition A. pump), piping, valves, decay heat one of two and controls SGs.

(Mode 1 & 2)

ATWS: One of two AFW pumps supplying feedwater to Page 13 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments two of two SGs.

3.7.7.A One CC train Two CC trains each Yes Heat sink for One of two CC trains Same inoperable. comprised of one pump removing with associated surge process and tank, piping, valves, operating heat heat exchanger, from safety instrumentation, and related controls components (Mode 1 & 2) 3.7.8.A No safeguards Two diesel-driven CL Yes Supply cooling One of two DDCLPs Varies; see CL pumps pumps (DDCLPs) and water to the CL (or 121 MDCLP, if Section 2.4.7 OPERABLE for one motor-driven CL pump discharge aligned as a of Attachment one train. pump (121 MDCLP) header safeguards 1 of this LAR (Mode 1 & 2) replacement) 3.7.8.B One CL supply Two CL supply headers Yes Supply cooling One of two supply Same header each consisting of water to safety- headers inoperable. piping, pumps, valves, related instrumentation, and equipment and controls equipment for (Mode 1 & 2) safe shutdown 3.8.1.A One required Two paths consisting of Yes Provide power One of two paths Same (Note 7) path inoperable. all breakers, from offsite between the The PRA model transformers, switches, transmission transmission grid and does not include cabling, and controls to network to onsite onsite 4kV Safeguards components transmit power from the safeguards Distribution System or upstream of the transmission network to buses one of two diesel 4kV bus source the safeguards bus(es). generators capable of breaker. The (Mode 1 & 2) supplying the onsite loss of a path to Page 14 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 4kV Safeguards the grid can be Distribution System modeled by failing applicable source breaker(s) open.

3.8.1.B One DG Two DGs capable of Yes Provide power to One of two paths Same (Note 7) inoperable. supplying onsite safeguards between the PRA success safeguards bus(es). buses when transmission grid and criteria also (Mode 1 & 2) offsite power to onsite 4kV Safeguards includes credit them is lost Distribution System or for re-powering one of two diesel buses through generators capable of the cross-tie to supplying the onsite the opposite unit 4kV Safeguards in some Distribution System circumstances.

3.8.1.C Two paths Two paths consisting of Yes Provide power One of two paths Same (Note 7) inoperable. all breakers, from offsite between the The PRA model transformers, switches, transmission transmission grid and does not include cabling, and controls to network to onsite onsite 4kV Safeguards components transmit power from the safeguards Distribution System or upstream of the transmission network to buses one of two diesel 4kV bus source the safeguards bus(es) generators capable of breaker. The (Mode 1 & 2) supplying the onsite loss of a path to 4kV Safeguards the grid can be Distribution System modeled by locking applicable source breaker(s) open.

Page 15 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.8.1.D One path Two paths consisting of Yes Provide power to One of two paths Same (Note 7) inoperable. all breakers, safeguards between the transformers, switches, buses when transmission grid and AND cabling, and controls to offsite power to onsite 4kV Safeguards transmit power from the them is lost Distribution System or One DG transmission network to one of two diesel inoperable. the safeguards bus(es) generators capable of and two DGs capable of supplying the onsite supplying onsite 4kV Safeguards safeguards bus(es). Distribution System (Mode 1 & 2) 3.8.4.A One battery Two battery chargers Yes Ensure One battery charger Same charger (one per DC safeguards availability of for one of two DC inoperable. electrical power required DC trains subsystem train) power to shut (Mode 1 & 2) down the reactor and maintain it in a safe condition 3.8.4.B One battery Two DC batteries (one Yes Ensure Battery for one of two Battery for one inoperable. per DC safeguards availability of DC trains with of two DC electrical power required DC capacity to carry trains with subsystem train) power to shut expected shutdown capacity to (Mode 1 & 2) down the reactor loads for a period of 1 carry SBO and maintain it in hour. loads for a a safe condition period of 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months 3.8.4.C One DC Two DC electrical power Yes Ensure One of two DC trains Same electrical power subsystems each availability of subsystem consisting of one DC required DC Page 16 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments inoperable for battery, one battery power to shut reasons other charger, cabling, and down the reactor than Condition controls and maintain it in A or B. (Mode 1 & 2) a safe condition 3.8.7.A One Reactor Four inverters per unit Yes Ensure One of four reactor Same Protection (Mode 1 & 2) availability of protection inverters Instrument AC required DC inverter power to shut inoperable. down the reactor and maintain it in a safe condition 3.8.9.A One or more Two safeguards AC Yes Provide AC At least one of two AC Same safeguards AC electrical power power for vital power subsystems electrical power distribution subsystems buses available distribution with buses and MCCs subsystems energized to proper inoperable. voltage (Mode 1 & 2) 3.8.9.B One or more Two safeguards DC Yes Provide DC At least one of two DC Same safeguards DC electrical power power for vital power subsystems electrical power distribution subsystems panels available distribution with panels energized to subsystems proper voltage inoperable. (Mode 1 & 2) 3.8.9.C One Reactor Four Reactor Protection Yes Provide At least one of four Same Protection Instrument AC power regulated AC Reactor Protection Instrument AC distribution panels power for Instrument panels panel energized to proper instrument available inoperable. voltage panels Page 17 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments (Mode 1 & 2)

Table E1-1 Notes:

1. The reactor protection system is segmented into four distinct but interconnected modules: field transmitters and process sensors, instrumentation current loops, reactor protection bistables, and reactor trip relays. Field transmitters provide measurements of the unit parameters to the Reactor Protection System via separate, redundant channels. The reactor protection bistables determine when applicable sensor setpoints are reached. The reactor trip relays are actuated by the bistables and determine whether the applicable 2/4 or 2/3 logic is satisfied to generate a reactor trip. The reactor trip signal consists of two redundant trains, to initiate a reactor trip or actuate Engineering Safety Functions.

2. Depending on the measured parameter, three or four instrumentation channels are provided to ensure protective action when required and to prevent inadvertent isolation resulting from instrumentation malfunctions. The output trip signal of each instrumentation channel initiates a trip logic. Failure of any one trip logic does not result in an inadvertent trip. Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If a parameter is used for input to the reactor protection system and a control function, four channels with a two-out-of-four logic are sufficient.

3. Each instrumentation channel provides input to both trains of the reactor protection system, which initiates a reactor trip on one-out-of-two logic. Each reactor protection system train provides input to the Reactor Trip Breakers (RTBs) by de-energizing the RTB undervoltage coils, which trips open the RTBs, tripping the reactor. One-out-of-two open RTBs will trip the reactor.

4. Each RTB is equipped with a shunt trip device that is energized to trip the RTB open upon receipt of a manual reactor trip signal, thus providing a redundant and diverse trip mechanism. Two Manual Reactor Trip channels provide the signal from reactor trip switches located in the Main Control Room to the RTBs.

5. A trip breaker train consists of all trip breakers associated with a single Reactor Trip System logic train that are racked in, closed, and capable of supplying power to the Rod Control System.

6. PRA Success Criteria for bleed and feed cooling requires 1 SI pump and 1 PORV. Each PORV requires power from its respective DC power subsystem to perform its safety function for feed and bleed.

Page 18 of 19

L-PI-20-026 NSPM Enclosure, Attachment 1 Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function PINGP PINGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments

7. The safeguards 4 kV Buses 15 and 16 serve engineered safety feature auxiliaries on Unit 1, and Buses 25 and 26 serve similar functions on Unit 2. The electrical loading of the safeguards 4 kV buses at PINGP is asymmetric, primarily for the loading of the 12 and 21 AFW pumps and the 121 MDCLP. The 12 AFW pump is powered from Bus 16 and the 21 AFW pump is powered from Bus

25. In addition, the 121 MDCLP is powered by Unit 2 safeguards Bus 27, which is supplied by either Unit 2 4 kV safeguards Bus 25 or Bus 26. The PINGP 4 kV safeguards buses have been analyzed which confirmed that the Unit 1 and 2 safeguards DGs are adequately sized to supply safe shutdown loads with one unit in LOOP conditions and the other in SBO conditions.

Page 19 of 19

ENCLOSURE, ATTACHMENT 2 PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 Response to Request for Additional Information Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b UPDATED TABLE E1-2 (3 Pages Follow)

L-PI-20-026 NSPM Enclosure, Attachment 2 Revised Table E1-2 RICTs were calculated for both units and both trains when applicable and the most limiting RICT is specified in the Table E1-2. Results were generally similar between Unit 1 and Unit 2.

Following implementation of the RICT Program, the actual RICT values will be calculated on a unit-specific basis, using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09A, Revision 0 and the NRC Final Safety Evaluation.

RICTs are based on the internal events (including internal flooding) and internal fire PRA model calculations with seismic CDF and LERF penalties. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A, Revision 0. RICTs not capped at 30 days are rounded to nearest number of days.

Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.3.1.B One Manual Reactor Trip channel inoperable. 30 Days 3.3.1.D One Power Range Neutron Flux channel inoperable. 30 Days 3.3.1.E One channel inoperable. 30 Days 3.3.1.K One channel inoperable. 30 Days 3.3.1.L One or both channel(s) inoperable on one bus. 30 Days 3.3.1.M One Reactor Coolant Pump Breaker Open channel inoperable. 21 Days 3.3.1.O One Turbine Trip channel inoperable. 30 Days 3.3.1.Q One train inoperable. 30 Days 3.3.1.R One RTB train inoperable. 30 Days 3.3.1.V One trip mechanism inoperable for one RTB. 30 Days 3.3.2.B One channel or train inoperable. 30 Days 3.3.2.C One train inoperable. 30 Days 3.3.2.D One channel inoperable. 30 Days 3.3.2.E One or more Containment Pressure channel(s) inoperable. 30 Days(1) 3.3.2.F One channel or train inoperable. 30 Days 3.3.2.G One train inoperable. 30 Days 3.3.2.H One channel inoperable. 30 Days 3.3.2.I One or both channel(s) inoperable on one bus. 30 Days 3.3.4.C One required automatic load sequencer inoperable. 11 Days 3.4.9.B One group of pressurizer heaters inoperable. 20 Days 3.4.11.B One PORV inoperable and not capable of being manually cycled. 25 Days Page 1 of 3

L-PI-20-026 NSPM Enclosure, Attachment 2 Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.4.11.C One block valve inoperable. 30 Days 3.5.2.A One or more trains inoperable. 14 Days 3.6.2.C One or more containment air locks inoperable for reasons other 30 Days than Condition A or B.

3.6.3.A One or more penetration flow paths with one containment isolation 30 Days valve inoperable for reasons other than Condition D.

3.6.3.C One or more penetration flow paths with one containment isolation 30 Days valve inoperable.

3.6.5.A One containment spray train inoperable. 30 Days(1) 3.6.5.C One or both containment cooling fan coil unit(s) (FCU) in one train 30 Days(1) inoperable.

3.6.5.D One containment cooling FCU in each train inoperable. 30 Days(1) 3.7.2.A One MSIV inoperable in MODE 1. 30 Days 3.7.4.A One SG PORV line inoperable. 30 Days 3.7.5.A One steam supply to turbine driven AFW pump inoperable. 12 Days 3.7.5.B One AFW train inoperable in MODE 1, 2, or 3 for reasons other 12 Days than Condition A.

3.7.7.A One CC train inoperable. 6 Days 3.7.8.A No safeguards CL pumps OPERABLE for one train. 29 Days 3.7.8.B One CL supply header inoperable. 6 Days 3.8.1.A One required path inoperable. 30 Days 3.8.1.B One DG inoperable. 30 Days 3.8.1.C Two paths inoperable. 5 Days 3.8.1.D One path inoperable.

AND 9 Days One DG inoperable.

3.8.4.A One battery charger inoperable. 27 Days 3.8.4.B One battery inoperable. 1 Day(2)

(No Voluntary Entry) 3.8.4.C One DC electrical power subsystem inoperable for reasons other 3 Hours than Condition A or B. (No Voluntary Entry)(2) 3.8.7.A One Reactor Protection Instrument AC inverter inoperable. 30 Days Page 2 of 3

L-PI-20-026 NSPM Enclosure, Attachment 2 Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.8.9.A One or more safeguards AC electrical power distribution 4 Hours subsystems inoperable. (No Voluntary Entry)(2)

(8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months front stop) 3.8.9.B One or more safeguards DC electrical power distribution 3 Hours subsystems inoperable. (No Voluntary Entry)(2) 3.8.9.C One Reactor Protection Instrument AC panel inoperable. 30 Days Table E1-2 Notes:

1. Performance of a hydraulic analysis has shown that success or failure of the Containment Spray and/or FCUs does not impact which sequences contributed to LERF. Therefore, there is no risk impact to removing them from service.

2. Several quantification results exceed the risk cap level of 1E-03 (CDF) or 1E-04 (LERF). Those LCOs are listed as No Voluntary Entry given the quantified risk. However, it is possible that the LCO could be entered for an emergent failure and RICT entry would be allowed.

Page 3 of 3

ENCLOSURE, ATTACHMENT 3 PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 Response to Request for Additional Information Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b UPDATED TS MARKUPS (49 Pages Follow)

INSERT EXAMPLE 1.3-8 EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore subsystem 7 days subsystem to OPERABLE inoperable. status. OR In accordance with the Risk Informed Completion Time Program B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned

changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

INSERT RICT 1 OR In accordance with the Risk Informed Completion Time Program

INSERT RICT 2 OR

NOTE------

Not applicable when more than one channel inoperable on one bus.

In accordance with the Risk Informed Completion Time Program INSERT RICT 3 OR

NOTE------

Not applicable when THERMAL POWER is below P-8 and above P-7.

In accordance with the Risk Informed Completion Time Program

INSERT RICT 4 OR

NOTE------

Not applicable to Function 2.a.

In accordance with the Risk Informed Completion Time Program INSERT TS 3.3.1 Condition N N. Required Action and N.1 Reduce THERMAL 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion POWER to < P-7 and P-8.

Time of Condition K, L, or M not met.

INSERT TS 3.3.1 Condition P P. Required Action and P.1 Reduce THERMAL 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion POWER to < P-9.

Time of Condition O not met.

INSERT TS 3.3.1 Condition U U. Required Action and U.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition T not met.

INSERT TS 3.3.1 Condition W W. Required Action and W.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition B, D, E, Q, R, S, or V not met.

INSERT TS 3.3.2 Condition L L. Required Action and L.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Conditions B AND or C not met.

L.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months INSERT TS 3.3.2 Condition M M. Required Action and M.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Conditions D, AND E, F, or G not met.

M.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

INSERT TS 3.3.2 Condition N N. Required Action and N.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition H or I not met.

INSERT RICT Program 5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines."

The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODES 1 and 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

INSERT RICT Program 5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines."

The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODES 1 and 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required If the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2),

Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the INSERT Completion Time for Required Action A.2 has not expired.

EXAMPLE 1.3-8 IMMEDIATE When Immediately is used as a Completion Time, the Required COMPLETION Action should be pursued without delay and in a controlled manner.

TIME Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 1.3-15 Unit 2 - Amendment No. 215

RTS Instrumentation 3.3.1 3.3 INSTRUMENTATION 3.3.1 Reactor Trip System (RTS) Instrumentation LCO 3.3.1 The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1-1.

ACTIONS

NOTE--------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Enter the Condition Immediately with one or more referenced in Table 3.3.1-1 required channels or for the channel(s) or train(s).

trains inoperable.

B. One Manual Reactor B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Trip channel OPERABLE status.

inoperable. INSERT OR RICT 1 B.2 Be in MODE 3. 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-1 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One channel or train C.1 Restore channel or train to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months inoperable. OPERABLE status.

OR C.2.1 Initiate action to fully insert 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months all rods.

AND C.2.2 Place the Rod Control 49 hours5.671296e-4 days 0.0136 hours 8.101852e-5 weeks 1.86445e-5 months System in a condition incapable of rod withdrawal.

D. One Power Range ----------------NOTE---------------

Neutron Flux channel The inoperable channel may be inoperable. bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing and setpoint adjustment of other channels.

D.1.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-2 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.1.2 ------------NOTE------------

Only required to be performed when THERMAL POWER is

> 85% RTP and the Power Range Neutron Flux input to QPTR is inoperable.

Perform SR 3.2.4.2. Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR D.2 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. One channel inoperable. ----------------NOTE---------------

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

E.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT OR RICT 1 E.2 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 3.3.1-3 Unit 2 - Amendment No. 149 TBD

RTS Instrumentation 3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME K. One channel inoperable. -----------------NOTE----------------

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

K.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR INSERT RICT 1 K.2 Reduce THERMAL 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months POWER to < P-7 and P-8.

L. One or both channel(s) -----------------NOTE----------------

inoperable on one bus. One inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

L.1 Place channel(s) in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT OR RICT 2 L.2 Reduce THERMAL 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months POWER to < P-7 and P-8.

Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-6 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME M. One Reactor Coolant M.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Pump Breaker Open OPERABLE status.

channel inoperable. INSERT OR RICT 3 M.2 Reduce THERMAL 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months POWER to < P-7 and P-8.

INSERT TS 3.3.1 Condition N N. One Turbine Trip -----------------NOTE----------------

channel inoperable The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for Administrative O surveillance testing of other change - add channel(s).

period.

N.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months O

OR INSERT RICT 1 N.2 Reduce THERMAL 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months POWER to < P-9.

INSERT TS 3.3.1 Condition P Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-7 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME O. One train inoperable. -----------------NOTE----------------

One train may be bypassed for up Q to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

O.1 Restore train to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Q OPERABLE status.

INSERT OR RICT 1 O.2 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months P. One RTB train ----------------NOTES---------------

inoperable. 1. One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for R

surveillance testing, provided the other train is OPERABLE.

2. One RTB may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for maintenance on undervoltage or shunt trip mechanisms, provided the other train is OPERABLE.

P.1 Restore train to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months R

OPERABLE status.

INSERT OR RICT 1 P.2 Be in MODE 3. 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-8 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME Q. One or more channels Q.1 Verify interlock is in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. S required state for existing unit conditions.

S OR Q.2 Be in MODE 3. 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months R. One or more channels R.1 Verify interlock is in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. T required state for existing unit conditions.

T OR R.2 Be in MODE 2. 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months INSERT TS 3.3.1 Condition U S. One trip mechanism S.1 Restore inoperable trip 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months inoperable for one RTB. mechanism to OPERABLE V V status. INSERT RICT 1 OR S.2 Be in MODE 3. 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months INSERT TS 3.3.1 Condition W Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-9 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 4 of 8)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

14. Turbine Trip

a. Low Autostop Oil 1(g) 3 N SR 3.3.1.10 > 45 psig Pressure SR 3.3.1.15 O

b. Turbine Stop 1(g) 2 N SR 3.3.1.10 Closed Valve Closure SR 3.3.1.15 O

15. Safety Injection (SI) 1, 2 2 trains O SR 3.3.1.14 NA Input from Engineered Safety Feature Q Actuation System (ESFAS)

(g) Above the P-9 (Power Range Neutron Flux) interlock.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 3.3.1-20 Unit 2 - Amendment No. 149 TBD

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 5 of 8)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

16. Reactor Trip System Interlocks

a. Intermediate 2(d) 2 Q SR 3.3.1.11 > 1.0E-10 amp Range Neutron SR 3.3.1.13 Flux, P-6 S

b. Low Power Reactor Trips Block, P-7

1. Power Range 1 4 R SR 3.3.1.11 < 12% RTP Neutron Flux SR 3.3.1.13 T

2. Turbine Impulse 1 2 R SR 3.3.1.7 < 12% Full Pressure SR 3.3.1.10 Load T

c. Power Range 1 4 R SR 3.3.1.11 < 11% RTP Neutron Flux, P-8 SR 3.3.1.13 T

d. Power Range 1 4 R SR 3.3.1.11 < 12% RTP Neutron Flux, P-9 SR 3.3.1.13 T

e. Power Range 1, 2 4 Q SR 3.3.1.11 > 9% RTP Neutron Flux, P-10 SR 3.3.1.13 S

17. Reactor Trip 1, 2 2 trains P SR 3.3.1.4 NA Breakers(h) (RTBs) R 3(a), 4(a), 5(a) 2 trains C SR 3.3.1.4 NA (a) With Rod Control System capable of rod withdrawal or one or more rods not fully inserted.

(d) Below the P-6 (Intermediate Range Neutron Flux) interlocks.

(h) Including any reactor trip bypass breakers that are racked in and closed for bypassing an RTB.

Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-21 Unit 2 - Amendment No. 149

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 6 of 8)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

18. Reactor Trip Breaker 1, 2 1 each per S SR 3.3.1.4 NA Undervoltage and Shunt RTB V Trip Mechanisms 3(a), 4(a), 5(a) 1 each per C SR 3.3.1.4 NA RTB

19. Automatic Trip Logic 1, 2 2 trains O SR 3.3.1.5 NA Q

3(a), 4(a), 5(a) 2 trains C SR 3.3.1.5 NA (a) With Rod Control System capable of rod withdrawal or one or more rods not fully inserted.

Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.1-22 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 3.3 INSTRUMENTATION 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation LCO 3.3.2 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.2-1.

ACTIONS

NOTE--------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Enter the Condition Immediately with one or more referenced in Table 3.3.2-1 required channels or for the channel(s) or trains inoperable. train(s).

B. One channel or train B.1 Restore channel or train to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months inoperable. OPERABLE status.

INSERT OR RICT 4 B.2.1 Be in MODE 3. 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months AND B.2.2 Be in MODE 5. 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-1 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One train inoperable. -----------------NOTE----------------

One train may be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

C.1 Restore train to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OPERABLE status.

INSERT OR RICT 1 C.2.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND C.2.2 Be in MODE 5. 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months D. One channel inoperable. -----------------NOTE----------------

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

D.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR INSERT RICT 1 D.2.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND D.2.2 Be in MODE 4. 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-2 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One or more -----------------NOTE----------------

Containment Pressure One channel may be bypassed for channel(s) inoperable. up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

E.1.1 Place inoperable 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months channel(s) in trip.

INSERT AND RICT 1 E.1.2 Verify one channel per 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months pair OPERABLE.

OR E.2.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND E.2.2 Be in MODE 4. 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-3 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. One channel or train F.1 Restore channel or train to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months inoperable. OPERABLE status.

INSERT OR RICT 1 F.2.1 Be in MODE 3. 54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months AND F.2.2 Be in MODE 4. 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months G. One train inoperable. -----------------NOTE----------------

One train may be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

G.1 Restore train to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OPERABLE status.

INSERT OR RICT 1 G.2.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND G.2.2 Be in MODE 4. 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-4 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H. One channel -----------------NOTE----------------

inoperable. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

H.1 Place channel in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months INSERT OR RICT 1 H.2 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months I. One or both channel(s) -----------------NOTE----------------

inoperable on one bus. One inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

I.1 Place channel(s) in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR INSERT RICT 2 I.2 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-5 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME J. One train inoperable. -----------------NOTE----------------

One train may be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

J.1 Enter applicable Immediately Condition(s) and Required Action(s) for Auxiliary Feedwater (AFW) train made inoperable by ESFAS instrumentation.

K. One channel inoperable. K.1 Enter applicable Immediately Condition(s) and Required Action(s) for Auxiliary INSERT TS 3.3.2 Feedwater (AFW) pump Condition L made inoperable by INSERT TS 3.3.2 ESFAS instrumentation.

Condition M INSERT TS 3.3.2 Condition N Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.2-6 Unit 2 - Amendment No. 149

4 kV Safeguards Bus Voltage Instrumentation 3.3.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. ------------NOTE----------- C.1 Perform SR 3.3.4.2 for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Only applicable in OPERABLE automatic MODE 1, 2, 3, or 4. load sequencer. AND Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Required Action and thereafter associated Completion Time of Condition A or B AND not met.

C.2 Establish offsite paths block 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR loading capability for associated 4 kV safeguards Function a or b or both bus.

with three channels per AND bus inoperable.

C.3 Verify offsite paths for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR associated 4kV safeguards bus OPERABLE. AND One required automatic load sequencer Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable. thereafter AND C.4 Declare required feature(s) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from supported by the affected discovery of inoperable DG inoperable Condition C when its required redundant concurrent with feature(s) is inoperable. inoperability of redundant required feature(s)

AND C.5 Restore automatic load 7 days sequencer to OPERABLE INSERT status. RICT 1 Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.3.4-3 Unit 2 - Amendment No. 149

Pressurizer 3.4.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One group of pressurizer B.1 Restore group of pressurizer 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months heaters inoperable. heaters to OPERABLE status. INSERT RICT 1 C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition B AND not met.

C.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.9.1 Verify pressurizer water level is < 90%. In accordance with the Surveillance Frequency Control Program SR 3.4.9.2 Verify capacity of each required group of In accordance with pressurizer heaters is > 100 kW. the Surveillance Frequency Control Program SR 3.4.9.3 Verify required pressurizer heaters are In accordance with capable of being powered from an the Surveillance emergency power supply. Frequency Control Program Prairie Island Unit 1 - Amendment No. 226 Units 1 and 2 3.4.9-2 Unit 2 - Amendment No. 214 TBD

Pressurizer PORVs 3.4.11 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One PORV inoperable B.1 Close associated block 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and not capable of being valve.

manually cycled.

AND B.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated block valve.

AND B.3 Restore PORV to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status. INSERT RICT 1 C. One block valve -----------------NOTE----------------

inoperable. Required Actions C.1 and C.2 do not apply when block valve is inoperable solely as a result of complying with Required Actions B.2 or E.2 C.1 Place associated PORV in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months manual control.

AND C.2 Restore block valve to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status. INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.4.11-2 Unit 2 - Amendment No. 149

ECCS - Operating 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS - Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE.

NOTE--------------------------------------

In MODE 3, both safety injection (SI) pump flow paths may be isolated by closing the isolation valves for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to perform pressure isolation valve testing per SR 3.4.15.1.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains A.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C. Less than 100% of the C.1 Enter LCO 3.0.3. Immediately ECCS flow equivalent to a single OPERABLE ECCS train available.

Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.5.2-1 Unit 2 - Amendment No. 149

Containment Air Locks 3.6.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more C.1 Initiate action to evaluate Immediately containment air locks overall containment leakage inoperable for reasons rate per LCO 3.6.1.

other than Condition A or B. AND C.2 Verify a door is closed in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months the affected air lock.

AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. INSERT RICT 1 D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.6.2-5 Unit 2 - Amendment No. 149

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A. ------------NOTE----------- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow paths by penetration flow paths use of at least one closed with two containment and de-activated or isolation valves. mechanically blocked INSERT

power operated valve, RICT 1 closed manual valve, blind One or more penetration flange, or check valve with flow paths with one flow through the valve containment isolation secured.

valve inoperable for reasons other than AND Condition D.

A.2 -----------NOTES------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow paths is for isolation isolated. devices outside containment AND following isolation Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.6.3-2 Unit 2 - Amendment No. 149

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. ------------NOTE----------- C.1 Isolate the affected 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Only applicable to penetration flow paths by penetration flow paths use of at least one closed with only one and de-activated power INSERT containment isolation operated valve, closed RICT 1 valve and a closed manual valve, or blind system. flange.

AND One or more penetration flow paths with one C.2 -----------NOTES------------

containment isolation 1. Isolation devices in valve inoperable. high radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow paths is isolated.

following isolation Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.6.3-4 Unit 2 - Amendment No. 149

Containment Spray and Cooling Systems 3.6.5 3.6 CONTAINMENT SYSTEMS 3.6.5 Containment Spray and Cooling Systems LCO 3.6.5 Two containment spray trains and two containment cooling trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray A.1 Restore containment spray 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable. train to OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 5. 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months C. One or both containment C.1 Restore containment 7 days cooling fan coil unit(s) cooling FCU(s) to INSERT (FCU) in one train OPERABLE status.

RICT 1 inoperable.

Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 3.6.5-1 Unit 2 - Amendment No. 215

Containment Spray and Cooling Systems 3.6.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One containment cooling D.1 Initiate action to isolate Immediately FCU in each train both inoperable FCUs.

inoperable.

AND D.2 Restore all FCUs to 7 days OPERABLE status. INSERT RICT 1 E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition C or D AND not met.

E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 3.6.5-2 Unit 2 - Amendment No. 215

MSIVs 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs)

LCO 3.7.2 Two MSIVs shall be OPERABLE.

Administrative change APPLICABILITY: MODES 1, MODES 2 and 3 except when both MSIVs are closed.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One MSIV inoperable in A.1 Restore MSIV to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months MODE 1. OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not met.

C. ----------NOTE----------- C.1 Close MSIV. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Separate Condition entry is allowed for each AND MSIV.

C.2 Verify MSIV is closed. Once per 7 days One or more MSIVs inoperable in MODE 2 or 3.

Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.7.2-1 Unit 2 - Amendment No. 149

SG PORVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Steam Generator (SG) Power Operated Relief Valves (PORVs)

LCO 3.7.4 Two SG PORV lines shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SG PORV line A.1 Restore SG PORV line to 7 days inoperable. OPERABLE status. INSERT RICT 1 B. Two SG PORV lines B.1 Restore one SG PORV line 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 4 without 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months reliance upon steam generator for heat removal.

Prairie Island Unit 1 - Amendment No. 158, 167 Unit 2 - Amendment No. -149, 157 I TBD Units 1 and 2 3.7.4-1

AFW System 3.7.5 ACTIONS

NOTE-------------------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to A.1 Restore affected equipment 7 days turbine driven AFW to OPERABLE status.

pump inoperable. INSERT RICT 1 OR

NOTE-----------

Only applicable if MODE 2 has not been entered following refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable in MODE 1, 2, OPERABLE status.

INSERT or 3 for reasons other than Condition A. RICT 1 Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 3.7.5-2 Unit 2 - Amendment No. 215

CC System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Component Cooling Water (CC) System LCO 3.7.7 Two CC trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One CC train inoperable. A.1 -------------NOTE------------

Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -

MODE 4," for residual heat removal loops made inoperable by CC.

Restore CC train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.7.7-1 Unit 2 - Amendment No. 149

CL System 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Cooling Water (CL) System LCO 3.7.8 Two CL trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. No safeguards CL pumps -----------------NOTES----------------

OPERABLE for one 1. Unit 1 enter applicable train. Conditions and Required Actions of LCO 3.8.1, AC Sources-MODES 1, 2, 3, and Administrative 4, for emergency diesel change - fix generator made inoperable by alignment of CL System. Note 1

2. Both units enter applicable Conditions and Required Actions of LCO 3.4.6, RCS Loops-MODE 4, for residual heat removal loops made inoperable by CL System.

3. This Condition may not exist

> 7 days in any consecutive 30 day period.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 3.7.8-1 Unit 2 - Amendment No. 149 TBD

CL System 3.7.8 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.1 Restore one safeguards CL 7 days pump to OPERABLE status. INSERT RICT 1 B. One CL supply header -----------------NOTES----------------

inoperable. 1. Unit 1 enter applicable Conditions and Required Actions of LCO 3.8.1, AC Sources-MODES 1, 2, 3, and 4, for emergency diesel generator made inoperable by CL System.

2. Both units enter applicable Conditions and Required Actions of LCO 3.4.6, RCS Loops-MODE 4, for residual heat removal loops made inoperable by CL System.

B.1 Verify vertical motor driven 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months CL pump OPERABLE.

AND B.2 Verify opposite train diesel 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months driven CL pump OPERABLE.

AND B.3 Restore CL supply header to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 3.7.8-2 Unit 2 - Amendment No. 215

AC Sources-Operating 3.8.1 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical sources shall be OPERABLE:

a. Two paths between the offsite transmission grid and the onsite 4 kV Safeguards Distribution System; and

b. Two diesel generators (DGs) capable of supplying the onsite 4 kV Safeguards Distribution System.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to DGs.

CONDITION REQUIRED ACTION COMPLETION TIME A. One required path A.1 Perform SR 3.8.1.1 for the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. OPERABLE path.

AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Restore path to 7 days OPERABLE status. INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 227 Units 1 and 2 3.8.1-1 Unit 2 - Amendment No. 215 TBD

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One DG inoperable. B.1 Perform SR 3.8.1.1 for the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months paths.

AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required feature(s) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from supported by the discovery of inoperable DG inoperable Condition B when its required concurrent with redundant feature(s) is inoperability of inoperable. redundant required feature(s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG is not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE DG.

AND B.4 Restore DG to 14 days OPERABLE status.

INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 227 TBD Units 1 and 2 3.8.1-2 Unit 2 - Amendment No. 215

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Two paths inoperable. C.1 Declare required feature(s) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from inoperable when its discovery of redundant required Condition C feature(s) is inoperable. concurrent with inoperability of redundant required features AND C.2 Restore one path to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

INSERT RICT 1 D. One path inoperable. -----------------NOTE----------------

Enter applicable Conditions and AND Required Actions of LCO 3.8.9, Distribution Systems-One DG inoperable. Operating, when Condition D is entered with no AC power source to either train.

D.1 Restore path to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status. INSERT RICT 1 OR D.2 Restore DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status. INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 227 Units 1 and 2 3.8.1-3 Unit 2 - Amendment No. 215 TBD

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger A.1 Verify its associated battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months inoperable. is OPERABLE.

AND A.2 Verify the other train 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months battery charger is OPERABLE.

AND A.3 Verify the diesel generator 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and safeguards equipment on the other train are OPERABLE.

AND A.4 Restore battery charger to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status.

INSERT RICT 1 Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.8.4-1 Unit 2 - Amendment No. 149

DC Sources - Operating 3.8.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One battery B.1 Verify associated battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months inoperable. charger is OPERABLE.

AND B.2 Verify other train battery is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE.

AND B.3 Verify other train battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months charger is OPERABLE.

AND B.4 Restore battery to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status. INSERT RICT 1 C. One DC electrical C.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power subsystem power subsystem to inoperable for reasons OPERABLE status. INSERT other than Condition A RICT 1 or B.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Prairie Island Unit 1 - Amendment No. 158 TBD Units 1 and 2 3.8.4-2 Unit 2 - Amendment No. 149

Inverters-Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters-Operating LCO 3.8.7 Four Reactor Protection Instrument AC inverters shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Reactor Protection A.1 ------------NOTE------------

Instrument AC inverter Enter the applicable inoperable. Conditions and Required Actions of LCO 3.8.9, Distribution Systems -

Operating with any Reactor Protection Instrument AC panel de-energized.

Restore Reactor Protection 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Instrument AC inverter to OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Prairie Island Unit 1 - Amendment No. 158, 219 Units 1 and 2 3.8.7-1 Unit 2 - Amendment No. 149, 206 TBD

Distribution Systems-Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems-Operating LCO 3.8.9 Train A and Train B safeguards AC and DC, and Reactor Protection Instrument AC electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more safeguards -----------------NOTE----------------

AC electrical power Enter applicable Conditions and distribution subsystems Required Actions of LCO 3.8.4, inoperable. DC Sources - Operating, for DC trains made inoperable by inoperable power distribution subsystems.

A.1 Restore safeguards AC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months electrical power distribution subsystems to INSERT OPERABLE status. RICT 1 B. One or more safeguards B.1 Restore safeguards DC 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months DC electrical power electrical power distribution subsystems distribution subsystems to INSERT inoperable. OPERABLE status. RICT 1 Prairie Island Unit 1 - Amendment No. 227 Units 1 and 2 3.8.9-1 Unit 2 - Amendment No. 215 TBD

Distribution Systems-Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One Reactor Protection C.1 Restore Reactor Protection 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Instrument AC panel Instrument AC panel to INSERT inoperable. OPERABLE status.

RICT 1 D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months E. Two trains with E.1 Enter LCO 3.0.3. Immediately inoperable distribution subsystems that result in a loss of safety function.

OR Two or more Reactor Protection Instrument AC panels inoperable.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker and switch alignments and In accordance with voltage to safeguards AC, DC, and Reactor the Surveillance Protection Instrument AC electrical power Frequency Control distribution subsystems. Program Prairie Island Unit 1 - Amendment No. 227 Units 1 and 2 3.8.9-2 Unit 2 - Amendment No. 215 TBD

Programs and Manuals 5.5 Administrative 5.5 Programs and Manuals change - underline 5.5.16 Control Room Envelope Habitability Program (continued)

e. The quantitative limits on unfiltered air in-leakage into the CRE. These limits shall be stated in a manner to allow direct comparison to the unfiltered in-leakage measured by the testing described in paragraph c.

The unfiltered air in-leakage limit for radiological challenges is the in-leakage flow rate assumed in the licensing basis analysis of DBA consequences. Unfiltered air inleakage limits for hazardous chemicals must ensure that exposure of CRE occupants to these hazards will be within the assumptions of the licensing basis.

f. The provisions of SR 3.0.2 are applicable to the Frequencies for assessing CRE habitability and determining CRE unfiltered in-leakage as required by paragraph c.

5.5.17 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, Risk-Informed Method for Control of Surveillance Frequencies, Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are INSERT applicable to the Frequencies established in the Surveillance Frequency Control Program.

RICT Program Prairie Island Unit 1 - Amendment No. 226 TBD Units 1 and 2 5.0-31 Unit 2 - Amendment No. 214

v t e Letter Sequence Response to RAI
EPID:L2019, TSTF-505, TSTF-411 (Open)
Initiation Request Acceptance... Administration Questions Answers 1 September 2020 Results Approval... Other: ML20122A228, ML20290A397
MONTHYEAR2020-05-04 [Table View]

L-PI-20-026, Response to Request for Additional Information: License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiativ

Text

References:

1.0 BACKGROUND

3.0 REFERENCES

Navigation menu

L-PI-20-026, Response to Request for Additional Information: License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiativ

Text

References:

1.0 BACKGROUND

3.0 REFERENCES

Navigation menu

Search