NMP2L2745, Request for Additional Information for Nine Mile Point Nuclear Station, Unit 2, to Adopt TSTF-505, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2

Request for Additional Information for Nine Mile Point Nuclear Station, Unit 2, to Adopt TSTF-505, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2

ML20276A020
Person / Time
Site:	Nine Mile Point
Issue date:	10/02/2020
From:	David Gudger Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NMP2L2745
Download: ML20276A020 (82)

Text

` 200 Exelon Way Kennett Square, PA 19348 www.exeloncorp.com 10 CFR 50.90 NMP2L2745 October 2, 2020 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Nine Mile Point Nuclear Station, Unit 2 Renewed Facility Operating License No. NPF-69 NRC Docket No. 50-410

Subject:

Request for Additional Information for Nine Mile Point Nuclear Station, Unit 2, to Adopt TSTF-505, "Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4b," Revision 2

References:

1. Letter from D. Gudger (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4b," dated October 31, 2019

2. Letter from M. Marshall (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Exelon Generation Company, LLC), "Nine Mile Point Nuclear Station, Unit 2 - Supplemental Information Needed for Acceptance of Requested Licensing Action RE: Adoption of Risk-Informed Completion Times (EPID L-2019-LLA-0234)," dated December 5, 2019

3. Letter from S. Rafferty-Czincila (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Supplemental Information No.1 for Nine Mile Point Nuclear Station, Unit 2, to Adopt TSTF-505, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b,' Revision 2,"

dated December 12, 2019

4. Letter from M. Marshall (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Exelon Generation Company, LLC), "Nine Mile Point Nuclear Station, Unit 2 - Request for Additional Information RE:

Review of License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times (EPID L-2019-LLA-0234)," dated July 30, 2020

U.S. Nuclear Regulatory Commission Request for Additional Information TSTF-505, Risk-Informed Extended Completion Times Docket No. 50-410 October 2, 2020 Page 2

5. Letter from D. Gudger (Exelon Generation Company, LLC) to U.S. Nuclear Regulatory Commission, "Request for Additional Information for Nine Mile Point Nuclear Station, Unit 2, to Adopt TSTF-505, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b,' Revision 2," dated August 28, 2020

6. Letter from M. Marshall (Senior Project Manager, U.S Nuclear Regulatory Commission) to R. Reynolds (Exelon Generation Company, LLC), "Nine Mile Point Nuclear Station, Unit 2 - Request for Additional Information to Support Review of License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times (EPID L-2019-LLA-0234)," dated September 2, 2020 By letter dated October 31, 2019 (Reference 1), Exelon Generation Company, LLC (Exelon) requested to change the Nine Mile Point Nuclear Station, Unit 2 (NMP2) Technical Specifications (TS). The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with TSTF-505, Revision 2, "Provide Risk- Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML18183A493).

In a letter dated December 5, 2019 (Reference 2), the NRC requested Supplemental Information to support their acceptance review of Reference 1. The acceptance review is performed to determine if there is sufficient information in scope and depth to allow the NRC staff to complete its detailed technical review. The letter states that bullets e and f of the proposed TS Administrative Section 5.5.15, "Risk Informed Completion Time Program,"

provided in Attachment 2 of Reference 1 differs from the wording in the NRC-approved TSTF-505, Revision 2 and that this variation is not identified nor justified in Reference 1.

This letter requests supplemental information to justify the variation. Exelon provided the supplemental information in Reference 3.

On July 30, 2020, the NRC provided a Request for Additional Information (RAI) (Reference

4) to support their continued review of Reference 1. Exelon provided the RAI responses in Reference 5.

On September 2, 2020, the NRC provided a second Request for Additional Information (RAI)

(Reference 6) to support their continued review of Reference 1. to this letter contains the NRCs request for additional information immediately followed by Exelons response.

Exelon has reviewed the information supporting a finding of no significant hazards consideration and the environmental consideration provided to the NRC in Reference 1. The supplemental information provided in this letter does not affect the bases for concluding that the proposed license amendment does not involve a significant hazards consideration.

Furthermore, the supplemental information provided in this letter does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.

U.S. Nuclear Regulatory Commission Request for Additional Information TSTF-505, Risk-Informed Extended Completion Times Docket No. 50-410 October 2, 2020 Page 3 There are no commitments contained in this response.

If you should have any questions regarding this submittal, please contact Ron Reynolds at 610-765-5247.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2nd day of October 2020.

Respectfully, David T. Gudger Senior Manager - Licensing Exelon Generation Company, LLC : Response to Request for Additional Information cc: USNRC Region I Regional Administrator w/attachments USNRC Senior Resident Inspector - NMP "

USNRC Project Manager, NRR - NMP "

A. L. Peterson, NYSERDA "

ATTACHMENT 1 Nine Mile Point Nuclear Station, Unit 2 Renewed Facility Operating License NPF-69 Docket No. 50-410 Request for Additional Information Adopt Risk Informed Completion Times Response to Request for Additional Information

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 1 of 78 Docket No. 50-410 Internal PRA Section 50.36(c)(2) of Title 10 of the Code of Federal Regulations (10 CFR) requires technical specifications (TSs) to contain limiting conditions of operations (LCOs) that describe the lowest functional capability of equipment required for safe operation of a plant and requires to follow any remedial actions permitted by the TSs. The remedial actions need to be completed within a set time frame commonly referred to as a completion time (CT) or allowed outage time. The risk informed completion time program that Exelon has requested to adopt at Nine Mile Point 2 is one way of establishing or changing a CT using a risk-informed approach that relies on probabilistic risk assessments (PRAs).

RAI 6

Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," (ADAMS Accession No. ML090410014) provides guidance for addressing probabilistic risk assessment (PRA) acceptability. RG 1.200, Revision 2, describes a peer review process using the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard ASME/ANS-RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," as one acceptable approach for determining the technical acceptability of the PRA. The primary results of peer review are the findings and observation (F&Os) recorded by the peer review team and the subsequent resolution of these F&Os. A process to close finding-level F&Os is documented in Appendix X to the Nuclear Energy Institute (NEI) guidance documents, NEI 05-04, NEI 07-12, and NEI 12-13, titled "NEI 05-04/07-12/12-06, Appendix X:

Close Out of Facts and Observations (F&Os)," (ADAMS Package Accession No. ML17086A431), which was accepted by the NRC staff in a letter dated May 3, 2017 (ADAMS Accession No. ML17079A427).

The license condition proposed in Attachment 7 of the LAR includes the commitment to complete a number of implementation items prior to implementation of RICT program. One of these implementation items is to address the open F&Os from the internal events PRA F&O closure report. This implementation item does not describe what updates will be made to the internal events PRA models to resolve the three remaining F&Os associated with the support system initiating event (SSIE) fault trees or cite resolutions described elsewhere in the LAR, such as in the descriptions in the "Disposition" column for F&Os presented in Enclosure 2, Table E2-1, of the TSTF-505 LAR. Therefore, address the following:

a. The disposition for F&O 5-1 states that the cited correction factor will be replaced with improved modeling in the PRA. If available, describe the proposed PRA modeling and any subsequent modifications to the corresponding implementation item.

b. The disposition for F&O 8-1 states that a systemic review of the cutsets produced by the SSIE fault trees will be performed to identify feasible recovery actions that could impact the frequency of the associated SSIE. The disposition does not commit to updating the PRA if feasible recovery actions that could impact the frequency of the associated SSIE are identified. Provide a description of the actions that will be performed upon identifying feasible recovery actions.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 2 of 78 Docket No. 50-410

c. The disposition for F&O 8-2 appears to indicate that the mission time for common cause factors used in the SSIE fault tress will be adjusted to a year-long mission time.

Describe how mission time will be adjusted and, if applicable, provide an update to the associated implementation item.

Exelon Response to RAI 6 Response to RAI-6 a)

The original PRA did not include linked Support System Initiating Event (SSIE) fault trees and the 2010 Peer Review Team issued a Finding which led to the development of SSIE Fault Trees. Based on concerns that PRA failure rates were conservative when applied over 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> versus 24, these SSIE fault trees included correction factors to bias SSIE fault tree results to match industry point-estimate frequencies applicable to each system for which an SSIE fault tree was developed.

This PRA model improvement was determined to be an upgrade and a Focused-Scope Peer review was performed in 2019. The Focused Scope Peer Review Team issued a new Finding which claimed that use of the correction factors negates the benefits of using fault trees for SSIEs. In order to address this finding, the Correction Factors were removed from the SSIE Fault Tree logic in the latest PRA model. Based on a systematic review of the cutsets for each SSIE (see response to part b below), plant-specific recovery events were developed in place of correction factors. F&O 5-1 is closed in the latest model and is closed via the 2020 F&O Closure Review.

Response to RAI-6 b)

As suggested by the Focused Scope Peer Review Team, cutsets yielded by the SSIE Fault Trees were reviewed and recovery was considered and, if justifiable, credited. As an example, initiator %SWPX Failure of Running SW Pumps models failure of 2 of the 4 running service water pump trains. Given this event, the 2 remaining operating service water pump trains would be unable to maintain plant cooling over time and a shutdown would eventually be required. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was assumed as the heat up window and recovery credit was developed per NSAC-161 Faulted Systems Recovery Experience1. Similarly, cutsets for other Service Water initiators were reviewed. These cutsets involve spurious closure of system header and/or crosstie valves.

In these situations, Service Water flow would be halted abruptly, and no recovery credit could be justified. Other SSIE Systems RBCLC, TBCLC, Instrument Air, Instrument Nitrogen, and 115kV Supply Trains were treated similarly. F&O 8-1 is closed in the latest model and is closed via the 2020 F&O Closure Review.

Response to RAI-6 c)

Support System Initiating event fault trees can produce non-representative results when 24-hour-based basic events are adjusted to apply a year-long mission time. Previously, Nine Mile Point Unit 2 (NMP2) used a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> common cause failure (CCF) mission time to avoid dominant contribution from CCF events which have not been prevalent in plant or industry Initiating Event experience. This simplification was removed, and 8760-hour-based mission times were used. Separate, one-year mission time common-cause grouping was added. For example, Common Cause Failure of two service water pumps over an 8760 hour0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> CCF group mission time is modeled (previously the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> group was used). F&O 8-2 is closed in the latest model and is closed via the 2020 F&O Closure Review.

1 NSAC-161, "Faulted Systems Recovery Experience", Mollerus Engineering, May, 1992.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 3 of 78 Docket No. 50-410

RAI 7

The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as, "the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences." Section 1-5 of Part 1 of the ASME/ANS RA-Sa-2009 PRA standard states that, "[u]pgrades of a PRA shall receive a peer review in accordance with the guidance specified in the Peer Review Section of each respective Part of this Standard []." Criteria presented to identify PRA upgrades are (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

LAR Enclosure 2 states that the last full scope peer review for the internal events PRA was conducted in July 2009 and that an F&O closure review to close out F&Os from the 2009 review was conducted in February 2019. The LAR does not indicate what internal events and internal flood PRA model changes were made between July 2009 and February 2019 to improve the model or to incorporate changes to reflect the as-built, as-operated plant. Address the following:

a. Summarize the model changes performed for the internal events, including internal flood PRA since July 2009, and for each change, justify why it does or does not meet the definition of a PRA upgrade as defined in the ASME/ANS RA-Sa-2009 PRA standard.

b. Confirm that focused-scope peer reviews have been conducted for any model change performed for the internal events, including internal flood, PRA model since July 2009 that meets the definition of a PRA upgrade as defined in the ASME/ANS RA-Sa-2009 PRA standard. Describe the peer review and status of the resulting F&Os. Provide any remaining open F&Os, along with dispositions for this application.

c. During the regulatory audit conducted May 4 to 7, 2020, the licensee identified a number of human reliability analysis (HRA) changes to the internal events PRA model, which included a change from human cognitive reliability to accident sequence evaluation program time reliability correlation, change to using the HRA Calculator joint human error probability (HEP) tool versus manual grouping of HEPs and changes to credit for diverse and flexible mitigation capabilities (FLEX).

Non-mandatory Appendix I-A of the PRA Standard states:

Consideration should be given to the scope or number of PRA maintenances performed. Although individual changes to a PRA model may be considered PRA maintenances, the integrated nature of several changes may necessitate a peer review. Multiple PRA maintenances can, over time, lead to considerable change in the insights (e.g., importance rankings, relative risk significance of

[structures, systems, and components] SSCs).

Discuss whether the cumulative changes in the internal events since 2009 led to considerable change in the risk insights and whether a peer review was performed.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 4 of 78 Docket No. 50-410 Exelon Response to RAI 7 Response to RAI-7 a)

The requested summary of NMP2 FPIE PRA model changes since the 2009 peer review and whether each represents a PRA Upgrade or not is provided in Table RAI7-1. Per Section 1-2 of Addenda A/B of the ASME Standard,2 the definition of PRA Upgrade is a change that satisfies one of three criteria:

(1) new methodology (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences The term new method used in this disposition is consistent with Table A-1 of Regulatory Guide (RG) 1.200, Rev. 2.

The Scope attribute is defined consistent with Section C of RG 1.2003, i.e., The scope of the PRA ...is defined in terms of (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

Consistent with concepts in RG 1.200, Rev. 2, as well as the basis for Capability Category distinctions in the PRA Standard, the term capability used in this disposition is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the Capability Category (from Not Met or CC-I to CC-II) for one or more SRs.

Finally, the standard also does not provide explicit criteria for assigning significance of changes.

This term encompasses both Level 1 (core damage) and Level 2 (post-core damage) accident sequences. This criterion is interpreted in this context of PRA Upgrade as the top 95% of sequences and whether the makeup of those sequences have been significantly impacted.

Whether the makeup of the top 95% of the sequences is determined to be significantly impacted is based on a qualitative consideration as to whether the change in the sequences would likely change decision making when applying the PRA in risk applications. For example, top sequences in the top 95% that for the model change drop out of the top 95% would be a case where justification should be provided as to why the change in question is not considered an upgrade or it should be identified as an upgrade. NOTE: Per the ASME PRA Standard Addenda A and RG 1.200, Rev. 2 definition of PRA upgrade, this criterion is logically ANDed with the other criteria of first having to be a change in scope or a change in capability.

The majority of NMP2 FPIE PRA changes since the 2009 peer review were to update industry and plant specific data or include plant modifications. These are necessary to maintain the 2

ASME/ANS RA-S-2009 - Addenda to ASME/ANS RA-S-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, July 2009.

3 REGULATORY GUIDE 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009, Rev. 2.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 5 of 78 Docket No. 50-410 model as representative of the as-built, as-operated plant. These conform to the overall method of the PRA and simply represent parameter changes or additional model logic. The PRA Model Files contain an Update Log, which documents model edits made to support PRA updates.

Because the Update Log is highly detailed, the log entries were reviewed and engineering judgement was applied to determine the level of detail and scope of changes appropriate to reproduce for this response; Table RAI7-1 provides a summary of the NMP2 FPIE PRA model changes of potential interest.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 6 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Inclusion of the HPCS EDG Crosstie No No No --- Maintenance The modeling was accomplished within the to Division I or II given LOSP with fault tree logic used for the PRA and no new failure of Division I and II EDGs to methods were applied.

power the Division III SW pump and other auxiliaries. This was addressed in the 2014A PRA Update.

Incorporation of the action to open No No No --- Maintenance The modeling was accomplished within the doors and dampers given loss of HRA Calculator used for the PRA and no new ECCS Room Cooling. This was methods were applied.

implemented in the 2014A PRA Update.

Loss of Off-Site Power (LOSP) No No No --- Maintenance The modeling was accomplished within the Analysis was updated to include fault tree logic used for the PRA and no new plant-specific, weather-related, grid- methods were applied.

centered, and switchyard-related impacts. This was implemented in the 2014A PRA Update.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 7 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Adopt use of ASEP vs. HCR for HRA Yes --- --- --- Upgrade This change is to one aspect of the post-time reliability correlation (TRC) to initiator HRA methodology used in the PRA.

improve consistency with other The CBDT HRA method is used but the HCR Exelon PRAs. This was implemented method time reliability correlation (TCR) was in the 2014A PRA Update. used for application to shorter term action HEPs whereas now the ASEP TRC is used for that contributor. Although the post-initiator HRA methods are unchanged except for this one component (and these are options provided within the HRA Calculator software),

this change is conservatively classified as an Upgrade. This same change was made to the HRA used in support of the Fire PRA and for an almost identical set of HEPs as that in the FPIE PRA. This Fire HRA (used ASEP TRC with CBDTM) was Peer Reviewed in 2018. No Findings were identified relative to the use of ASEP TRC method4. A Focused Scope peer review was performed on this topic for the FPIE PRA HRA; refer to part b of this response for a description of the results of the FSPR.

4 FPRA Peer Review F&O 4-17 indicated that some ASEP selections were not adequately justified. This is a documentation-oriented finding not related to the adequacy of ASEP. The peer team noted in SR HR-G2 that ASEP was used and there was no finding related to the choice of method. HR G-3 notes that ASEP is an appropriate method. F&O 4-17 has been closed through the Peer closure process and improvements have been translated into the IEPRA.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 8 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Credit Portable FLEX equipment. A No No No --- Maintenance No new methods are employed in order to portable battery charger capability credit FLEX into existing models. The scope of was included in the Peer Reviewed the model remains identical to the peer-model (2009). The formal FLEX reviewed model; at-power, internally initiated program improvements (FLEX DGs, Initiating Events. Likewise, no change in the FLEX Pumps, Low-Pressure RCIC capability categories for any supporting Operation, etc.) were added to the requirement apply.

FPRA model in 2018 and to the IPRA model in 2019.

Credit newly installed Hardened No No No --- Maintenance No new methods are employed in order to Containment Venting System (HCVS) credit FLEX into existing models. The scope of Modification. A local, manual process the model remains identical to the peer-utilizing damage repair procedures reviewed model; at-power, internally initiated was given some credit in the Peer Initiating Events. Likewise, no change in the Reviewed model (2009). The hard- capability categories for any supporting piped FLEX modification was added requirement apply.

to the FPRA model in 2018 and to the IPRA model in 2019.

Created dedicated SORV/IORV event No No No --- Maintenance Improved the traceability and visibility of Stuck tree and top logic, removed from Open Relief Valve scenarios. No significant MLOCA. Similarly, removed LOSP change in overall logic but rather a from the general transient event tree reorganization of the model configuration.

logic and included in a LOSP This model change does not constitute an dedicated event tree structure built Upgrade.

similar to the general transient logic.

This allowed for better consideration of non-SBO A/C recovery. This was implemented in the 2014A PRA Update.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 9 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Created CF-CV node to address the No No No --- Maintenance Included an additional severe accident failure possibility of RPV Injection failure mode to improve the completeness of the PRA following Containment Venting. This and develop greater consistency with the was implemented in the 2014A PRA Exelon Fleet PRAs. The modeling was Update. accomplished within the event tree and fault tree logic used for the pre-existing PRA and no new methods were applied.

In order to address the possibility of No No No --- Maintenance Included an additional severe accident failure RPV Injection failure (HPCS Steam mode to improve the completeness of the PRA Binding) following Containment and develop greater consistency with the Venting, added gate Exelon Fleet PRAs. The modeling was "HPCSCONDENSATE" under Gate accomplished within the event tree and fault "HS-SBO". This modeling requires tree logic used for the pre-existing PRA and no HPCS to operate successfully from new methods were applied.

the CST in SBO. While slightly conservative, it addresses any concern that HPCS could be over-credited given a hot suppression pool.

Deleted SBO-ML gate for MLOCA et, addressed by new SORV ET. This was implemented in the 2014A PRA Update.

Removed the requirement for RPV No No No --- Maintenance Eliminated a failure mode which does not depressurization when the ISLOCA apply to the boundary conditions of the Pipe Rupture failure mode applies. scenario. This improved the accuracy of the The model previously asked RPV model in addressing the as-built plant. The depressurization and such a demand modeling was accomplished within the event would not exist in unisolated ISLOCA tree and fault tree logic used for the PRA and events. This was implemented in the no new methods were applied.

2014 PRA Update.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 10 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Broke the RQ Node into constituent No No No --- Maintenance Revised ATWS accident sequence logic to parts (QM, QE, ARI). Modified more closely match the configuration of other endstate links. Removed MLOCA Exelon BWR PRA models. No significant and LLOCA from ATWS model. change in overall logic but rather a ATWS Node added to LL and ML reorganization of the model configuration.

event trees separately (and assumed failed). Deleted gate WL1A under WL1-ATWS Gate. Assigned LLOCA with failure to SCRAM directly to Class-4L CDF rather than transferring to ATWS model. Assigned MLOCA with failure to SCRAM directly to Class-4L CDF rather than transferring to ATWS model. This was implemented in the 2014A PRA Update.

Re-assigned select ECCS Pipe No No No --- Maintenance Eliminated a failure mode which does not breaks to "Steam" LOCA rather than apply to the boundary conditions of the "Water" LOCA. (Moved from gate IE- scenario. This improved the accuracy of the ML-WATER to gate IE-ML-STEAM)." model in addressing the as-built plant. The This was implemented in the 2014A modeling was accomplished within the event PRA Update. tree and fault tree logic used for the PRA and no new methods were applied.

Require CRD for RCIC success path No No No --- Maintenance Included an additional severe accident failure in small LOCA. RCIC AND CRD mode to improve the completeness of the PRA must be successful for this success and consistency with the Exelon BWR PRAs.

path. Added CRD (gate: XXCRDF) to The modeling was accomplished within the RCIC (Gate: IC-SL). This was event tree and fault tree logic used for the pre-implemented in the 2014A PRA existing PRA and no new methods were Update. applied.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 11 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Adding credit for HPCS given No No No --- Maintenance Included an additional success path to better feedwater failure in ATWS. Added represent the as-built plant. The modeling was Gate OD-ATWS-HPI to gate ODLPI- accomplished within the event tree and fault ATWS in ATWS model. This "ANDs" tree logic used for the PRA and no new HPCS with Depressurization and LPI. methods were applied.

This was implemented in the 2014A PRA Update.

Implemented HRAC Joint HEP tool No No No --- Maintenance The THERP decision-tree method for versus manual grouping of HEPs. dependency underpinned the existing and This was implemented in the 2014A improved modeling but employment of the PRA Update. HRA Calculator was mainly to automate the process and better conform to standard industry practices.

Added Multiple Spurious Operation No No No --- Maintenance Included additional severe accident failure (MSO) logic for Fire PRA. MSOs modes to improve the completeness of the were added to the FPRA model in PRA; mainly in preparation for aligning with the 2018 and to the IPRA model in 2019. Fire PRA. The modeling was accomplished within the event tree and fault tree logic used for the PRA and no new methods were applied.

Added logic to credit the Pseudo No No No --- Maintenance Included an additional success path to better LPCI mode of RHR. The Pseudo represent the as-built plant. The modeling was LPCI capability was added to the accomplished within the event tree and fault FPRA model in 2018 and to the IPRA tree logic used for the PRA and no new model in 2019. methods were applied.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 12 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Added logic for instruments and No No No --- Maintenance Explicitly modeled equipment which could power supplies required for HEP BEs. prevent successful operator actions.

The instruments supporting existing Instruments are typically highly reliable HEPs were added to the FPRA model compared to operators and are not considered in 2018 and to the IPRA model in a dominant contributor to IEPRA results.

2019. However, this change addresses potential significance in Fire and mainly is important in terms of aligning with the Fire PRA. The modeling was accomplished within the event tree and fault tree logic used for the PRA and no new methods were applied.

Created Main Control Room No No No --- Maintenance Developed an event tree structure to address Abandonment (MCRA) model. The fire-induced Main Control Room Abandonment.

MCRA logic was added to the FPRA The modeling was accomplished within the model in 2018 and to the IPRA model event tree and fault tree logic used for the PRA in 2019. and no new methods were applied.

Sequences do not apply to the IPRA and modeling is solely to support the FPRA.

Added water hammer logic. This No No No --- Maintenance Included an additional severe accident failure logic was added in the 2019 Update. mode to improve the completeness of the PRA and develop greater consistency with the Exelon Fleet PRAs. The modeling was accomplished within the event tree and fault tree logic used for the pre-existing PRA and no new methods were applied.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 13 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Added SSIE logic to support the PRA Yes --- --- --- Upgrade Added logic to model support system initiating Update performed in 2009 and events with fault trees to better represent subsequently enhanced as part of the equipment importance and address a peer 2014A PRA Update. Review Finding. This change was classified as an Upgrade (New Method) and a Focused Scope Peer Review was performed in 2019.

This Focused Scope Peer Review led to three new findings which required additional changes. The additional changes were parametric in nature and within the SSIE modeling approach and do not constitute another change in method or upgrade.

Added UPS Transfer switch logic. No No No --- Maintenance Included additional 120VAC failure modes to This was implemented in the 2019 improve the completeness of the PRA. The PRA Update. modeling was accomplished within the event tree and fault tree logic used for the PRA and no new methods were applied.

Added maintenance event No No No --- Maintenance Included an additional maintenance alignment WBYS3_BYSBAT2CMNT to improve the completeness of the PRA. The (2BYS*BAT2C Division III Battery modeling was accomplished within the event Unavailable Due to Maintenance) tree and fault tree logic used for the PRA and under gate BAT2C. This was no new methods were applied.

implemented in the 2019 PRA Update.

Added Human Error event No No No --- Maintenance Based on the FLEX improvement initiative, ZODC1_OD-CONTROL Operator included an new success path to better Fails to Control RPV Pressure above represent the as-built plant. The modeling was RCIC Shutoff. The action to operate accomplished within the event tree logic, fault RCIC at low pressure was added to tree logic, and HRA method (HRAC) used for the FPRA model in 2018 and to the the PRA and no new methods were applied.

IPRA model in 2019.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 14 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment As per RICT program request, added No No No --- Maintenance Included an additional severe accident failure logic for failure to open vacuum mode to improve the completeness of the breakers (assume necessary PRA. The modeling was accomplished within following DW spray actuation). See the event tree and fault tree logic used for the new gate: VS-OPEN. This logic was PRA and no new methods were applied.

added in the 2019 Update.

As per RICT program request, added No No No --- Maintenance Included additional seasonally dependent logic for failure of intake Bar Heaters. intake failure modes to improve the See new gate: SWS_ICE. This logic completeness of the PRA. The modeling was was added in the 2019 Update. accomplished within the event tree and fault tree logic used for the PRA and no new methods were applied.

Added alternate supply logic for gates No No No --- Maintenance Included additional 600VAC system cross-ties M12A, M12C, M13A, M13C, M32B, to better represent the as-built plant and to M32D, M33B, M33D. This logic was particularly benefit plant configuration risk added in the 2019 Update. management assessments. The modeling was accomplished within the event tree and fault tree logic used for the PRA and no new methods were applied.

Added logic for high lake water No No No --- Maintenance Included additional seasonally dependent temperature and related service water service water success criteria to improve the success criteria to include the completeness of the PRA. The modeling was specification of more pumps required accomplished within the event tree and fault at high lake temp per Technical tree logic used for the PRA and no new Specifications (TS). This logic was methods were applied.

added in the 2019 Update.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 15 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Added a failure mode related to LPCS No No No --- Maintenance Included additional LPCS failure modes to Min Flow requirements. Specifically, improve the completeness of the PRA. The added CSLXMOV107XVM1D1 under modeling was accomplished within the event Gate LSGATE009 to address Min tree and fault tree logic used for the PRA and Flow Valve Open Demand that is no new methods were applied.

necessary when the system is secured to control RPV level. The valve is normally open and will close when LPCS initiates. If LPCS is secured (after the min flow valve closes) to control RPV level and then restarted when RPV drops (as expected) the min flow valve may be required to open to protect the pump until the injection valve opens. While the time spent dead-headed is expected to be minimal under, the failure mode is added to address cases such as when RCIC is restored and RPV pressure is recovered. The change was added to the FPRA model in 2018 and to the IPRA model in 2019.

Added logic for Failure of Condenser No No No --- Maintenance Included an additional severe accident failure Vacuum to Isolate (RICT/50.69 mode to improve the completeness of the Request). This logic was added in PRA. The modeling was accomplished within the 2019 Update. the event tree and fault tree logic used for the PRA and no new methods were applied.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 16 of 78 Docket No. 50-410 Table RAI7-1 Summary of Model Changes in NMP2 FPIE PRA Since 2009 Peer Review Change Significant PRA New in Change in Impact on Maintenance or PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Upgrade(5) Comment Added logic for Load Tap Changer No No No --- Maintenance Included additional 115kV failure modes to (LTC) Available vs Unavailable improve the completeness of the PRA. The relative to conditional LOOP. See modeling was accomplished within the event Gate OG-COND. This logic was tree and fault tree logic used for the PRA and added in the 2019 Update. no new methods were applied. A review of cutsets shows that this modeling plays a role in results and that results are as expected.

Extended Power Uprate. This No No No --- Maintenance Updated thermal hydraulic analyses, HEP change was addressed in the 2014A timing, and success criteria consistent with the Update. updated power level. Existing event tree and fault tree logic used for the PRA and no new methods were applied.

Removed correction factors from No No No --- Maintenance Removed correction factors from SSIE fault SSIE fault trees, in response to 2019 trees, and created recovery events instead, FSPR F&O 5-1, 8-1, 8-2. Findings also created CCF 8760 hr mission time were closed via the 2020 F&O grouping instead of 24 hr.

Closure Review.

Notes to Table RAI7-1:

1. New Method: Consistent with Table A-1 of RG 1.200, Rev. 2, the term new method refers to an analysis method (i.e., not documentation method) that is new to the subject PRA even if the method itself is not new and has been applied in other PRAs. This term also encompasses newly developed methods in the industry that have been implemented in the base PRA in question.

2. Change in Scope: Consistent with Section C of RG 1.200, Rev. 2, the term PRA scope is defined in terms of the following three attributes: (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

3. Change in Capability: Consistent with concepts in RG 1.200, Rev. 2 as well as the basis for Capability Category distinctions in the PRA Standard, this term is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 17 of 78 Docket No. 50-410 criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the Capability Category (from Not Met or CC-I to CC-II) for one or more SRs.

4. Impact on Significant Accident Sequences or Significant Accident Progression Sequences: This term encompasses both Level 1 (core damage) and Level 2 (post-core damage) accident sequences. This criterion is interpreted in this context of PRA Upgrade as the top 95% of sequences and whether the makeup of those sequences have been significantly impacted.

Whether the makeup of the top 95% of the sequences is determined to be significantly impacted is based on a qualitative consideration as to whether the change in the sequences would likely change decision making when applying the PRA in risk applications. For example, top sequences in the top 95% that for the model change drop out of the top 95% would be a case where justification should be provided as to why the change in question is not considered an upgrade or it should be identified as an upgrade. NOTE: Per the ASME PRA Standard Addenda A and RG 1.200, Rev. 2 definition of PRA upgrade, this criterion is logically ANDed with the other criteria of first having to be a change in scope or a change in capability.

5. Definition of PRA Upgrade: The definition of a PRA Upgrade used here is the definition provided in Section 1-2 of the PRA Standard ASME/ANS RA-Sa-2009. This definition is summarized as follows (the criteria terms are explained in the preceding notes):

A model change is classified as a PRA upgrade if it satisfies one of the following three criteria:

(1) new methodology

-OR-(2) change in scope that (i.e., AND) impacts the significant accident sequences or the significant accident progression sequences

-OR-(3) change in capability that (i.e., AND) impacts the significant accident sequences or the significant accident progression sequences

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 18 of 78 Docket No. 50-410 Response to RAI-7 b)

The first Focused Scope Peer Review of the NMP2 FPIE PRA (since the 2009 full peer review) was held in 2019 to address a change in method relating to the development of support system initiating event fault trees. This focused scope peer review led to 3 additional finding F&Os; the 3 SSIE-related Finding F&Os (F&O 5-1, 8-1, and 8-2) were closed during a Closure Review held in 2020. See also RAI 6 for more background on these findings.

The second Focused Scope Peer Review was held in 2020 to address the change in HRA method involved in replacing the HCR/ORE Method with the ASEP method. The change from HCR/ORE to ASEP was classified as an Upgrade (refer to Table RAI7-1) and required a focused-scope peer review. The 2020 Focused Scope Peer Review led to three additional F&Os 20-1, 20-2, 20-3. These findings primarily involve improving HRA documentation, additional detail is provided below.

F&O Number and Description Suggested Status Resolution F&O 20-1: There is no consistency check in the Perform a This F&O was a HRA Notebook; Section 3.13 on page 3-22 states reasonableness check documentation edit that 'No NMP2 information was readily available'. consistent with the involving the HRA A limited review was performed by the 2020 review issues cited in the Basis notebook, but it did team and it was determined that screening values for this Finding and not involve any model do not have sufficient documentation in the HRA document it in the HRA changes, and thus notebook to justify reasonableness and there is no Notebook. will have no impact documented evidence that any type of consistency on the RICT. This review after the methodology was changed from finding has been HCR/ORE to ASEP. NMP2 stated in a comment addressed in the that a review of reasonableness check was current HRA performed for a previous peer review but was not Notebook but has not documented. been subjected to an F&O Closure Review.

F&O 20-2: All NMP2 FPIE HFEs that are quantified Re-write section 4.2 to This F&O was a in the HRA Calculator with detailed analysis use align with how all NMP2 documentation edit ASEP TRC+CBDTM+THERP. The discussion on post-initiator actions are involving the HRA the ASEP TRC in Section 4.2.2 agrees with what actually quantified. notebook, but it did was actually done for cognitive modeling, but Table Revise Table 4-1 to not involve any model 4-1 (in particular items 8.g, 10 and 11) and Table reflect the methods that changes, and thus 4-5 discuss the ASEP method for 'Post-Diagnosis' were used. Delete will have no impact modeling (meaning Execution errors), which is Tables 4-4 and 4-5 since on the RICT. This confusing and not what was used. those methods were not finding has been used in the analysis addressed in the current HRA Notebook but has not been subjected to an F&O Closure Review.

F&O 20-3: Item (c) of the SR relates to factors Within the HRA This F&O was used in quantification. These are discussed in Calculator database, the primarily a Section 3.0

SUMMARY

OF NINE MILE POINT text for each action documentation edit UNIT 2 CHARACTERISTICS AFFECTING THE should be reviewed and involving the HRA HRA and how they were incorporated in the updated to reflect what notebook. T = 0 was quantification is discussed in Sections 4.1 & 4.2 for is actually included in edited to be the CBDTM and ASEP methods, respectively. the model. Additionally, consistent; this However, there is no specific discussion of how involved a few Level

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 19 of 78 Docket No. 50-410 F&O Number and Description Suggested Status Resolution ASEP does not use Tcog and how the cognitive the main body of the 2 actions that did timing is apportioned into Texe (or Tdelay in some HRA Notebook should: need correction, but cases). (a) include a discussion the edits were HEP-on the timeline and each neutral (meaning no of the timing parameters quantitative impact).

(as used in the HRA Thus, these changes, Calculator) and how they will have no impact are determined for the on the RICT. This ASEP method. (b) clarify finding has been what is T=0 and if it was addressed in the consistently defined the current HRA same way for all actions. Notebook and HRAC but has not been subjected to an F&O Closure Review.

Response to RAI-7 c)

Table RAI7-2 provides a summary of CDF and LERF in the 2009 PRA which was Peer Reviewed and for subsequent PRA Updates. As can be seen, CDF and LERF have been reduced significantly.

TABLE RAI7-2 TRUNCATION TRUNCATION MODEL DATE CDF LERF LIMIT LIMIT 2009 07/09 8.7E-06/yr 1E-13 4.6E-07/yr 1E-13 2014A 12/14 2.00E-06/yr 1E-13 2.80E-07/yr 1E-13 2016A 3/17 1.78E-06/yr 1E-13 2.56E-07/yr 1E-13 2019A 3/20 1.70E-06/yr 1E-12 2.23E-07/yr 1E-12 The following model CDF result and cutset comparisons show the key PRA changes that lead to the PRA reductions:

• The 2009 Model was dominated by cutsets with failure of Division 2 vital AC which caused containment venting failure (120VAC solenoids inside containment). HEP ZCV06 was set to 1.0 to model this and the CDF-FV for this HEP was 0.496 in 2009.

The containment venting mod eliminated this condition and led to significantly improved results. The same methods were used to model this issue throughout the evolution of the PRA and this improvement is an expected result of a risk-reduction initiative and this does not represent a change in methods or capability category which would lead to upgrade classification.

• The 2009 Model included another HEP which was set to 1.0 due to plant conditions.

ZHS03 (2009 CDF-FV=0.197) modeled operators aligning fire water to cool the HPCS EDG. This is a desirable strategy because the Div 1 and 2 EDGs provide Service Water to cool the HPCS EDG and the HPCS EDG is dependent on success of one of the

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 20 of 78 Docket No. 50-410 Divisional EDGs. In 2009 there was no procedure for this action so the HEP was set to 1.0. Following the 2009 update, the plant initiated a modification and procedure improvements to allow operators to implement this strategy. Crediting the modification and procedure greatly reduced PRA results. The same methods were used to model this issue throughout the evolution of the PRA and this improvement is an expected result of a risk-reduction initiative and this does not represent a change in methods or capability category which would lead to upgrade classification.

For CDF, these two changes resulted in an approximate 70% reduction (FV 0.496+0.197). The 2009 result of 8.7E-6/yr multiplied by the reduction (i.e., 1-0.7) equals 2.61E-6/yr which slightly above the current PRA result. Other improvements noted in Table RAI7-1 lead to the further reductions yielded by the PRA. These changes do not represent upgrades because there is no change in methods or capability category associated with crediting risk management informed plant improvements. In fact, the two most risk significant changes were explicitly included in the 2009 peer reviewed model but were simply set to 1.0 because the plant had not yet implemented the PRA-identified improvements.

The following model LERF result and cutset comparisons show the key PRA changes that lead to the PRA reductions:

• In the 2009 Model LERF was dominated by station blackout scenarios. These are important at NMP2 because NMP2, unlike other BWRs, uses normally open MOVs for containment isolation. Drywell equipment and Floor Drain isolation valves require AC power to close. ZHS03 (2009 LERF-FV=0.63) modeled operators aligning fire water to cool the HPCS EDG. This is a desirable strategy because the Div 1 and 2 EDGs provide Service Water to cool the HPCS EDG and the HPCS EDG is dependent on success of one of the Divisional EDGs. In 2009 there was no procedure for this action so the HEP was set to 1.0. Following the 2009 update, the plant initiated a modification and procedure improvements to allow operators to implement this strategy. Crediting the modification and procedure greatly reduced LERF results. The same methods were used to model this issue throughout the evolution of the PRA and this improvement is an expected result of a risk-reduction initiative and this does not represent a change in methods or capability category which would lead to upgrade classification.

For LERF, this one change resulted in an approximate 63% reduction (FV 0.63). The 2009 result of 4.7E-7/yr multiplied by the reduction (i.e., 1-0.63) equals 1.7E-7/yr which slightly above the current PRA result. Other updates noted in Table RAI7-1 reflect the current LERF yielded by the PRA. These changes do not represent upgrades because there is no change in methods or capability category associated with crediting risk management informed plant improvements.

In fact, the most risk significant change was explicitly included in the 2009 peer reviewed model but was simply set to 1.0 because the plant had not yet implemented the PRA-identified improvement.

During the PRA Update process, Exelon conducts a challenge review of the PRA Model. The purpose of the challenge review is to have an independent assessment of the PRA model and documentation. This review is performed towards the end of a PRA update; after all quantitative model changes have occurred, but before any documentation sign off. Similar to a peer review, the challenge review consists of a pre-onsite phase, an onsite phase, and a post-onsite phase.

Independent reviewers evaluate PRA notebooks and perform a cutset review to confirm model results are appropriate. Additionally, all model changes are evaluated to determine if any potential upgrades have occurred per the guidance provided in the ASME/ANS PRA Standard.

Any inconsistencies noted are provided as recommendations in a report to the PRA team. The

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 21 of 78 Docket No. 50-410 NMP2 PRA model was updated per Exelons procedural requirements in 2014, 2016, and 2019; a challenge review was performed during each update. The challenge reviews performed in 2019 and 2016 identified the HCR/ORE method change, and Support-System Initiating Event fault trees respectively, as requiring peer reviews.

RAI 8

Section 2.3.4 of NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document,"

(ADAMS Accession No. ML12286A322) specifies that "[c]riteria shall exist in PRA configuration risk management to require PRA model updates concurrent with implementation of facility changes that significantly impact RICT calculations."

LAR Enclosure 7 states that if, "a plant change or a discovered condition is identified that has a significant impact on the RICT Program calculations [], an unscheduled update of the PRA models will be implemented." The LAR does not explain under what conditions an unscheduled update of the PRA model will be performed or the criteria defined in the plant procedure that will be used to initiate the update.

Therefore, describe the conditions under which an unscheduled PRA update (i.e., less than once every two refueling cycles) would be performed, the criteria that would be used to require a PRA update and how the impact on RICT estimates is considered. In the response, define what is meant by "significant impact to the RICT Program calculations."

Exelon Response to RAI 8 The Exelon Risk Management FPIE & FPRA Model Update procedures require an evaluation of plant changes or discovered conditions (tracked as Updating Requirement Evaluations or UREs) against an extensive list of criteria including change in CDF/LERF. A Risk Management Engineer will evaluate each URE to determine whether the MOR should be updated expeditiously or the update can be delayed to the next periodic update. This determination will be made based on whether the PRA model fidelity (representation of the as-built, as operated plant) without the update is adequate to support PRA applications that are currently in effect.

This is determined either by qualitative screening or Working model updates for potentially significant changes.

Some of the PRA Unscheduled Update Criteria are listed below

• CDF or LERF change >25%

• CDF>1E-5

• LERF>1E-6

• Significant change in accident class or sequence (greater than factor of 2 increase in an accident class that contributes >5% risk)

• Configuration risk increase factors that could breach the color thresholds used in Maintenance Rule a(4).

These evaluations, particularly the check on significant sequences and configuration risk, ensure changes that could significantly impact RICT calculations initiate an unscheduled PRA model update or result in administrative limits on the RICT program per Exelon procedures (for example, limiting the use of RICT to LCOs where the impact of the condition is not significant).

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 22 of 78 Docket No. 50-410

RAI 9

The NRC staffs safety evaluation (SE) to NEI 06-09, Revision 0-A specifies that the LAR should provide a comparison of the TS functions to the PRA modeled functions and that justification be provided to show that the scope of the PRA model is consistent with the licensing basis assumptions. Table E1-1 in Enclosure 1 of the LAR identifies each TS LCO proposed to be included in the RICT program and describes how the systems and components covered in the TS LCO are implicitly or explicitly modeled in the PRA. For certain LCOs, the LAR did not provide sufficient description of the PRA modeling that will be used in the RICT calculations.

Therefore, address the following:

a. For TS LCO 3.6.1.7 (Suppression Chamber-to-Drywell Vacuum Breakers), Condition A (One line with one or more suppression chamber-to-drywell vacuum breakers inoperable for opening), LAR Table E1-1 states that the "PRA model includes one failure mode:

lines fail to close after initially opening. The model will be updated to include this failure mode prior to exercising the RICT program for this TS." The meaning of text is not clear.

Based on the text, it appears that the PRA model already includes the failure mode that could be used to calculate the RICT. The implementation item table presented in LAR Attachment 6 has the same wording as used in the comment column of this TS LCO Condition.

i. Explain how failure to open of the Suppression Chamber-to-Drywell Vacuum Breakers impacts the core damage frequency (CDF) or large early release frequency (LERF) and how a change in CDF and LERF can be calculated for the RICT estimate.

ii. Explain and justify the PRA model changes proposed for the implementation item associated with TS LCO Condition 3.6.1.7.A.

b. For TS LCO 3.7.1 (Service Water System and Ultimate Heat Sink), Condition C (One service water subsystem inoperable for reasons other than Conditions A and B), LAR Table E1-1, states that the:

[] success criteria are consistent with the design basis except when UHS temperature is > 82 [degrees Fahrenheit] °F. The model is being updated to include this condition prior to exercising the RICT program for this TS.

The implementation item table presented in LAR Attachment 6 has the same wording as used in the comment column of this TS LCO condition. This seems to imply that the success criteria that will be used in the PRA models to complete the implementation item associated with TS LCO Condition 3.7.1.C will be the same as the design-basis success criterion, "four of six pumps during a loss of coolant accident (LOCA) without a loss of off-site power and ultimate heat sink greater than 82 °F and less than or equal to 84 °F."

Describe and justify the PRA model update.

c. For TS LCO 3.3.5.1 (Emergency Core Cooling System (ECCS) Instrumentation),

Condition E (ECCS Actuation instrumentation for low pressure core spray (LPCS), low pressure coolant injection (LPCI), high pressure core spray (HPCS)), LAR Table E1-1, states that the failure of the HPCS minimum flow valve will be used as a surrogate for HPCS discharge instrumentation failure.

i. Explain how failure of the HPCS minimum flow valve is deemed conservative compared to failure of HPCS discharge instrumentation.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 23 of 78 Docket No. 50-410 ii. Explain how actuation instrumentation for LPCS and LPCI is modeled in the PRA and how a RICT estimate can be calculated.

d. LAR Table E1-1 indicates for TS LCO 3.5.1 (Low Pressure ECCS Injection/Spray),

Condition A (One low pressure ECCS injection/spray subsystem inoperable), that the PRA success criterion is "One of four subsystems," while the design-basis success criterion is "Two of four subsystems." The explanation for this difference was not provided in LAR Table E1-1 and is not clear to the NRC staff. The comment column indicates for this LCO condition that the "success criteria are consistent with the design basis for each train." Therefore, address the following:

Clarify and justify the PRA success criteria used to model systems associated with TS LCO Condition 3.5.1.A, Low Pressure ECCS Injection/Spray, and provide justification for the less demanding success criteria.

e. For TS 3.3.7.2 (Mechanical Vacuum Pump Isolation Instrumentation), Condition A (one or more channels inoperable), the first implementation item listed in Attachment 6 of the LAR states that:

SSCs are not modeled. The model will be updated to include these SSCs prior to exercising the RICT program for this TS. The PRA Success Criteria will match the Design Success Criteria.

i. Describe the proposed PRA modeling associated with TS 3.3.7.2.A.

ii. Explain how the inoperability of the mechanical vacuum pump isolation instrumentation impacts CDF or LERF and how a change in CDF and LERF can be calculated for the RICT estimate.

iii. If applicable, provide an update to the associated implementation item.

f. For TS LCO 3.7.1.D (One division of intake deicer heaters inoperable), the fifth implementation item listed in Attachment 6 of the LAR states that "the intake deicer heaters are not directly modeled in the PRA. The model will be updated to explicitly include these components prior to its use with RICT []."

i. Describe the proposed PRA modeling associated with TS 3.7.1.D.

ii. Explain how the inoperability of the deicer heaters impacts the CDF or LERF and how a change in CDF and LERF can be calculated for the RICT estimate.

iii. Describe how success criteria associated with intake deicer heaters will be tracked in the Real-Time Risk (RTR) model.

iv. If applicable, provide an update to the associated implementation item.

g. For TS LCO 3.7.5 (Main Turbine Bypass System), Condition A (Main Turbine Bypass System - Requirements of the LCO not met), LAR Table E1-1, indicates that the PRA success criterion is "Three of five bypass valves," while the design-basis success criterion is "Five of five bypass valves." The explanation provided in the comment column of table for this entry states that the "PRA success criteria is based on the minimum valves required to prevent major demands on the suppression pool." The function of the main turbine bypass valves as stated in LAR Table E1-1 is to "control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown." Accordingly, it is not clear how preventing major demands on the suppression pool is equivalent to limiting peak

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 24 of 78 Docket No. 50-410 pressure in the main streamlines and reactor to acceptable limits. Therefore, address the following:

i. Explain the PRA modeling for the main turbine bypass system and its impact on CDF and LERF.

ii. Justify that successful opening of three of five main turbine bypass valves is sufficient to fulfill the safety function of these valves under TS LCO Condition 3.7.5.A in the accident scenarios modeled in the PRAs.

Exelon Response to RAI 9 Response to RAI-9 a)

As indicated in Enclosure 1 Table E1-1, TS LCO Condition 3.6.1.7.A refers to One line with one or more suppression chamber-to-drywell vacuum breakers inoperable for opening. Since submitting the License Amendment Request (LAR), the PRA model has been updated to include failure of the suppression chamber-to-drywell vacuum breakers to open. SSCs are modeled consistent with the TS scope and so can be directly included in the Real Time Risk (RTR) tool for the RICT program. The success criteria are consistent with the design basis.

The RTR tool will be updated in accordance with Exelon procedures to reflect these PRA model changes.

Response to RAI-9 b)

The Design Success Criteria in Table E1-1 for TS LCO Condition 3.7.1.C is listed as Two of six pumps during a LOCA concurrent with a LOOP. Three of six pumps during a LOCA without a LOOP and UHS temperature <= 82°F. Four of six pumps during a LOCA without a LOOP and UHS temperature > 82°F and <= 84°F. The PRA model update incorporated more specific information for Service Water (SW) system alignment during conditions when the Ultimate Heat Sink (UHS) is greater than 82 F. When the UHS is greater than 82 F, it is assumed 5 SW pumps are running and the PRA Success Criteria for SW is four of six SW pumps for a LOCA without a LOOP, consistent with the Design Success Criteria listed in Table E1-1.

Success criteria for the service water system align with the design success criteria based on UHS temperature, i.e. an additional SW pump required when high UHS temperature and deicers required when UHS temperature is low. UHS temperature will either be tracked explicitly in PARAGON or the conservative assumption for the configuration will be used (low temperature if deicer is OOS or high temperature otherwise). No other success criteria change based on seasonal variation.

Response to RAI-9 c)

The minimum flow instruments are provided to protect the HPCS pump from overheating when the pump is operating, and the associated injection valve is not sufficiently open to ensure adequate ECCS flow during transients and accidents. The HPCS discharge instrumentation is directly modeled in the PRA consistent with the TS scope and so can be directly included in the RTR tool for the RICT program. The success criteria are consistent with the design basis.

Response to RAI-9 d)

The PRA Success Criteria of one Low Pressure Core Injection (LPCI) pump is based on a MAAP calculation for a Large LOCA (LLOCA) scenario, which is a bounding scenario for Low Pressure ECCS Injection/Spray. Furthermore, sensitivity studies using more restrictive LPCI

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 25 of 78 Docket No. 50-410 PRA Success Criteria (e.g. two of four subsystems) demonstrate that the RICT calculations are not sensitive to this PRA model assumption.

Response to RAI-9 e)

Per the T S Bases, the Mechanical Vacuum Pump Isolation Instrumentation initiates a trip of the main condenser mechanical vacuum pumps and isolation of the associated isolation valve following events in which main steam line radiation exceeds predetermined values. Tripping and isolating the mechanical vacuum pumps limits the offsite doses in the event of a control rod drop accident (CRDA).

The PRA model assumes that in scenarios where the main condenser pressure boundary remains intact there is some likelihood the condenser vacuum pump pathway fails to isolate, which can lead to a Large Early Release for LOCAs outside of containment.

This mitigating function is directly modeled in the PRA consistent with the TS scope and so can be directly included in the RTR tool for the RICT program. The success criteria are consistent with the design basis. The RTR tool will be updated in accordance with Exelon procedures to reflect these PRA model changes.

A sample RICT for this TS LCO is 30 days based on the most limiting result of CDF and LERF calculations.

Response to RAI-9 f)

The LOCA/LOOP is the most limiting condition for the intake deicer heater requirements.

During a LOCA/LOOP, 14 heaters are available in one division (assuming a DG failure) per intake structure to support the two required SW pumps. Failure of both divisions in conjunction with cold enough lake temperature to require needing the deicers, 38 F, is assumed to fail the service water system.

Success criteria for the service water system align with the design success criteria based on UHS temperature, i.e. an additional SW pump required when high UHS temperature and deicers required when UHS temperature is low. UHS temperature will either be tracked explicitly in PARAGON or the conservative assumption for the configuration will be used (low temperature if deicer is OOS or high temperature otherwise). No other success criteria change based on seasonal variation.

The intake deicer heaters are directly modeled in the PRA consistent with the TS scope and so can be directly included in the RTR tool for the RICT program. The success criteria are consistent with the design basis. The RTR tool will be updated in accordance with Exelon procedures to reflect these PRA model changes.

A sample RICT for this TS LCO is 30 days based on the most limiting result of CDF and LERF calculations.

Response to RAI-9 g)

The turbine bypass capability is 23% of rated full power (RFP) at NMP2 and the NMP2 PRA credits 3 of 5 turbine bypass valves (TBVs) which would provide roughly ~13.5% of RFP. For all non-anticipated transient without SCRAM (non-ATWS) scenarios, this capability (i.e., 13.5%)

can comfortably address decay heat removal (DHR) requirements, with margin, and requiring minimal safety relief valve (SRV) actuations and a minimal related suppression pool heat up challenge.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 26 of 78 Docket No. 50-410 Given a full-power, un-mitigated ATWS, power can exceed 40% RFP which is in excess of the full turbine bypass capability as well as the PRA credited turbine bypass capability. Thus, given an ATWS event, NMP2 will experience a Suppression Pool Heat up challenge regardless of the exact number of functioning TBVs. The NMP2 ATWS response includes Recirc pump trip (RPT), standby liquid control (SLC) actuation, and automatic depressurization system (ADS) inhibit, along with operator control of RPV level. This response, as addressed in NMP2 Emergency Operating Procedure N2-EOP-C5 Failure to SCRAM, is designed to bring RPV Power to less than 4% RFP without rod movement and the PRA success criteria is consistent with this response. 4% RFP is within the PRA credited Turbine Bypass Capability and the PRA success criteria requires combinations of related mitigation functions and actions consistent with this plant response. Combinations of mitigation failures which result in excessive power production are directed to core damage endstates or ATWS scenarios without the Main Condenser.

Overall, the success criteria of turbine bypass is judged to represent and appropriate balance between calculated system reliability and the systems overall capability to support ATWS and non-ATWS event mitigation. Given Core Damage or ATWS with the Main Condenser Unavailable, Large, Early Release likelihood would be dictated by containment performance issues separate from whether the TBV success criteria is 3 of 5 or 5 of 5.

As indicated in Enclosure 1 Table E1-2, a sample RICT calculation for this TS LCO Condition gives a RICT of 30 days based on the most limiting result of CDF and LERF calculations.

RAI 10

Regulatory Position 2.3.3 of RG 1.174, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

(ADAMS Accession No. ML17317A256) states that:

[t]he level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

Additionally, NEI 06-09, Revision 0-A states:

If the PRA model is constructed using data points or basic events that change as a result of time of year or time of cycle (examples include moderator temperature coefficient, summer versus winter alignments for HVAC, seasonal alignments for service water), then the RICT calculation shall either 1) use the more conservative assumption at all time, or 2) be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration for the feature as modeled in the PRA.

LAR Enclosure 8, Section 2, states that, "[t]he impact of outside temperatures on system requirements like seasonal service water pumps were evaluated and found no dependent flags were needed to be addressed in the CRMP model." LAR Enclosure 9, Table E9-1, indicates that the industry data used in the PRA models includes data for weather-related loss-of-offsite power. The NRC staff notes that seasonal variations in weather conditions include environmental factors besides temperature.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 27 of 78 Docket No. 50-410

a. Explain how any changes in initiator frequency due to seasonal variations is accounted for in the RTR model used in the RICT calculations. If changes in initiator frequency due to seasonal variation are not addressed in the RTR model, then provide justification for this simplification.

b. Explain how any changes in plant response success criteria based on seasonal variations are accounted for in the RTR model used in the RICT calculations. If changes in plant response success criteria due to seasonal variation are not addressed in the RTR model, then provide justification for this simplification.

c. For any items identified in parts (a) and (b) above, describe any additional Risk Management Actions (RMAs) that will be performed.

Exelon Response to RAI 10 Response to RAI-10 a)

Modeled seasonal variables were reviewed and one modeled seasonal variable was identified.

Ultimate heat sink temperature changes success criteria for the service water system when UHS temperature is >82 F and changes success criteria for the newly modeled deicer (required when UHS < 38F). These conditions will be accounted for in the RTR tool as described in part b). The RTR modeling will propagate through the support system initiating event fault tree to impact Loss of Service Water frequency.

LOOP initiator frequency will not be adjusted due to seasonal variation in the RTR model used for RICT calculations. LOOP Frequency is weather-dependent and no standard industry practice exists for seasonal adjustments to LOOP frequency. Existing industry and site data do not support determination of a LOOP frequency multiplier given the range of outcomes from a Severe Storm Warning (anything from short drenching rains to rapid succession lightning strikes to straight winds and tornadoes). In 2015 an industry benchmark was performed and there is no industry consensus on quantitatively assessing severe weather conditions. While some utilities used a multiplier for LOOP frequency, there is weak technical basis the value of the multiplier used. Because of the uncertainty involved and since there is no definitive way to calculate a precise increase in LOOP frequency when severe weather conditions are imminent; Exelon developed the approach of declaring a High Risk Evolution (HRE) and performing a qualitative evaluation for the risk assessment when severe weather conditions exist. Due to the High Risk Evolution the site would take appropriate risk management actions as described in part c.

Response to RAI-10 b)

Success criteria for the service water system align with the design success criteria based on UHS temperature, i.e. an additional SRW pump required when UHS temperature is > 82 degrees F and 1 deicer train required when UHS temperature is below 38 F. UHS temperature will either be tracked explicitly in PARAGON or the conservative assumption for the configuration will be used (low temperature if deicer is OOS or high temperature otherwise). No other success criteria change based on seasonal variation.

See LOOP discussion in a) for justification of not tracking weather to adjust LOOP frequencies.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 28 of 78 Docket No. 50-410 Response to RAI-10 c)

Risk Management actions for hot ultimate heat sink and cold ultimate heat sink will be identified according with Enclosure 12 of the NMP2 RICT LAR as well as the site Operations procedures for adverse condition monitoring and severe weather / natural disasters. Examples would be to stage materials to combat frazil ice or verification of traveling screen availability for extreme cold conditions and increased intake temperature monitoring or verification of HVAC availability for high temperature.

Conditions requiring the LOOP HRE (such as Severe Thunderstorm Warning, Tornado Warning or Solar Magnetic grid disturbances) are proceduralized in the Exelon Work Control procedures and appropriate risk management actions such as deferring any AC power maintenance may be taken as a result of the HRE. In addition a separate Operation procedure provides guidance for severe weather mitigation such as restoring ECCS or other system equipment to cope with severe weather, holding shift briefings for potential weather impacts and reviewing LOOP procedures as well as guidance for specific threats such as removing potential on site missiles for high wind conditions or additional intake monitoring for blizzard conditions.

RAI 11

The NRC staff SE to NEI 06-09, Revision 0-A, specifies that the LAR should identify key assumptions and sources of uncertainty and assess and disposition each as to their impact on the RMTS application.

Section 5.3 of NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Final Report," (ADAMS Accession No. ML17062A466), presents guidance on the process of identifying, characterizing, and qualitative screening of model uncertainties.

LAR Enclosure 9 states that the process for identifying key assumptions and sources of uncertainties for the internal events PRA and fire PRA (FPRA) was performed using the guidance in NUREG-1855, Revision 1. It states that the internal events and FPRA models and notebooks were reviewed for plant-specific key assumptions and sources of uncertainty.

Further, the LAR states that generic sources of uncertainty for the internal events PRA were identified from Electric Power Research Institute (EPRI) Technical Report (TR)-1016737, "Treatment of Parameter and Modeling uncertainty for Probabilistic Risk Assessments" and for the FPRA from EPRI TR-1026511, "Practical Guidance of the Use of Probabilistic Risk Assessment in Risk-informed Applications with a Focus on the Treatment of Uncertainty." The LAR does not describe the process and the criteria used to identify, from the initial comprehensive list of assumptions and sources of uncertainty in the base PRA model(s)

(including those associated with plant-specific features, modeling choices, and generic industry concerns), the specific key assumptions and sources of uncertainties presented in the LAR.

Describe, separately for the internal events, internal flooding and the fire PRAs, the process used to identify and evaluate key assumptions and sources of model uncertainty. Address the following in the response:

a. Discuss how a comprehensive list of plant-specific and generic industry key assumptions and sources of uncertainty were identified as a starting point for this evaluation.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 29 of 78 Docket No. 50-410

b. Explain how the comprehensive list of key assumptions and sources of uncertainty sources was screened to a list of uncertainties that were specifically evaluated for their impact on the RICT application.

c. Explain what criteria, qualitative or quantitative, or what additional analysis were used to evaluate the impact of the key assumptions and sources of uncertainty on the RICT application.

Exelon Response to RAI 11 Response to RAI-11 a)

This uncertainty identification process is consistent with NUREG-1855, Revision 1 as referenced in Reg. Guide 1.200 Rev. 2 guidance. For the Identification of Sources of Model Uncertainty and Related Assumptions, Tables A-1 and A-2 of EPRI 1016737 were used to identify potential sources of model uncertainty for the internal events and internal flooding PRA models. Appendix B and Appendix E of EPRI 1026511 were used to identify potential sources of model uncertainty in the fire PRA and Level 2 PRA model, respectively. Unique plant-specific issues and assumptions were also considered in the identification process based on the PRA Notebooks which document the PRA models.

Response to RAI-11 b)

This screening process is consistent with NUREG-1855, Revision 1 as referenced in Reg.

Guide 1.200 Rev. 2 guidance. In particular, the NUREG Stage E process, Assessing Model Uncertainty, was used as described below:

• Step E-1.1 (Identification of Sources of Model Uncertainty and Related Assumptions):

Identification, as noted in the response to part (a), above.

• Step E-1.2 (Identification of Relevant Sources of Model Uncertainty and Related Assumptions): This step allows for screening of potential sources of model uncertainty based on the parts of the models used for the application. Since the Risk-Informed Completion Time evaluations involve complete model re-quantification for each case analyzed, no specific potential sources of uncertainty were screened out for this application.

• Step E-1.3 (Characterization of Sources of Model Uncertainty and Related Assumptions): Per the guidance in NUREG-1855 and the associated EPRI reports, the characterization process involves identifying: 1) the part of the PRA model affected, 2) the modeling approach or assumptions utilized in the model, 3) the impact on the PRA model, and 4) representation of conservative bias (if applicable). These considerations were included in the evaluation of the potential sources of model uncertainty.

• Step E-1.4 (Qualitative Screening of Sources of Model Uncertainty and Related Assumptions): This step allows for screening out potential sources of model uncertainty by referencing consensus model approaches. The evaluation process included identifying the approach utilized (e.g., consensus approach or other applicable guidance) and using those considerations as the means to qualitatively screen potential impacts on the application.

• Step E-1.5 (Identification and Characterization of Relevant Sources of Model Uncertainty and Related Assumptions Associated with Model Changes): The implementation of the

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 30 of 78 Docket No. 50-410 RICT program utilizes the base PRA models. As such, no new sources of model uncertainty have been introduced for the application.

• Step E-2 (Identification of Key Sources of Model Uncertainty and Related Assumptions):

As described in NUREG-1855, only the relevant sources of uncertainties and related assumptions with the potential to challenge the applications acceptance guidelines are considered key. Also, per NUREG-1855, if any sources of uncertainty do challenge the acceptance guidelines, then appropriate compensatory measures or performance monitoring should be identified to help minimize the risk. In the case of RICT, appropriate compensatory measures will be in place prior to the RMAT being exceeded and for the remaining duration of the RICT configuration. RMAs will be developed as described in Enclosure 12 of the LAR using insights from the PRA models and other good practices (e.g., minimizing durations of maintenance activities and minimizing work on redundant trains of equipment). Additionally, Enclosure 11 of the LAR describes the performance monitoring that will be associated with the RICT program. As such, the overall RICT program implementation is consistent with Step E-2 of NUREG-1855.

Response to RAI-11 c)

NEI 06-09 Risk-Managed Technical Specifications (RMTS) Guidelines includes guidance on considering uncertainty (i.e., Section 3.3.4 Uncertainty Consideration in a RMTS Program).

This guidance, which is best described as qualitative, was used for NMP2. This NEI 06-09 guidance directs the identification of sources of uncertainty and the applicable SSCs and PRA elements impacted. It further directs the use of sensitivity studies to inform compensatory Risk Management Actions (RMAs) which are intended to limit the impact of reasonable alternate modeling assumptions.

Responses to questions (a) and (b) above describe the uncertainty identification and screening process used for NMP2. As part of the identification and screening of uncertainties for NMP2, identification of alternate modeling assumptions is also presented, as appropriate, as well as any sensitivity study results. The NMP2 discussions provided for each identified uncertainty in of the LAR provide background to inform the RMAs, consistent with the NEI 06-09 guidance.

In reviewing the NMP2 PRA uncertainty information, the main insight from the uncertainty study is that operator action/reliability is an important aspect of managing and mitigating uncertainty inherent in the PRA.

Exelon Risk Management procedures include direction to incorporate PRA model key assumptions and sources of uncertainty. As the NMP2 RMAs are developed, uncertainty insights will be considered and are expected to include, at a minimum, the identification of configuration specific operator actions with the most influence on the PRA.

RAI 12

The NRC staff SE to NEI 06-09, Revision 0-A, specifies that the LAR should identify key assumptions and sources of uncertainty and assess and disposition each for impact on the application. LAR Enclosure 9 Tables E9-1 and E9-3 identify the key assumptions and sources of uncertainty for the internal events and fire PRA and provide their associated disposition for the application. The NRC staff reviewed the key assumptions and sources of modeling uncertainty and their dispositions provided in the LAR and noted few items that appeared to have an impact on the RICT calculations. During the regulatory audit conducted May 4 to 7, 2020, the NRC staff also reviewed the Nine Mile Point 2 internal events and fire PRA

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 31 of 78 Docket No. 50-410 uncertainty analysis report and noted few additional items, not identified in the LAR, that appeared to have an impact on the RICT application. Therefore, address the following:

a. LAR Enclosure 9, Table E9-1, states that treatment of suppression pool strainers performance is a modeling uncertainty. The disposition to this modeling uncertainty states:

Because suction strainer failures impact all ECCS systems as a common-mode failure, any potential extended unavailability via RICT is not relevant. This item does not represent a key source of uncertainty for the RICT Application.

It is not clear why the assumed individual and common cause failure probabilities for the suppression pool strainers have no impact on the RICT calculations. The NRC staff notes that suppression pool strainer plugging contributes to the failure probability of ECCS systems and that LCOs exist in the RICT program for the ECCS. Accordingly, it appears that if the strainer plugging probability is underestimated, then the RICT for an ECCS system can be overestimated. Therefore, justify the conclusion that the uncertainty associated with suppression pool strainer performance has no impact on the RICT calculations.

b. LAR Enclosure 9, Table E9-1, states that:

Since BWRs are designed to maintain 2/3 core height for a very large break LOCA, injection by one LPCI pump into the shroud area may maintain the covered core sub-cooled. Cooling of the top 1/3 core for a substantial time is questionable, since long-term steam cooling effect may not be ensured. Nine Mile Point 2 assumes that a single LPCI pump is adequate, and there is no real evidence yet that this is not acceptable to prevent core melt.

The LAR also states that a set of sensitivity studies has been performed that shows this uncertainty has a minimal impact on the RICT calculation. However, the LAR does not describe those studies or provide the results.

Describe the sensitivity studies that were performed. Include a description of the assumptions that were made in the sensitivity cases and provide the results of the studies that support the conclusion that this uncertainty only has a minimal impact on the RICT calculations.

c. LAR Enclosure 9, Table E9-3, identifies detailed circuit analysis as a source of fire PRA modeling uncertainty because of conservatisms in the approach. The NRC staff notes that because detailed circuit analysis is resource-intensive, it is not typically performed on all circuits. The disposition to this source of uncertainty presented in Table E9-3 states that [] uncertainty (conservatism) that may remain in the fire (FPRA) is associated with scenarios that do not contribute significantly to the overall fire risk. It is not clear what the phrase contribute significantly to the overall fire risk means quantitatively. The NRC staff notes that uncertainties (e.g., assumed failures or assumed hot shorts) that have some impact on total fire risk could impact the RICT calculations for certain SSCs.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 32 of 78 Docket No. 50-410 Justify that the conservativism that exists in circuit analysis will not have an impact on RICT calculations.

d. The Nine Mile Point 2 PRA uncertainty analysis report reviewed by the NRC staff during the regulatory audit conducted May 4 to 7, 2020 identifies generic and plant specific sources of uncertainty and dispositions them for this application. The report identifies plugging of the intake from the lake (i.e., Ultimate Heat Sink (UHS)) to the Service Water (SW) system to be a source of uncertainty. Plugging can occur due to the existence of Zebra Mussels, frazil ice, high winds, and algae. The report explains that a certain initiating event is modelled as the common cause failure of the intake to the SW system from the lake. The report states that this represents "considerable uncertainty," but that this uncertainty is treated conservatively. The NRC staff notes that modeling conservatisms can mask the delta risk associated with taking certain components out of service and, therefore, can lead to underestimation of the delta risk and overestimation of a RICT. The NRC staff notes that LCO 3.7.1 (SW and UHS) Conditions A, C, D, E, and F are proposed to be in the RICT program and that RICTs calculated for these conditions could be impacted by this modeling conservatism. Therefore:

i. Given that risk can be masked in the RICT calculation for LCO 3.7.1 Conditions associated with the SW system, justify that the uncertainty associated with modelling the common cause plugging of the lake intake will have no impact on the RICT calculated for components associated with this LCO (e.g., one way to determine the impact is to perform a sensitivity study).

ii. Also, given that risk can be masked in the RICT calculation for TS LCO SSCs in the RICT the program that depend on the SW system, justify that the uncertainty associated with modelling the common cause plugging of the lake intake has no impact on the RICT estimates for other LCOs in scope of the RICT program.

iii. If in the response to part (i and ii) above, it cannot be justified that the uncertainty associated with modelling the common cause plugging of the lake intake has no impact on the application, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

e. The Nine Mile Point 2 PRA uncertainty analysis report reviewed by the NRC staff during the regulatory audit conducted May 4 to 7, 2020 identifies the development of special data variables as a source of uncertainty. This appears to refer to failure probabilities that were developed "based on judgment" for non-typical equipment for which failure data was not available. The disposition for this source of uncertainty states that the treatment is considered "reasonable" and that no "justifiable alternative" exists. It is not clear to the NRC staff what non-typical equipment is being referred to by the report or the basis used for the failure probabilities developed using "judgement." The NRC staff notes that even though non-typical equipment failure data may not be available, the uncertainty associated using failure probabilities based on judgment, none-the-less, represents a source of uncertainty. In light of these observation, address the following:

i. Briefly describe the non-typical equipment referred to in the uncertainty analysis report and explain the approach used to develop failure probabilities for this equipment based on judgment.

ii. Justify that the uncertainty associated with the non-typical equipment failure probabilities developed using judgment will have no impact on the RICTs

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 33 of 78 Docket No. 50-410 calculated for components associated with LCOs proposed to be included in the RICT program (e.g., one way to determine the impact is to perform a sensitivity study).

iii. If in the response to part (ii) above, if it cannot be justified that the uncertainty associated with the non-typical equipment failure probabilities developed using judgment will have no impact on the calculated RICTs, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

f. The Nine Mile Point 2 PRA uncertainty analysis report reviewed by the NRC staff during the regulatory audit conducted May 4 to 7, 2020 identifies the modelling associated with Main Control Room (MCR) abandonment due to loss of control (LOC) as a source of modelling uncertainty. The report explains that no credit was taken for MCR abandonment due to LOC, and therefore, the approach is considered to be conservative and to have only a small impact on the application. The report indicated that the modeling associated with MCR abandonment due to LOC required additional development beyond the modeling that was performed for MCR abandonment due to loss of habitability. The NRC staff notes that modeling conservatisms can mask the delta risk associated with taking certain components out of service and, therefore, can lead to underestimation of the delta risk and overestimation of a RICT. The NRC staff also notes that the fire risk contribution from MCR abandonment scenarios due to LOC may be significant. The report states that MCR abandonment from a main control board fire is the top CDF contributor and second highest risk LERF contributor. In light of these observation, address the following:

i. Justify that the uncertainty associated with not modelling or crediting MCR abandonment due to LOC will have no impact on the RICT estimates (e.g., one way to determine the impact is to perform a sensitivity study). Include identification of LCO Conditions that could potentially be impacted by this uncertainty.

ii. If, in the response to part (i) above, it cannot be justified that the uncertainty associated with not modelling or crediting MCR abandonment due to LOC will have no impact on the calculated RICTs, then explain how this uncertainty will be treated in the RICT program. Include discussion of any additional RMAs that would be implemented.

Exelon Response to RAI 12 Response to RAI 12 a)

The ECCS suction strainer plugging failure mode is overwhelmingly dominated by common-cause failure of all suction strainers. Thus, in a proposed RICT impacted alignment where a particular ECCS train is unavailable (e.g., Low Pressure Core Spray), that train-level unavailability is non-minimal to any cutsets with the common-cause suction strainer failure mode. If the suction strainer failure mode occurs, it is not significant whether the train taking suction from the pool is unavailable at t=0 or not, it is failed regardless. Thus, it was concluded that uncertainty in the ECCS suction strainer failure probability does not play a significant role in RICT results.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 34 of 78 Docket No. 50-410 In terms of a rigorous and complete response, it is worth noting that RCIC and HPCS can draw on the CST in addition to the suppression pool. Therefore, it is possible for RCIC and HPCS results to be affected by suppression pool suction strainer reliability. Thus, a sensitivity was performed on RCIC and HPCS results given an order of magnitude increase in common-cause suction strainer failure for both LOCA and non-LOCA conditions. The LAR results did not change in this sensitivity, see Table 12.a-1.

Table 12.a-1 Suppression Pool Suction Strainer Sensitivity ID TS Condition Function LAR Sensitivity Results 3-3-5-3-B_1 RCIC System Instrumentation - As Reactor Vessel Water 30 days 30 days required by Required Action A.1 Level - Low Low, Level 2 and referenced in Table 3.3.5.3-1.

3-3-5-3-B_2 RCIC System Instrumentation - As Reactor Vessel Water 30 days 30 days required by Required Action A.1 Level -High, Level 8 and referenced in Table 3.3.5.3-1.

3-3-5-3-D_1 RCIC System Instrumentation - As Pump Suction Pressure - 30 days 30 days required by Required Action A.1 Low and referenced in Table 3.3.5.3-1.

3-3-5-3-D_2 RCIC System Instrumentation - As Pump Suction Pressure - 30 days 30 days required by Required Action A.1 Timer and referenced in Table 3.3.5.3-1.

3-5-1-B_1 High Pressure Core Spray (HPCS) High Pressure injection into 30 days 30 days System inoperable. the RPV 3-5-1-C_4 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_7 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_8 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_9 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_10 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 35 of 78 Docket No. 50-410 Table 12.a-1 Suppression Pool Suction Strainer Sensitivity ID TS Condition Function LAR Sensitivity Results 3-5-3-A-2_1 RCIC System Inoperable. Supply high pressure 30 days 30 days makeup water to the RPV.

Response to RAI-12 b)

As noted in LAR Enclosure 9, Table E9-1, an assumption regarding credit for LPCI in LLOCA is subject to potentially significant uncertainty. Since BWRs are designed to maintain 2/3 core height for a very large break LOCA, injection by one LPCI pump into the shroud area may maintain the covered core sub-cooled. Cooling of the top 1/3 core for a substantial time is questionable since long term steam cooling effect may not be ensured. The base model assumes that one LPCI pump can prevent core damage for below-core Large LOCA (LLOCAW) events. In order to study this assumption, a few sensitivity cases were performed:

• Case 8.1-1: Assume 2 of 3 LPCI are required for LLOCAW

• Case 8.1-2: Assume 3 of 3 LPCI are required for LLOCAW

• Case 8.1-3: No Credit for LPCI in LLOCAW Table 12.b-1 provides the results of this study.

Table 12.b-1 LPCI in LLOCAW Sensitivity Cases (IEPRA Model NM219A at 1E-12/yr truncation)

Case CDF (/yr) Delta CDF (/yr) LERF (/yr) Delta LERF

(/yr)

Base (1/3 LPCI for LLOCAW) 1.7007E-06 n/a 2.2289E-07 n/a 1 (2/3 LPCI for LLOCAW) 1.7007E-06 0.00E+00 2.2289E-07 0.00E+00 2 (3/3 LPCI for LLOCAW) 1.7008E-06 1.0E-10 2.2295E-07 6.0E-11 3 (No LPCI in LLOCAW) 1.7010E-06 3.0E-10 2.2295E-07 6.0E-11 These results show that the model is insensitive to changes in the LPCI System success criteria required for LLOCAW. The change in CDF and LERF are small because the LLOCAW initiating event frequency is small (3.07E-6/yr) and HPCS and LPCS both remain available for event mitigation.

Response to RAI-12 c)

Unlike most Fire PRAs that utilize a significant percentage of circuit analysis from Appendix R, NMP2 utilized circuit analysis developed specifically for the Fire PRA. Consequently, the detailed circuit analysis credited in the NMP2 Fire PRA eliminates many conservatisms typically associated with mapping PRA basic events to cables selected for Appendix R functions. Circuit

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 36 of 78 Docket No. 50-410 failure probabilities were applied to the applicable basic events using the guidance from NUREG/CR-7150 Volume 2 which replaced the circuit failure probabilities provided in NUREG/CR-6850 Task 10 and the hot short duration guidance provided in FAQ 08-0051.

Aggregate values from NUREG/CR-7150 were used in lieu of cable specific values to address individual intra-cable hot shorts, inter-cable hot shorts, or ground equivalent hot shorts. The potential conservatism in the use of aggregate values is judged to be small. Additionally, the approach was not limited to specific scenarios but involved application of the circuit failure probabilities to the applicable basic events throughout the model. By not limiting the application of the circuit failure probability to the more risk significant scenarios, the events appeared in the cutsets (versus being TRUED out of the cutsets) which facilitated further inspection and refinement as necessary following cutset reviews. The circuit analysis methods were peer reviewed against the Supporting Requirements of the Cable Selection element of ASME/ANS RA-Sa-2009.

Response to RAI-12 d) i) The uncertainty in the frequency of plugging events that result in the loss of the Service Water (SW) system is an important contributor to the base model; however, the RICTs identified in this question would not be impacted by potential changes to the frequency of intake plugging. The reason is that the plugging event results in the failure of the entire SW system such that the status of the SW trains/functions/components does not impact the conditional core damage frequency or LERF if the plugging event occurs.

Case Description Change made to model Results (Change in RICT) increase in plugging frequency LCO 3.7.1 One SW supply Not required No change:

A header cross connect valve If the lake water is not available to the inoperable. Service Water System from the intake structure, the availability of the Service Water cross-tie will not change the risk because all divisions of Service Water will be failed.

3.7.1.C One SW Not required No change:

subsystem inoperable for If the lake water is not available to the reasons other Service Water System from the intake than Conditions A structure, the availability of the Service and B. Water subsystem will not change the risk because all divisions of Service Water will be failed.

3.7.1.D One division of Not required The model assumes that if the bar rack intake deicer heaters (deicer heaters) are not heaters operable and the lake is below 38 inoperable. degrees F, intake freezing always occurs (failing the entire SW system).

PARAGON will include an event that will be turned on when lake water is below the 38 degree F threshold and the model will quantify the risk associated with the maintenance

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 37 of 78 Docket No. 50-410 Case Description Change made to model Results (Change in RICT) increase in plugging frequency configuration. The intake plugging event identified in RAI 11B is not related to this function.

3.7.1.E One required SW Not required No change:

pump not in operation. If the lake water is not available to the Service Water System from the intake structure, the availability of a Service Water pump will not change the risk because all divisions of Service Water will be failed.

3.7.1.F Two or more Not required See 3.7.1.C required SW pumps not in operation.

ii) Although conservative bias approaches may lead to masking delta risk increases in some cases, these approaches should generally not contribute significantly to the base risk values. In a bounding case, the calculated delta risk that is potentially masked would be no more than the difference in CDF (or LERF) when the subject event is set to its conservative value and the CDF (or LERF) when the subject event is set to zero.

Therefore, the calculated changes to RICT would be minimal as shown in the example below which calculates a total masked contribution of 15% based on the Fussell-Vesely contribution of the common cause plugging of the lake intake event to the NMP2 model.

• The total base FPIE CDF is 1.7E-06/yr (the hazard to which the common cause plugging of the lake intake event is applicable).

• The common cause plugging of the lake intake masked risk contribution is up to 15%

of that total: 0.15

• 1.70E-06 = 2.55E-07.

For various RICT times the calculated required increase in CDF (i.e. 1.00E-05/ (#

Days/365)) and potential impact from masking (at 15% of base CDF) is shown below, which is minimal:

Adjusted RICT in days Calculated DELTA (with 2E-7 masked Ratio to Default RICT (days) CDF DELTA CDF) Calculation 1.0E-05 / (7.3E-05+2.55E-07)

• 365 =

5.0 7.30E-05 4.98 0.997 1.0E-05 / (3.65E-04+2.55E-07)

• 365 =

10.0 3.65E-04 9.99 0.999 1.0E-05 / (1.83E-04+2.55E-07)

• 365 =

20.0 1.83E-04 19.9 0.996

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 38 of 78 Docket No. 50-410 Adjusted RICT in days Calculated DELTA (with 2E-7 masked Ratio to Default RICT (days) CDF DELTA CDF) Calculation 1.0E-05 / (1.22E-04+2.55E-07)

• 365 =

30.0 1.22E-04 29.9 0.995 iii) Responses to questions 12.d.i and 12.d.ii are provided above and no additional information is required to respond to this question.

Response to RAI-12 e) i) Special Data Variables are developed for non-typical equipment used in the PRA model.

In general, these are items that are not conducive to surveillance testing and have little available data, therefore engineering judgement is used to develop failure distributions.

Two examples of special data variables developed with engineering judgement are FLEX equipment failure rates and bar rack heater failure rates. These variables are explained below:

FLEX Equipment: FLEX strategies are credited in the PRA model that use portable equipment with limited operating history and significant uncertainty in failure rates. The FLEX equipment credited includes portable diesel driven pumps and portable diesel generators. The NMP2 portable diesel generator is a portable 450 kW, 600 VAC generator able to power the class 1E system at NMP2. From NUREG/CR-6928:

The generators covered in this data sheet include those within the Class 1E ac electrical power system, the high-pressure core spray (HPCS) systems, and station blackout (SBO) generators.

Thus, the portable diesel generator is similar to the industry EDGs used in NUREG/CR-6928, although there is no data specifically for the portable diesel generators as yet.

The portable diesel driven pumps are similar to the industry pumps in that they are diesel powered, similar to, for example, the diesel fire pump. However, the pumps informing the data in NUREG/CR-6928 are Auxiliary Feedwater, Fire Protection, Fuel oil transfer pumps, and standby service water pumps. There is no data available specifically for portable diesel pumps.

Failure data for FLEX equipment is taken from NUREG/CR-6928 and multiplied by a factor of two to reflect uncertainty.

Bar rack heaters: The PRA Model addresses failure of the Bar Rack Heaters (also referred to as deicers). There is no industry/generic failure rate of a bar rack heater, therefore the following engineering judgement is used to establish a failure value.

There are two intake structures for NMP2 Service Water. Each intake structure is a 6-sided structure that is outfitted with bar rack heaters on all sides. Three sides of each structure are Division 1 supplied power, and the other three sides are supplied by division 2 power sources (12 total bar racks for both structures). There are 7 bars per side which equals 21 bars per division per structure (42 total bars per structure, and 84 bars total between both structures). Each bar has its own heating element. NMP2 TS require each intake structure to have seven Division I and seven Division II heaters in operation when

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 39 of 78 Docket No. 50-410 the lake temperature is below 38F. The current data online suggests that four months out of the year (December, January, February, March) are the only times when Lake Ontario temperature is below 38F. Therefore, the bar rack heaters would only be in operation for 4 months each year. The water level at the pump intake is checked at least every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

Current and voltage to the intake de-icing is checked at least every 7 days.

A value of 1E-6 (Lognormal Distribution, EF=10) is assumed for loss of one division of bar rack heaters. There are two basic events, one for each division. The limiting condition is the NMP2 TS require seven Division I powered heaters, and seven Division II powered heaters. However, because there are a large number of heaters, there is robust redundancy. Additionally, the Service Water System Manager indicated that there has never been a loss of intake due to heater failure during the life of the plant. Additionally, the loss of Lake Intake initiating event value developed in the Initiating Events Notebook assumes a 2E-7/yr value, which is within a similar range to the loss of bar rack heater value (1E-06) assumed.

ii) The uncertainty associated with the non-typical equipment failure probabilities developed using judgment will have no impact on the RICTs calculated for components associated with LCOs proposed to be included in the RICT program. In order to demonstrate this, the FPIE CDF Cutsets were sorted by F-V and the special variables were reviewed (the NMP2 special variables all share a common prefix of zz). Special variable ZZOHX_DHRRECVRY (Failure to Recover Loss of DHR Prior to Containment Failure) appears in Cutset #6, and has an F-V value of 17%. The next special variable to appear is ZZZ48CFXHSFAILAX (Large Containment Failure in DW or WW water space), also in cutset #6, and has an F-V value of 16%. These variables are not included in any of the LCOs and variations in their probabilities would have bounding impacts on RICT days of less than 1 percent (as demonstrated in the response to question 12.d.ii); together they comprise 33% of the F-V. The next special variable to appear is ZZOGR1_RECOGR1HG (FAILURE OF OFFSITE PWR RECOVERY IN 30 MIN LOSP INITIATOR-GRID), in cutset

1. 42 with an F-V of 13%, the LOSP-grid initiator is not included in the LCOs, and will also have a negligible impact on the NMP2 RICTs. Special variable ZZZ42_RPSXXQMXXX (Common-Cause Failure of Mechanical Equipment Causes Scram Failure) appears in cutset # 43, with a 10% F-V, and this special variable is not included in any of the LCOs, so there would be no impact on the NMP2 RICTs. The rest of the special variables are all below 10% F-V, and thus will not be individually discussed.

Additionally, question RAI-14.d.ii.3 provides results of the FLEX equipment sensitivity study. Sensitivities were performed for each LCO with FLEX portable equipment failure rates modified and FLEX strategy HEP/JHEPs modified. The cases were developed by setting equipment failures to 5x generic data and Independent and Joint HEPs to the 95 th percentile values.

As shown in the RAI-14.d.ii.3 response, the number of RICT days for each LCO are not highly sensitive to the reliabilities of the FLEX equipment or operator actions associated with the FLEX equipment.

iii) Responses to questions 12.e.i and 12.e.ii are provided above and no additional information is required to respond to this question.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 40 of 78 Docket No. 50-410 Response RAI-12 f)

Part i Fire scenarios for the main control room (MCR) are comprised of three (3) types: 1) main control board (MCB) fires for the Bin 4 ignition sources, 2) non-MCB fires based on fixed and transient ignition sources that do not lead to abandonment, and 3) fires that result in MCR abandonment.

Three MCR abandonment (MCRAB) scenarios were postulated: MCRAB from an MCB fire, MCRAB from a Bin 15 electrical cabinet fire, and MCRAB resulting from a transient fire. In addition to the initial target damage, MCRAB scenarios eliminate all success paths other than the mitigating systems that are controlled from the remote shutdown panel. In all three cases, the MCRAB scenario frequency was based on loss of habitability (LOH); loss of control (LOC) abandonment was not credited in the Fire PRA. For LOC abandonment, the HEP applicable to NMP2 for the decision to abandon has not been formally calculated, but may range from 6.0E-2 to 1.0 based on the guidance in NUREG-1921 Supplement 2. For LOH abandonment, the HEP associated with the decision to abandon is considered to be negligible due to untenable environmental conditions.

During the initial review of NRC Information Notice 92-18, it was determined that several MOVs in the RCIC system are susceptible to IN 92-18 type hot shorts. Therefore, the credited deterministic safe shutdown strategy for a control room fire is to utilize ADS with the pseudo LPCI mode of the RHR system if RCIC is not available. Pseudo LPCI relies on injecting suppression pool water to the vessel by way of the SDC return path. Other than the MCR abandonment scenarios, no credit is taken in the Fire PRA for recovery of a fire-induced MOV mispositioning. Additionally, MOVs with potential IN 92-18 damage are not assumed to be available after transferring control to the RSP. Accordingly, the Fire PRA strategy is consistent with the deterministic strategy for remote shutdown. For the abandonment scenarios modeled in the Fire PRA, other than long-term containment venting, no credit is taken for HPCS or other systems that cannot be controlled from the RSP, and the available system functions from the RSP are scenario specific given the potential for IN 92-18 damage.

Prior to the 2020 update of the NMP2 Fire PRA, LOC abandonment was identified as a source of uncertainty due primarily to the contribution of a single Main Control Board (MCB) fire (P852) to the overall fire risk. This scenario contributed 12% to the Fire CDF and 26% to the Fire LERF making it the second most risk-significant CDF and top LERF scenario. The only other potential LOC candidate with a similar lack of available success paths is an MCB fire in P601. Further scenario refinement crediting LOC abandonment using the guidance available at the time was not pursued for either scenario. While the decision to abandon for LOH is a given, the decision to abandon for LOC requires development of a unique HEP in addition to the execution steps associated with transferring control to the remote shutdown panel. Given the challenges associated with crediting LOC abandonment, treatment of MCB fire scenarios using NUREG-2178, Volume 2 was subsequently incorporated into the 2020 update of the NMP2 Fire PRA in order to improve realism in the determination of fire risk. The updated treatment utilizes an MCB event tree which resulted in a more comprehensive and realistic treatment of fires originating in the MCB. This update significantly improved the results from MCB fire scenarios as well as the LOH abandonment scenario due to an MCB fire which previously contributed 16% to the Fire CDF and 9% to the Fire LERF making it the top CDF and second most risk-significant LERF scenario prior to the 2020 update.

Following the 2020 update, scenarios P852-MP and P601-MP effectively replaced the previous scenarios where consideration of LOC abandonment might be applicable due to lack of available success paths. Refer to Table RAI 12f-1 below.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 41 of 78 Docket No. 50-410 Table RAI 12f High CCDP Scenario Candidates for LOC Abandonment 92-18 Scenario Frequency SF NSP CCDP CDF Impact?

1. P852-MP No 2.05E-03 0.208 3.71E-04 9.40E-01 1.49E-07

2. P601-MP Yes 2.05E-03 0.299 4.32E-04 9.40E-01 2.49E-07 Total 3.98E-07 LOC is incorporated into the NUREG-2178 Volume 2 event tree using Branch J, with the LOC toggle set to 0.0. The updated treatment for NMP2 sets the toggle to 1.0 (no LOC credit). If LOC abandonment were to be credited, the CCDP to account for mitigation from the RSP must first be estimated. For P852-LOC, the CCDP may be conservatively assumed to correspond to the HEP for the decision to abandon, which is assumed to be 0.2 based on a review of plant procedures and an assumption about training conditions (adjusted to 0.188 by the plant availability factor). However, the CCDP for P601-LOC would be significantly higher than for P852-LOC due to RCIC cable impacts within P601. The CCDP for the MCB abandonment scenario based on LOH is 0.413; the corresponding CCDP for P601-LOC would then be 0.601 (0.413 + 0.188) after accounting for the assumed HEP associated with the failure to abandon.

Refer to Table RAI 12f-2 below.

Table RAI 12f Scenario Improvement Crediting LOC Abandonment 92-18 Scenario Frequency SF NSP CCDP CDF Impact?

1. P852-LOC No 2.05E-03 0.208 3.71E-04 0.188 2.97E-08

2. P601-LOC Yes 2.05E-03 0.299 4.32E-04 0.601 1.59E-07 Total 1.89E-07 The combined improvement in fire CDF from crediting LOC abandonment is only 2.09E-07 (3.98E 1.89E-07) following the update of the MCB scenarios to the NUREG-2178 Volume 2 event tree approach. Assuming existing plant procedures would justify a HEP as low as 0.2 for LOC abandonment, the potential credit is estimated to be only slightly above 1% of the total fire CDF. Accordingly, not crediting LOC abandonment in the NUREG-2178 Volume 2 event tree approach is now a minor conservatism and no longer considered a significant source of uncertainty. Thus, the potential credit from LOC abandonment in the Fire PRA would have no impact on the delta risk calculations for RICT.

The updated MCB treatment was subject to a focused scope peer review and the results from that review have been addressed in the applicable FPRA notebook.

Part ii Not applicable to NMP2.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 42 of 78 Docket No. 50-410

RAI 13

As provided by the guidance in NEI 06-09, Revision 0-A, changes to CDF and LERF calculated by a PRA that models the current operating configuration are used to support the RICT program. The guidance in NEI 06-09, Revision 0-A, provides several quantitative risk management thresholds values: the calculated RICT, the calculated instantaneous risk, and the cumulative risk increase. When a risk threshold value is exceeded, specific guidance is provided in Table 2-2 of NEI 06-09, Revision 0-A.

RG 1.174 clarifies that, because of the way the acceptance guidelines in RG 1.174 have been developed, the appropriate numerical measures to use when comparing the PRA results with the risk acceptance guidelines are mean values. The risk management thresholds values for the RICT program have been developed based on RG 1.174 and, therefore, the most appropriate measures with which to make a comparison are also mean values. Point estimates are the most commonly calculated and reported PRA results. Point estimates do not account for the state-of-knowledge correlation (SOKC) between nominally independent basic event probabilities, but they can be quickly and simply calculated. Mean values do reflect the SOKC and are always larger than point estimates but require longer and more complex calculations.

NUREG-1855, Revision 1, provides guidance on evaluating how the uncertainty arising from the propagation of the uncertainty in parameter values (SOKC) of the PRA inputs impacts the comparison of the PRA results with the guideline values.

Summarize how the SOKC investigation was performed for all the PRA models used to support the RICT application, and how the SOKC will be addressed for the RICT program.

Exelon Response to RAI 13 The mean CDF and LERF values derived via Monte Carlo sampling are indeed higher than the corresponding Point Estimate CDF and LERF values. Because the RICT program application is a delta type application (i.e., acceptability is based on the difference in risk calculated for the base model configuration and that calculated for a configuration in which equipment is unavailable), the impact of the SOKC uncertainty on RICT estimates is considered negligible and Point Estimate values are adequate to inform the difference between plant configurations (i.e., the delta risk between different plant configurations). While mean CDF and LERF values are higher than the point estimate values for the base model, the mean CDF and LERF values are also higher than the point estimate values reflective of an equipment unavailable plant configuration. As a sensitivity, the delta risk was evaluated using both point estimate and mean values for a condition where RCIC is assumed unavailable for an extended LCO. A combined IPRA and FPRA model was used with CDF and LERF quantified at 1E-11/yr. This yielded point estimate values for the base and RCIC unavailable plant configurations. Monte Carlo simulation was then used with 5000 samples to calculate the corresponding mean values. Table Q13-1 provides the results of these calculations which show that the delta-risk results using mean and point estimate values are very similar and are not significant to the RICT application. Two other sensitivities were also performed, the first assuming the Div. 2 EDG is unavailable and the second assuming that RHR A is unavailable. Tables Q13-2 and Q13-3, respectively, provide the results of these additional sensitivities which also demonstrate a small increase in delta risk when mean values are quantified.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 43 of 78 Docket No. 50-410 Table Q13-1 Summary of Mean vs Point Estimate Results (IPRA & FPRA)

CDF CDF LERF LERF Point Propagated Point Propagated Estimate (/yr) Mean (/yr) Estimate Mean (/yr)

(/yr)

Base 3.36E-05 3.42E-05 1.02E-05 1.07E-05 RCIC Failed 9.22E-05 9.36E-05 3.40E-05 3.51E-05 Delta 5.86E-05 5.94E-05 2.38E-05 2.44E-05

% Increase in Delta n/a 1.4% n/a 2.5%

RICT (days) 30.0 30.0 14.9 14.6 Table Q13-2 Summary of Mean vs Point Estimate Results (IPRA & FPRA)

CDF CDF LERF LERF Point Propagated Point Propagated Estimate (/yr) Mean (/yr) Estimate Mean (/yr)

(/yr)

Base 3.36E-05 3.42E-05 1.02E-05 1.07E-05 Div 2 EDG Failed 1.08E-04 1.10E-04 4.93E-5 5.06E-05 Delta 7.44E-05 7.58E-05 3.91E-05 3.99E-05

% Increase in Delta n/a 1.9% n/a 2.0%

RICT (days) 30.0 30.0 9.2 9.0 Table Q13-3 Summary of Mean vs Point Estimate Results (IPRA & FPRA)

CDF CDF LERF LERF Point Propagated Point Propagated Estimate (/yr) Mean (/yr) Estimate Mean (/yr)

(/yr)

Base 3.36E-05 3.42E-05 1.02E-05 1.07E-05 RHR A Failed 3.26E-04 3.28E-04 4.57E-05 4.63E-05 Delta 2.92E-04 2.94E-04 3.55E-05 3.56E-05

% Increase in Delta n/a 0.5% n/a 0.3%

RICT (days) 12.5 12.4 10.1 10.1

RAI 14

The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, 'Crediting Mitigating Strategies in Risk-Informed Decision Making,' Guidance for Risk-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2 (ADAMS Accession No. ML090410014).

Regarding equipment failure probability in the May 30, 2017, memorandum, the NRC staff concludes (Conclusion 8):

The uncertainty associated with failure rates of portable equipment should be considered in the PRA models consistent with the ASME/ANS PRA Standard as endorsed by RG 1.200. Risk-informed applications should address whether and how these uncertainties are evaluated.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 44 of 78 Docket No. 50-410 Regarding human reliability analysis (HRA), NEI 16-06, Section 7.5, recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses, and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. In the May 30, 2017, memorandum, the NRC staff concludes (Conclusion 11):

[] Until gaps in the human reliability analysis methodologies are addressed by improved industry guidance, HEPs associated with actions for which the existing approaches are not explicitly applicable, such as actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, along with assumptions and assessments, should be submitted to NRC for review.

Regarding uncertainty, Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties shall be considered in application of the PRA-based model results to the RICT program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of an RICT calculation. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions. Uncertainty exists in PRA modeling of FLEX, related to the equipment failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities.

Therefore, FLEX modeling assumptions can be key assumptions and sources of uncertainty for RICTs proposed in this application.

The LAR does not address whether FLEX equipment or actions have been credited in the PRA models. The NRC staff notes that the LAR Enclosure 4, Section 5 credits FLEX features for defense-in-depth for the impact of Local Intense Precipitation. To understand the credit that will be taken for FLEX equipment and actions in the RICT Program, address the following separately for the internal events PRA, internal flooding PRA, and FPRA:

a. Discuss whether Exelon has credited FLEX equipment or mitigating actions into the Nine Mile Point Nuclear Station, Unit 2 (Nine Mile Point 2) internal events, including internal flooding, or FPRA models.

If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested, and remainder of this question is not applicable.

b. Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

c. Regarding the credited equipment:

i. Discuss whether the credited equipment (regardless of whether it is portable or permanently installed) are like other plant equipment (i.e. SSCs with sufficient plant-specific or generic industry data).

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 45 of 78 Docket No. 50-410 ii. If all credited FLEX equipment is similar to other plant equipment credited in the PRA (i.e., SSCs with sufficient plant-specific or generic industry data), responses to items ii and iii below are not necessary.

iii. Provide the failure rates and discuss the data used to support the modeling and provide the rationale for using the chosen data.

iv. Discuss how the failure rates assumed in the PRA for the FLEX equipment are consistent with the most recent industry operational experience.

v. Detail the plant-specific operational experience (e.g., number of failures, number of demands, operational hours) of the Nine Mile Point portable FLEX equipment that are credited in the PRA. Discuss any screening or disregarding of plant-specific data (e.g., design modifications, changes in operating practices).

Discuss how the failure rates assumed in the PRA for the FLEX equipment are consistent with relevant plant-specific evidence and operational experience.

vi. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA standard, as endorsed by RG 1.200, Revision 2.

vii. Perform, justify, and provide results of LCO specific sensitivity studies that assess impact on RICT due to FLEX equipment data and failure probabilities. As part of the response, include the following:

1. Justify values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results.

3. Describe how the results of the sensitivity studies will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

d. Regarding HRA, address the following:

i. Discuss whether any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06.

If any credited operator actions related to FLEX equipment contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06, answer either item ii or iii below:

ii. Perform, justify, and provide results of LCO specific sensitivity studies that assess impact from the FLEX independent and dependent HEPs associated with deploying and staging FLEX portable equipment on the RICTs proposed in this application. As part of the response, include the following:

1. Justify independent and joint HEP values selected for the sensitivity studies, including justification of why the chosen values constitute bounding realistic estimates.

2. Provide numerical results on specific selected RICTs and discussion of the results.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 46 of 78 Docket No. 50-410

3. Discuss composite sensitivity studies of the RICT results to the operator action HEPs and the equipment reliability uncertainty sensitivity study provided in response to item c.iii above.

4. Describe how the source of uncertainty due to the uncertainty in FLEX operator actions HEPs will be addressed in the RICT program. Describe specific RMAs being proposed and how these RMAs are expected to reduce the risk associated with this source of uncertainty.

iii. Alternatively, for item ii above, provide information associated with the following items listed in supporting requirements HR-G3 and HR-G7 of the ASME/ANS RA-Sa-2009 PRA standard to support detailed NRC review:

1. the level and frequency of training that the operators and non-operators receive for deployment of the FLEX equipment (performance shaping factor (a));

2. performance shaping factor (f) regarding estimates of time available and time required to execute the response;

3. performance shaping factor (g) regarding complexity of detection, diagnosis, and decisionmaking, and executing the required response;

4. performance shaping factor (h) regarding consideration of environmental conditions; and

5. human action dependencies as listed in supporting requirement HR-G7 of the ASME/ANS RA-Sa-2009 PRA standard.

e. The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as, "the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impacts the significant accident sequences or the significant accident progression sequences." Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA standard states that, "upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the Peer Review Section of each respective Part of this Standard []."

Regarding human reliability analysis (HRA), NEI 16-06, Section 7.5, recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as debris removal, transportation of portable equipment, installation of equipment at a staging location, routing of cables and hoses, and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. During the regulatory audit conducted May 4 to 7, 2020, the licensee indicated FLEX HRA was developed by following EPRI 3002013018 "Human Reliability for Diverse and Flexible Mitigation Strategies and Use of Portable Equipment." This methodology indicates modeling human actions for transporting equipment, connecting hoses, and verifying portable pump operability are categorized as tasks not covered by THERP.

Non-mandatory Appendix I-A of the PRA Standard cites "a different HRA approach to human error analysis..." as a potential PRA upgrade.

Considering the above, applying the current HRA methods to those operator actions for staging and deploying FLEX mitigating strategies could constitute a PRA upgrade.

Therefore:

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 47 of 78 Docket No. 50-410

i. Provide an evaluation of the model changes associated with incorporating FLEX mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

ii. As an alternative to item i above, confirm that a focused-scope peer review has been conducted for crediting FLEX in the PRA models. Describe the peer review and status of the resulting F&Os. Provide any remaining open F&Os, along with dispositions for this application.

Exelon Response to RAI 14:

Exelon Response to RAI 14a:

The NMP2 internal events, internal flooding, and fire PRA models credit FLEX equipment and related mitigating actions.

Exelon Response to RAI 14b:

The following three FLEX equipment capabilities are credited:

1. Alignment of FLEX diesel generators to provide power to maintain DC power and to provide power for long term Nitrogen makeup to the SRVs. - Portable Equipment

2. FLEX injection to the RPV with suction from Lake Ontario- Portable Equipment

3. Hardened Containment Vent System (HCVS) - Permanently Installed The FLEX equipment modeled in the PRA is the portable diesel generator and the portable diesel driven pumps. Permanently installed equipment including piping and dry hydrants are currently not part of the PRA. Compensatory actions modeled include alignment of the FLEX diesel generator and FLEX pumps for injection. Other compensatory actions include DC load shedding, RCIC initiation (including black start), cycling of the SRVs and containment venting.

Exelon Response to RAI 14c:

i. The NMP2 portable diesel generators are portable 450 kW, 600 VAC generators able to power the class 1E system at NMP2. From NUREG/CR-6928:

The generators covered in this data sheet include those within the Class 1E ac electrical power system, the high-pressure core spray (HPCS) systems, and station blackout (SBO) generators.

Thus, the portable diesel generators are similar to the industry EDGs used in NUREG/CR-6928, although there is no data specifically for the portable diesel generators as yet.

The portable diesel driven pumps are similar to the industry pumps in that they are diesel powered, similar to, for example, the diesel fire pump. However, the pumps informing the data in NUREG/CR-6928 are Auxiliary Feedwater, Fire Protection, Fuel oil transfer pumps, and standby service water pumps. There is no data available specifically for portable diesel pumps.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 48 of 78 Docket No. 50-410 ii. See the previous response to c.i. It is noted that c.ii appears to be a continuation of question c.i.

iii. While industry data for FLEX components is being collected and is anticipated to be available prior to implementation of RICT at NMP2, an assumption is made that two times the generic reliability values from NUREG/CR-6928 for similar equipment provides a reasonable approximation of the reliability of the FLEX equipment. The portable FLEX equipment credited includes portable diesel driven pumps and portable diesel generators, and the values used for reliability are provided below.

Failure Mode FLEX Generator FLEX Pumps Failure to Start 6.30E-03 4.34E-03 Failure to Run (1st hour) 7.44E-03 4.02E-03 Failure to Run (23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />) 23*1.79E-03 = 4.12E-2 23*1.00E-02 = 2.3E-1 Total Failure Probability 5.49E-02 2.38E-01 iv. As of September 10, 2020, there is limited industry failure data published for FLEX equipment. Revision 0 of PWROG-18043-P (FLEX Equipment Data Collection and Analysis) is available and has been used as a representation of industry data, but it should be noted that Revision 1 of the document is due to be released in the near term and it is not known at this time how the results will differ from the Revision 0 results.

The NMP2 failure to start and failure to run data documented in the response to question 14.c.iii were compared to those provided in PWROG-18043-P for comparable equipment, and the NMP2 estimates were found to be consistent with those in PWROG-18043-P.

As documented in the response to RAI question 14.d.ii.3, reasonable differences in FLEX pump and generator reliability estimates have a very small impact on the RICT results.

v. Nine Mile Point (NMP) Units 1 and 2 use FLEX pumps and generators of the same design to support their FLEX strategies and the equipment can be used on either unit. The N+1 requirements for the equipment are met by ensuring there are enough pumps and generators to support the FLEX strategies for each unit simultaneously with an additional spare pump and generator (3 generators, 5 pumps). NMP monitors surveillance and testing results and any equipment failures are identified and documented (for example, in Action Request (AR) records). Records related to FLEX equipment test procedures are available from as early as October 2014, but for the purposes of this response, the data collection period is assumed to begin in January of 2015.

Since January 2015, there have been a total of six (6) failures of the portable diesel driven FLEX pumps and one (1) failure of the diesel driven FLEX generators. Based on a review of the ARs, two of the diesel driven FLEX pump failures are not considered to be applicable to the current FLEX design, and before using the NMP FLEX equipment failure data in any reliability estimates, it is considered necessary to screen these failures from the data pool. The following is a description of the two failures and the rationale for screening them:

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 49 of 78 Docket No. 50-410

• In September of 2016, both BDB-P2A and BDB-P2B failed to start during their surveillance tests. The immediate corrective action was to replace the battery tenders for the two pumps, but the extent of condition analysis completed in October of 2016 identified that the design of the crimped ring connector on the battery terminal allowed for the 18AWG stranded cable to pull out of the connector and become grounded, leading to failure of the charging function. The connectors on all of the FLEX diesel driven pumps were replaced with a clamp style connector of a different design and no further connector issues have been identified. Because the cause of these failures has been identified and the design of the charging connections has been altered, these charging failures should not be counted as failures when using the NMP2 FLEX operational experience to inform current FLEX pump failure rates.

After elimination of these two failures from the NMP2 data pool, failure probabilities for the FLEX diesel driven pumps and generators could be calculated directly based on estimates of demands and run hours, as shown in the table below. For actual use in the PRA, the process would be to select a prior distribution and perform a Bayesian update to generate the final failure rate/probability; however, at this time, this calculation has not been performed:

Equipment Comments Number of Number of Failure Probability or Type/Failure Failures Demands5 Rate Mode Includes 2 failures associated with worn out batteries. When the FLEX Pump batteries were replaced, the 3 11 2.7E-01 Failure to Start generators started and operated as required.

Potentially conservative to count these as failures.

The failure was due to fuel filter clogging and resulted FLEX Pump in shutdown after 10 Failure to Run (1st seconds. It is assumed that hour and the 1 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> 4.5E-02/hr the generator came up to following 23 are run speed and that it grouped together) represents a failure to run in the first hour.

FLEX Generator Generator cranked, but did 1 11 9.0E-02 Failure to Start not start.

FLEX Generator 0 (assume Failure to Run (1st 0.5 for an hour and the 16 3.1E-03/hr No failures to run recorded.

incipient following 23 are failure) grouped together) 5 Based on FLEX generators are started twice per year and are run for about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 2 of which are under loaded conditions. FLEX pumps are started twice per year and are run for about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, 2 of which are under loaded conditions. The data collection period is assumed to begin on 01/01/2015 and end on 06/30/2020 (halfway through 2020).

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 50 of 78 Docket No. 50-410 The NMP2-specific failure rates and probabilities calculated in the table above are larger than those that are used the NMP2 PRA and those that are documented in PWROG-18043-P, however, the limited amount of plant-specific data provides little insight into the actual plant-specific failure rates. This is further complicated because the FLEX program is in state of change as the plant uses operating experience to enhance equipment design and procedures (for example, the changes that were made to the FLEX pump battery charging connections that are described above).

The plant operating experience does not appear to suggest that the NMP FLEX equipment reliability should be considered to be outliers, and as demonstrated in the response to RAI question 14.d.ii.3, the RICT results are not highly sensitive to changes in FLEX equipment failure rates.

vi. The uncertainties associated with the data values are based on the uncertainty parameters from the generic data and are in accordance with the ASME/ANS PRA Standard. Use of these values should provide a reasonable approximation of the reliability of the FLEX equipment. This assumption will be revisited during periodic PRA updates as industry and plant specific data become available.

vii.1 As described in the response to the item above, the current assumption is made that two-times the generic reliability values for similar equipment provides a reasonable approximation of the reliability of the FLEX equipment. This leads to total failure probabilities in the range of 0.1 or approximately 1-in-10. To further explore the sensitivity to this assumption, the TS/LCO conditions noted above were re-run for RICT using 5x the generic failure probabilities instead of 2x the generic failure probabilities. The following summarizes this treatment for basic events related to portable equipment credited in the PRA.

Basic Event Basic Event Description Industry BE Prob BE Prob Sensitivity Rate (Per (Industry) Base BE Prob Hour, Per PRA (2x Sensitivity Demand) generic) (5x generic)

FLEX-EDG- FLEX Generator Failure to Run (1st 3.72E-03 3.72E-03 7.44E-03 1.86E-02 FTR hour)

FLEX-EDG- FLEX Generator Failure to Run (after 8.95E-04 2.06E-02 4.12E-02 1.03E-01 FTR2 1st hour)

FLEX-EDG- FLEX Generator Failure to Start 3.15E-03 3.15E-03 6.30E-03 1.58E-02 FTS FLX-PMPA- FLEX Pump Failure to Run (1st hour) 2.01E-03 2.01E-03 4.02E-03 1.01E-02 FTR FLX-PMPA- FLEX Pump Failure to Run (after 1st 5.00E-03 5.00E-03 2.30E-01 5.75E-01 FTR2 hour)

FLX-PMPA- FLEX Pump Failure to Start 2.17E-03 2.17E-03 4.34E-03 1.09E-02 FTS FLX-PMPB- FLEX Pump Failure to Run (1st hour) 2.01E-03 2.01E-03 4.02E-03 1.01E-02 FTR FLX-PMPB- FLEX Pump Failure to Run (after 1st 5.00E-03 5.00E-03 2.30E-01 5.75E-01 FTR2 hour)

FLX-PMPB- FLEX Pump Failure to Start 2.17E-03 2.17E-03 4.34E-03 1.09E-02 FTS

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 51 of 78 Docket No. 50-410 vii.2 The numerical results on specific selected RICTs and discussion of the results is provided in response to Question d below.

vii.3 The description of how the results of the sensitivity studies will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A is provided in the response to Question d below.

d. Regarding HRA, address the following:

i. There are NMP2 operator actions related to the implementation of FLEX strategies that contain the activities described in Sections 7.5.4 and 7.5.5 of NEI 16-06. These actions are:

• ZS1FL_FLEX-MECHA: Operator Fails to Align FLEX Pumps

• ZOLS1_LOADSHEDDC: Operator Fails to Conduct DC Load Shedding Procedure

• ZPAC1_COPERATOR: Operator Fails to Manually Align Long Term DC (PAC) -

Load Shedding Successful (FLEX generator deployment/start)

The activities in Sections 7.5.4 and 7.5.5 of NEI 16-06 were the subjects of the example based guidance provided in EPRI 3002013018, Human Reliability Analysis (HRA) for Diverse and Flexible Mitigation Strategies (FLEX) and Use of Portable Equipment, which was used to support the development of the actions identified above.

All three actions were considered for the internal events, internal flooding, and internal fire hazards, but ZS1FL_FLEX-MECHA is currently set to 1.0 for fire events due to the need to further refine the actions timing bases. The Fire HRA for these actions was performed prior to the release of EPRI 3002013018 and while the same HRA methodologies were used to evaluate the fire versions of the actions, not all of the techniques proposed for use in EPRI 3002013018 were applied in the Fire evaluations.

ii.1 In order to provide bounding realistic estimates of the HEPs and JHEPs for the actions identified in the response to question 14.d.i, the 95th percentile values for the events are proposed as appropriate values. While other options are available to estimate bounding values, such as applying a factor of 10 to the base failure probabilities, the 95th percentile values are intended to represent the likely upper bound HEPs for the actions, the values were developed using the HRA methodology, and they have a documented quantitative basis. While these estimates may be lower than the result obtained by applying a factor of 10 multiplier to the base values, EPRI 3002013018 has provided a systematic approach to addressing the issues addressed in NEI 16-06 Sections 7.5.4 and 7.5 and insights from the guidance indicate that for some of the activities identified, the available methodologies may overestimate the task failure probabilities.

• Debris removal: The suggested treatment is account for the task in the timeline rather than to quantify a HEP because commonly used HRA methodologies do

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 52 of 78 Docket No. 50-410 not address this type of work. While this could be considered to be a non-addressed contributor to the FLEX strategy failure probability, debris removal is not expected to be a major factor for the FPIE, internal flooding, or internal Fire scenarios. In addition, the recovery times available for the potentially impacted actions ZS1FL_FLEX-MECHA and ZPAC1_COPERATOR are extensive. For example, for ZS1FL_FLEX-MECHA, the time available for recovery is about 640 minutes and for ZPAC1_COPERATOR the time is about 370 minutes. Additional time spent working on debris removal is not expected to be a significant issue for these FLEX actions.

• Transportation of Portable Equipment: EPRI 3002013018 provided an approach to assessing the risk from potential transportation errors and they were determined to be negligible contributors for NMP2. No reasonable variations in the probability of failure for these tasks is expected to impact the action HEPs.

• Installation of Equipment at Staging Location/Addressing Complex Actions in Mitigating Strategies: EPRI 3002013018 indicates that a weakness of using THERP to assess tasks comprised of many steps is that that the aggregate HEP can be unrealistically high. This implies that the use of a factor of 10 multiplier would provide a further, undesirable bias to this sensitivity case.

o For those tasks that are not directly represented by THERP data, EPRI 3002013018 requires a basis to be developed for surrogate values used.

This may lead to a greater degree of uncertainty in the HEPs for sub-steps, but the surrogate values are generally applied to those actions that are comprised of many steps (e.g. making hose connections), which would reduce the likelihood of underestimating the FLEX action HEP.

• Routing of Hoses and Cables: The treatment of these tasks fits into the category of self-revealing errors in EPRI 3002013018. If the hoses or cables are incorrectly routed such that they cannot be connected to equipment, the action could not progress. If there is adequate time for recovery (true for the relevant NMP2 actions) and no irreversible consequence occurs, the errors are treated as negligible contributors to risk. No reasonable variations in the probability of failure for these tasks is expected to impact the action HEPs.

The same approach was used for the JHEPs. For JHEPs that were set to the minimum JHEP value of 1E-6, if the calculated 95th percentile value was still below the minimum JHEP value, the minimum JHEP value of 1E-6 was retained as the 95th percentile value. The baseline values and the 95 th percentile values for each hazard are provided in Table 14.d.ii-1 for the independent HFEs along with examples of the JHEPs that were used in the models. The entire list of JHEPs containing one or more of the HFEs identified in the response to 14.d.i has not been provided in this response due to the large number of events that comprise the list (over 220 dependent events):

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 53 of 78 Docket No. 50-410 Table 14.d.ii-1: Overview of FLEX HEP and Joint HEP 95th Percentile Values BEID Description Dist. FPIE/Flood FPIE/Flood Fire Fire 95th Type Base 95th Base ZS1FL_FLEX- Operator Fails to Align FLEX Pumps B 6.9E-2 1.8E-1 1.0 1.0 MECHA ZOLS1_LOADS Operator Fails to Conduct DC Load B 3.3E-2 9.1E-2 1.8E-2 9.0E-2 HEDDC Shedding Procedure ZPAC1_COPER Operator Fails to Manually Align B 2.2E-2 6.1E-2 1.1E-2 5.5E-2 ATOR Long Term DC (PAC) - Load Shedding Successful ZQ-DEP-HEP-55 Dependent HEP for L 3.69E-05 3.68E-04 NA NA ZA301_DCRDOOR,ZHS0B_CB_CU BICLE,ZHS03_HSDGOPERTR,ZPA C1_COPERATO ZQ-DEP-HEP-56 Dependent HEP for L 1.51E-04 1.51E-03 NA NA ZA301_DCRDOOR,ZHS04_EDGCO OLING,ZPAC1_COPERATOR ZQ-DEP-HEP-57 Dependent HEP for L 5.00E-05 5.00E-04 NA NA ZA301_DCRDOOR,ZHS0B_CB_CU BICLE,ZHS05_HSROOMCOL,ZPAC 1_COPERATOR COMBINATION_ Dependent HEP for L NA NA 1.42E-04 7.09E-04 1004 ZHS04F1EDGCOOLNG, ZIS01F1SOPERATOR, ZPAC1F1COPERATR, ZFP01F1FPOPERATR, ,

COMBINATION_ Dependent HEP for L NA NA 2.91E-05 1.45E-04 1003 ZME01F1MEOPERATR, ZMA01F1OPNRMDOOR, ZPAC1F1COPERATR, , ,

COMBINATION_ Dependent HEP for L NA NA 6.60E-03 3.30E-02 100 ZHS03F1HSDGOPRTR, ZPAC1F1COPERATR, , , ,

Key to Operator HEPs included in Table:

• ZS1FL_FLEX-MECHA, Operator Fails to Align FLEX Pumps

• ZOLS1_LOADSHEDDC, Operator Fails to Conduct DC Load Shedding Procedure

• ZA301_DCRDOOR, Operator Fails to Open Diesel Control Room Door

• ZFP01F1FPOPERATR, Operator Fails to Open Crosstie to NMP1 Fire System (In-Plant Fire)

• ZHS03_HSDGOPERTR, Operator Fails to Align Fire Water for EDG Cooling

• ZHS03F1HSDGOPRTR, Operator Fails to Align Fire Water for EDG Cooling (In-Plant Fire)

• ZHS04_EDGCOOLING, Operator fails to protect EDG From High Temp During SBO

• ZHS04F1EDGCOOLNG, Operator fails to protect EDG From High Temp During SBO (In-Plant Fire)

• ZHS05_HSROOMCOL, Operator Fails to open HPCS Room Doors and HVAC Duct

• ZHS0B_CB_CUBICLE, Operator Fails to Align (Div III) EDG2 to ALT DIV. Given SBO

• ZIS01F1SOPERATOR, OP FAILS TO LOCALLY CLOSE EQ. DRN AND FLR DRN MOV IN RB-LATE (In-Plant Fire)

• ZMA01F1OPNRMDOOR, Operators Fail to Open ECCS Room Doors Given High Temp (In-Plant Fire)

• ZME01F1MEOPERATR, Operators Fail to Manually Initiate ECCS (In-Plant Fire)

• ZPAC1_COPERATOR, Operator Fails to Manually Align Long Term DC (PAC)

• ZPAC1F1COPERATR, Operator Fails to Manually Align Long Term DC (PAC, In-Plant Fire)

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 54 of 78 Docket No. 50-410 ii.2. The results of the HEP sensitivities are provided as composite sensitivity cases (Equipment and HEP adjustments applied) in the response to RAI question 14.d.ii.3 below.

ii.3. The results of the FLEX HEP and equipment sensitivity studies are shown in Table 14.d.ii-2 below. Sensitivities were performed for each LCO with FLEX portable equipment failure rates modified and FLEX strategy HEP/JHEPs modified. The cases were developed by setting equipment failures to 5x generic data and Independent and Joint HEPs to the 95th percentile values.

As shown in Table 14.d.ii-2, the number of RICT days for each LCO are not highly sensitive to the reliabilities of the FLEX equipment or operator actions associated with the FLEX equipment. Detailed results for select LCOs are provided in Table 14.d.ii-3, Table 14.d.ii-4, Table 14.d.ii.5, and Table 14.d.ii.6.

Table 14.d.ii-2: Example RICT Calculations Original Sensitivity w/

Technical RICT Equipment TS Condition Specifications Estimate Reliability and HEP (days) adjustments (days) 3.5.3.A.2 RCIC System Inoperable. 21.3 21.4 One required offsite circuit 3.8.1.A 15.0 14.4 inoperable.

3.8.1.B One required DG inoperable. 9.8 9.8 One required offsite circuit 3.8.1.D inoperable AND One 5.4 5.3 required DG inoperable.

Division 1 or 2 DC electrical 3.8.4.A power subsystem 30.0 30.0 inoperable.

One emergency UPS 3.8.7.A 20.7 20.8 inverter inoperable.

One or both Division 1 and 2 AC electrical power 3.8.8.A 0.8 0.7 distribution subsystems inoperable.

One or both Division 1 and 2 120 VAC uninterruptible 3.8.8.B 0.9 0.9 electrical power distribution subsystems inoperable.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 55 of 78 Docket No. 50-410 Table 14.d.ii-3 FLEX Sensitivity to Equipment and Human Failures (RCIC System Inoperable)

CDF (/yr) LERF (/yr)

Base (No Maintenance) 3.01E-05 8.84E-06 Seismic Penalty 6.40E-07 6.40E-07 3.5.3.A.2 7.35E-05 2.53E-05 Delta 4.40E-05 1.71E-05

% Increase in Delta 146.3% 193.4%

RICT (days) 30.0 21.3 Degraded FLEX 3.07E-05 8.87E-06 Degraded FLEX - 3.5.3.A.2 7.39E-05 2.53E-05 Delta 4.38E-05 1.71E-05

% Increase in Delta 142.8% 192.4%

RICT (days) 30.0 21.4 Table 14.d.ii-4 FLEX Sensitivity to Equipment and Human Failures (One required offsite circuit inoperable)

CDF (/yr) LERF (/yr)

Base (No Maintenance) 3.01E-05 8.84E-06 Seismic Penalty 6.40E-07 6.40E-07 3.8.1.A 7.56E-05 3.25E-05 Delta 4.61E-05 2.43E-05

% Increase in Delta 153.3% 274.9%

RICT (days) 30.0 15.0 Degraded FLEX 3.07E-05 8.87E-06 Degraded FLEX - 3.8.1.A 7.80E-05 3.36E-05 Delta 4.79E-05 2.54E-05

% Increase in Delta 156.2% 286.0%

RICT (days) 30.0 14.4

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 56 of 78 Docket No. 50-410 Table 14.d.ii-5 FLEX Sensitivity to Equipment and Human Failures (One required DG inoperable)

CDF (/yr) LERF (/yr)

Base (No Maintenance) 3.01E-05 8.84E-06 Seismic Penalty 6.40E-07 6.40E-07 3.8.1.B 9.30E-05 4.53E-05 Delta 6.35E-05 3.71E-05

% Increase in Delta 211.1% 419.7%

RICT (days) 30.0 9.8 Degraded FLEX 3.07E-05 8.87E-06 Degraded FLEX - 3.8.1.B 9.75E-05 4.56E-05 Delta 6.74E-05 3.74E-05

% Increase in Delta 219.7% 421.3%

RICT (days) 30.0 9.8 Table 14.d.ii-6 FLEX Sensitivity to Equipment and Human Failures (One required circuit inoperable AND One required DG inoperable)

CDF (/yr) LERF (/yr)

Base (No Maintenance) 3.01E-05 8.84E-06 Seismic Penalty 6.40E-07 6.40E-07 3.8.1.D 1.42E-04 7.55E-05 Delta 1.13E-04 6.73E-05

% Increase in Delta 373.9% 761.3%

RICT (days) 30.0 5.4 Degraded FLEX 3.07E-05 8.87E-06 Degraded FLEX - 3.8.1.D 1.48E-04 7.68E-05 Delta 1.18E-04 6.86E-05

% Increase in Delta 384.2% 773.1%

RICT (days) 30.0 5.3 ii.4. Based on the results of the sensitivity studies, no specific global Risk Management Actions (RMAs) were identified related to FLEX HEPs. If FLEX actions are identified as important during a certain plant configuration based on the Real-Time Risk tool (PARAGON), configuration-specific RMA candidates would be identified.

In general, determination of RMAs involves the use of both qualitative and quantitative considerations for the specific plant configuration and the practical

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 57 of 78 Docket No. 50-410 means available to manage risk. The scope and number of RMAs developed and implemented are reached in a graded manner.

Exelon Risk Management procedures contain guidance for development of RMAs in support of the RICT program. Development of RMAs considers those developed for other processes, such as the RMAs developed under the 10CFR 50.65(a)(4) program and the protected equipment program. Additionally, Common Cause RMAs are developed to address the potential impact of common cause failures.

RMAs are identified based on the configuration-specific risk. There are three categories of RICT RMAs:

1) Actions to increase risk awareness and control, such as briefing of crews on risk important operator actions and procedures.

2) Actions to reduce the duration of maintenance activities, such as performing activities around the clock.

3) Actions to minimize the magnitude of the risk increase, such as protecting risk important equipment or minimizing fire risk in risk important rooms.

General RMAs are developed for input into the site-specific RICT system guidelines.

These guidelines are developed using a graded approach. Consideration is given for system functionality. These RMAs include:

• Consideration of rescheduling maintenance to reduce risk

• Discussion of RICT in pre-job briefs

• Consideration of proactive return-to-service of other equipment

• Efficient execution of maintenance.

In addition to the RMAs developed qualitatively for the system guidelines, RMAs are developed based on the Real-Time Risk tool to identify configuration-specific RMA candidates to manage the risk associated with internal events, internal flooding, and fire events. These actions include:

• Identification of important equipment or trains for protection

• Identification of important Operator Actions for briefings

• Identification of key fire initiators and fire zones for RMAs in accordance with the site Fire RMA process

• Identification of dominant initiating events and actions to minimize potential for initiators

• Consideration of insights from PRA model cutsets, through comparison of importances.

Common cause RMAs are also developed to ensure availability of redundant SSCs, to ensure availability of diverse or alternate systems, to reduce the likelihood of initiating events that require operation of the out-of-service components, and to prepare plant personnel to respond to additional failures. Common cause RMAs are developed by considering the impact of loss of function for the affected SSCs.

Examples of common cause RMAs include:

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 58 of 78 Docket No. 50-410

• Performance of non-intrusive inspections on alternate trains

• Confidence runs performed for standby SSCs

• Increased monitoring for running components

• Expansion of monitoring for running components

• Deferring maintenance and testing activities that could generate an initiating event which would require operation of potentially affected SSCs

• Readiness of operators and maintenance to respond to additional failures

• Shift briefs or standing orders which focus on initiating event response or loss of potentially affected SSCs.

iii.1. Because a response to RAI question 14.d.ii is provided above, no response to this question is required.

iii.2. Because a response to RAI question 14.d.ii is provided above, no response to this question is required.

iii.3. Because a response to RAI question 14.d.ii is provided above, no response to this question is required.

iii.4. Because a response to RAI question 14.d.ii is provided above, no response to this question is iii.4. required.

iii.5. Because a response to RAI question 14.d.ii is provided above, no response to this question is required.

e.i. Incorporation of FLEX into the NMP2 PRA model is a reflection of plant modifications and procedure changes. Updating the model to reflect such a change is necessary to maintain the model as representative of the as-built, as-operated plant. Accident sequences progress in the same manner as before, except there is the possibility of extended time for power to be available and alternate injection sources. Risk estimation capability is not changed, all FLEX system implementations were made utilizing the existing PRA methodology.

The model changes associated with incorporating FLEX mitigating strategies and their disposition regarding (1) new methodology, (2) change in scope and (3) change in capability are noted in Table 14.e.i-1.

The term new method used in this disposition is consistent with Table A-1 of RG 1.200, Rev. 2.

The Scope attribute is defined consistent with Section C of RG 1.2006, i.e., The scope of the PRA ...is defined in terms of (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

6 REGULATORY GUIDE 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009, Rev. 2.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 59 of 78 Docket No. 50-410 Consistent with concepts in RG 1.200, Rev. 2 as well as the basis for Capability Category distinctions in the PRA Standard, the term capability used in this disposition is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the Capability Category (from Not Met or CC-I to CC-II) for one or more SRs.

Table 14.e.i-1 Summary of FLEX Model Changes in NMP2 FPIE PRA Change Significant New in Change in Impact on PRA Model Change Method(1) Scope(2) Capability(3) Sequences(4) Comment Creation of FLEX No No No --- The FLEX System Fault Tree was System fault tree created in a manner analogous to the already existing fault trees.

Failure rate values for new equipment is described in Section c above. All the human error probabilities for FLEX components were evaluated with the same methodology used for all human error probabilities in the NMP2 PRA models as documented in the NMP2 HRA notebook. No new methods were employed. The scope of the model remains identical and no change in the capability categories for any supporting requirement apply.

Edits to SBO Event No No No --- This is an edit to an existing Event Tree reflecting FLEX Tree and corresponding top logic implementation and event tree.

corresponding Top No new methods were employed.

Logic Event Tree The scope of the model remains identical and no change in the capability categories for any supporting requirement apply.

Edits to Transient No No No --- This is an edit to an existing Fault Event Tree Top Trees.

Logic, and AC fault No new methods were employed.

tree to implement The scope of the model remains FLEX capability. identical and no change in the capability categories for any supporting requirement apply.

Credited FLEX DG for No No No --- This is an edit to existing fault trees.

CV-RB (Local No new methods were employed.

Containment Vent) The scope of the model remains editing SRV system identical and no change in the fault tree and top capability categories for any logic for the Large supporting requirement apply.

LOCA fault tree.

1. New Method: Consistent with Table A-1 of RG 1.200, Rev. 2, the term new method refers to an analysis method (i.e., not documentation method) that is new to the subject PRA even if the method itself is not new and has been applied in other

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 60 of 78 Docket No. 50-410 PRAs. This term also encompasses newly developed methods in the industry that have been implemented in the base PRA in question.

2. Change in Scope: Consistent with Section C of RG 1.200, Rev. 2, the term PRA scope is defined in terms of the following three attributes: (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

3. Change in Capability: Consistent with concepts in RG 1.200, Rev. 2, as well as the basis for Capability Category distinctions in the PRA Standard, this term is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the Capability Category (from Not Met or CC-I to CC-II) for one or more SRs.

4. Impact on Significant Accident Sequences or Significant Accident Progression Sequences: This term encompasses both Level 1 (core damage) and Level 2 (post-core damage) accident sequences. This criterion is interpreted in this context of PRA Upgrade as the top 95% of sequences and whether the makeup of those sequences have been significantly impacted. Whether the makeup of the top 95% of the sequences is determined to be significantly impacted is based on a qualitative consideration as to whether the change in the sequences would likely change decision making when applying the PRA in risk applications. For example, top sequences in the top 95% that for the model change drop out of the top 95% would be a case where justification should be provided as to why the change in question is not considered an upgrade or it should be identified as an upgrade. NOTE: Per the ASME PRA Standard Addenda A and RG 1.200, Rev. 2, definition of PRA upgrade, this criterion is logically ANDed with the other criteria of first having to be a change in scope or a change in capability.

e.ii. Because a response to RAI question 14.e.i is provided above, no response to this question is required.

RAI 15

The LAR proposed TS LCOs include those related to instrumentation and controls (I&C). PRA technical acceptability attributes are provided in Section 2.3.4 of NEI 06-09, Revision 0-A, and in RG 1.200, Revision 2. The LAR does not address whether the I&C is modeled in sufficient detail to support implementation of TSTF-505, Revision 2. The following additional information is requested:

a. Explain how instrumentation is modeled in the PRA. This should include, but not be limited to, the scope of the I&C equipment (e.g., channel, relays logic) and associated TS functions for which an RICT would be applied, and PRA modeling of I&C and associated functions, including the level of detail and inclusion of plant-specific data, etc.

b. For any I&C design basis functions or I&C components in scope of the RICT program not modeled in the PRA, justify why the lack of modeling has no impact on the RICT program, or alternatively, describe any proposed surrogates and justify why the proposed surrogate adequately captures the configuration risk;

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 61 of 78 Docket No. 50-410

c. Regarding digital I&C, the NRC staff notes the lack of consensus industry guidance for modeling these systems for plant PRAs to be used in risk-informed applications. In addition, known modeling challenges exist due to the lack of industry data for digital I&C components and the complexities associated with modeling software failures, including common cause software failures. Given these needs and challenges, if the modeling of digital I&C system is included in the RTR model, then address the following:

i. Provide the results of a sensitivity study on the SSCs in the RICT program demonstrating that the uncertainty associated with modeling digital I&C systems has inconsequential impact on the RICT calculations.

ii. Alternatively, identify which LCOs are determined to be impacted by the digital I&C system modeling for which RMAs will be applied during an RICT. Explain and justify the criteria used to determine what level of impact to the RICT calculation require additional RMAs Exelon Response to RAI 15 Response to RAI-15 a)

Instrumentation is included in the PRA to support the modeled systems (i.e., Safety-Related and non-Safety-Related systems). Some instruments (relays, switches, transmitters) are explicitly modeled in the PRA, while other instruments are included within the main components boundary (e.g. instrument air compressor boundary includes the compressor, motor, local circuit breaker, and local instrumentation and control circuitry). For those components not explicitly included in the PRA, a surrogate is identified. One to one mapping is maintained; meaning that only one surrogate is identified for one component.

Relative to the Safety Systems, the Reactor Protection System (RPS) consists of two independent, functionally identical trip systems (A and B). Each trip system is further divided into two independent, functionally identical trip channels (A1, A2; B1, B2). These four channels consist of independent sensors, relays, contacts, switches, and trip units. The ECCS Initiation System interfaces with RPS to provide the automatic initiation of ADS, LPCS, LPCI, HPCS, and RCIC.

The failure data is handled in the same fashion as other components with Type Codes assigned for each component type. The instrument failure rates are updated during scheduled PRA updates; generic failure rates from NUREG/CR-6928 or other industry data is used. Plant-specific instrument failure information is gathered from the site, and a Bayesian update is performed.

The inclusion of instrumentation in the model is judged adequate to represent the reliability of systems credited in the PRA. There are no open Peer Review Findings regarding instrumentation. To demonstrate at a high level the breadth of instrumentation included in the PRA model, Table 15-1 lists the instrumentation for key TS related systems addressed in the PRA (examples of modeled components and component types). Any additional instrumentation not in the table is similarly modeled to support other systems and operator actions.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 62 of 78 Docket No. 50-410 Table 15-1: NMP2 TS INSTRUMENTS RPS INSTRUMENTS MODELED TS TABLE 3.3.1.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE N/A. Component not explicitly modeled. IRMs are Not Modeled, considered encompassed by the electrical scram

1. Intermediate Range Monitors Common-Cause Electrical Scram Failure failure event, therefore channel failure can be used as surrogate.

N/A. Component not explicitly modeled. ARMs are Not Modeled, considered encompassed by the electrical scram

2. Average Power Range Monitors Common-Cause Electrical Scram Failure failure event, therefore channel failure can be used as surrogate.

Vessel Pressure Transmitter Fails (Used for ATWS signal) Pressure Transmitter

3. Reactor Vessel Steam Dome Pressure Relay Fails on Demand Fails (Used for ATWS signal) Relay N/A. Component not explicitly modeled. Level 3 Not Modeled, water level is considered encompassed by the

4. Reactor Vessel Water Level - Low, Level 3 Common-Cause Electrical Scram Failure electrical scram failure event, therefore channel failure can be used as surrogate.

Main Steam Isolation Valve Pressure Transmitter

5. Main Steam Isolation Valve - Closure Operator Fails to Manually Close Spurious Open MSIVs N/A (Manual Action)

6. Drywell Pressure - High Drywell High Pressure Switch Fails Pressure Switch N/A. Component not explicitly modeled. Scram Not Modeled, discharge water level is considered encompassed

7. Scram Discharge Volume Water Level - High Common-Cause Mechanical Scram Failure by the mechanical scram failure event, therefore channel failure can be used as surrogate.

N/A. Component not explicitly modeled. Turbine Not Modeled, stop valve is considered encompassed by the

8. Turbine Stop Valve - Closure Common-Cause Electrical Scram Failure electrical scram failure event, therefore channel failure can be used as surrogate.

N/A. Component not explicitly modeled. Turbine

9. Turbine Control Valve Fast Closure, Trip Oil Not Modeled, stop valve is considered encompassed by the Pressure - Low Common-Cause Electrical Scram Failure electrical scram failure event, therefore channel failure can be used as surrogate.

10. Reactor Mode Switch - Shutdown Position Operators Fail to put Mode Switch in Shutdown N/A (Manual Action)

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 63 of 78 Docket No. 50-410 RPS INSTRUMENTS MODELED TS TABLE 3.3.1.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE N/A. Component not explicitly modeled, is Not Modeled, considered encompassed by the electrical scram

11. Manual SCRAM Common-Cause Electrical Scram Failure failure event, therefore channel failure can be used as surrogate.

RCIC INSTRUMENTS MODELED TS TABLE 3.3.5.3.1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE Reactor Core Isolation Cooling (RCIC) System Vessel Low Level Signal Relay Fails to Pick Up Relay

1. Reactor Vessel Water Level - Low, Level 2 Vessel Low Level Switch Fails to Operate on Demand Level Switch Vessel High Level (8) Relay Fails to Pick Up Relay

2. Reactor Level 8, High Vessel High Level (8) Switch Fails to Operate on Demand Level Switch

3. Pump Suction Pressure Low CST Low Level Signal to RCIC Relay Fails Level Switch N/A. Component not explicitly modeled, is within

4. Pump Suction Pressure Timer RCIC Pump Fails to Start RCIC pump component boundary, therefore surrogate for pump start failure can be used.

Equipment not modeled. Operator action HEP can be used

5. Manual Initiation N/A (Manual Action) as surrogate: Operator Fails to Manually Control RCIC ECCS INSTRUMENTS MODELED TS TABLE 3.3.5.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE

1. Low Pressure Coolant Injection-A (LPCI) and Low Pressure Core Spray (LPCS) Subsystems a,b. Reactor Vessel Water Level - Low Level 3, Not Modeled. Level 3 isolates Shutdown Cooling, which is a N/A Level 1 system not credited in the PRA Model.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 64 of 78 Docket No. 50-410 ECCS INSTRUMENTS MODELED TS TABLE 3.3.5.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE Drywell Pressure Switch Fails Pressure Switch c, d. Drywell Pressure - High Drywell High Pressure Switch Fails Pressure Switch LPCS Permissive Differential Pressure Transmitter Fails Pressure Transmitter

e. LPCS Pump Start - Time Delay Relay (Normal LPCS Permissive Diff. Pressure Switch Fails to Operate Pressure Switch Power)

LPCS Pressure Permissive Relay Fails Relay

f. LPCI Pump A Start - Time Delay Relay (Normal LPCI B Sequencer Relay Fails To Pick Up Relay Power)

g. LPCS Pump Start - Time Delay Relay LPCS Sequencer Relay Fails To Pick Up Relay (Emergency Power)

h. LPCI Pump A Time Delay Relay (Emergency ECCS Sequencer Time Delay Relay fails to pick up Relay Power)

LPCS Permissive Differential Pressure Transmitter Fails Pressure Transmitter

i. LPCS Differential Pressure - Low (Injection LPCS Permissive Diff. Pressure Switch Fails to Operate Switch Permissive)

LPCS Pressure Permissive Relay Fails to Pick Up Relay LPCI A Permissive Differential Pressure Transmitter Fails Pressure Transmitter

j. LPCI A Differential Pressure - Low (Injection LPCI A Permissive Diff. Pressure Switch Fails to Operate Pressure Switch Permissive)

LPCI A Pressure Permissive Relay Fails to Pick Up Relay LPCS Flow Transmitter For Min Flow MOV107 Control Fail Flow Transmitter

k. LPCS Pump Discharge FlowLow (Bypass)

LPCS Flow Switch For Min Flow MOV107 Control Fails Flow Switch RHR A Flow Transmitter For Min Flow MOV4A Control Fails Flow Transmitter

l. LPCI Pump A Discharge Flow - Low (Bypass) RHR A Flow Switch For Min Flow MOV4A Control Fails Flow Switch Control Relay For RHR A Min Flow MOV4 Control Drops Out Relay

m. Manual Initiation Operators Fail to Manually Initiate ECCS N/A (Manual Action)

2. Low Pressure Coolant Injection (LPCI) B & C Subsystems

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 65 of 78 Docket No. 50-410 ECCS INSTRUMENTS MODELED TS TABLE 3.3.5.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE Not Modeled. Level 3 isolates Shutdown Cooling, which is a a,b. Reactor Vessel Water Level - Low, Level 3 N/A system not credited in the PRA Model.

Drywell Pressure Switch Fails Pressure Switch c, d. Drywell Pressure - High Drywell High Pressure Switch Fails Pressure Switch

e. LPCI B Pump Start - Time Delay Relay LPCI B Sequencer Relay Fails To Pick Up Relay (Normal Power)

f. LPCI C Pump Start - Time Delay Relay (Normal LPCI C Sequencer Relay Fails To Pick Up Relay Power)

g. LPCI B Pump Start - Time Delay Relay LPCI B Sequencer Relay Fails To Pick Up Relay (Emergency Power)

h. LPCI C Pump Start - Time Delay Relay LPCI C Sequencer Relay Fails To Pick Up Relay (Emergency Power)

i. LPCI B and C Differential Pressure - Low LPCI B Permissive Differential Pressure Transmitter Fails. Pressure Transmitter (Injection Permissive)

RHR B Flow Transmitter For Min Flow MOV4B Control Fails Flow Transmitter

j. LPCI B & C Pump Discharge Flow - Low (Bypass) RHR B Flow Switch For Min Flow MOV4B Control Fails Switch Relay for Min Flow MOV4B Control Drop Relay

m. Manual Initiation Operators Fail to Manually Initiate ECCS N/A (Manual Action)

3. High Pressure Core Spray (HPCS) Subsystem Vessel Level Transmitter Fails Level Transmitter Vessel Low Level Switch Fails to Operate Switch

a. Reactor Vessel Water Level - Low, Level 2 Vessel Low Level Signal "A" Relay Fails to Pick Up Relay Drywell Pressure Transmitter Fails Pressure Transmitter

b. Drywell Pressure - High High DW Pressure Switch Fails to Operate Pressure Switch

c. Reactor Level 8, High Vessel High Level (8) Signal Relay Fails to Pick Up Transmitter

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 66 of 78 Docket No. 50-410 ECCS INSTRUMENTS MODELED TS TABLE 3.3.5.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE N/A. Component not explicitly modeled, is within HPCS pump component boundary, therefore

d. Pump Suction Pressure Low HPCS Pump Discharge Pressure Transmitter Fails surrogate for pump discharge pressure transmitter can be used.

N/A. Component not explicitly modeled, is within HPCS pump component boundary, therefore

e. Pump Suction Pressure Timer HPCS Pump Discharge Pressure Transmitter Fails surrogate for pump discharge pressure transmitter can be used.

N/A. Component not explicitly modeled, Suppression Pool water level high will cause HPCS pump to fail,

f. Suppression Pool water Level High HPCS Pump Fails to Run During the First Hour therefore surrogate for HPCS pump failure can be used.

N/A. Component not explicitly modeled, Suppression

g. Suppression Pool water Level High (Bypass) HPCS Pump Fails to Run During the First Hour Pool water level high will cause HPCS pump to fail, therefore surrogate for pump failure can be used.

HPCS Pump Flow Transmitter Fails Flow Transmitter

h. HPCS Flow Rate HPCS Pump Flow Switch Fails Switch

i. Manual Initiation Operators Fail to Manually Initiate ECCS N/A (Manual Action)

4. ADS System A Instruments not modeled. Failure of the SRVs and Operator

a. Reactor Vessel Water Level - Low, Level 1 actions included. Number of SRVs for success depends on N/A, PRA treats ADS as manually initiated per EOPs specific plant conditions.

Instruments not modeled. Failure of the SRVs and Operator

b. ADS Initiation Timer actions included. Number of SRVs for success depends on N/A, PRA treats ADS as manually initiated per EOPs specific plant conditions.

c. Reactor Vessel Water Level - Low, Level 3 Not explicitly modeled; surrogate for Failure to Scram, ADS N/A, PRA treats ADS as manually initiated per EOPs (Permissive) initiation and RHS isolation

d. LPCS Pump Discharge Pressure High Not explicitly modeled, surrogate LPCS Pump Fails To Start N/A, PRA treats ADS as manually initiated per EOPs

e. LPCI A Pump Discharge Pressure High Not explicitly modeled, surrogate RHR A Pump Fails To Start N/A, PRA treats ADS as manually initiated per EOPs

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 67 of 78 Docket No. 50-410 ECCS INSTRUMENTS MODELED TS TABLE 3.3.5.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE F. Manual Initiation Operator Fails to Manually Depressurize N/A (Manual Action)

4. ADS System B Instruments not modeled. Failure of the SRVs and Operator

a. Reactor Vessel Water Level - Low, Level 1 actions included. Number of SRVs for success depends on N/A, PRA treats ADS as manually initiated per EOPs specific plant conditions.

Instruments not modeled. Failure of the SRVs and Operator

b. ADS Initiation Timer actions included. Number of SRVs for success depends on N/A, PRA treats ADS as manually initiated per EOPs specific plant conditions.

c. Reactor Vessel Water Level - Low, Level 3 Not explicitly modeled; surrogate for Failure to Scram, ADS N/A, PRA treats ADS as manually initiated per EOPs (Permissive) initiation and RHS isolation

d. LPCI B Pump Discharge Pressure High Not explicitly modeled, surrogate RHR B Pump Fails To Start N/A, PRA treats ADS as manually initiated per EOPs

e. LPCI C Pump Discharge Pressure High Not explicitly modeled, surrogate RHR C Pump Fails To Start N/A, PRA treats ADS as manually initiated per EOPs F. Manual Initiation Operator Fails to Manually Depressurize N/A (Manual Action)

RPV INSTRUMENTS MODELED TS TABLE 3.3.5.2-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE 3.3.5.2.1 (a,b,c,d,e) RPV Inventory Control - Low Pressure Coolant Injection-A (LPCI) and Low Reactor Vessel Level 1 low level Level Instrumentation Pressure Core Spray (LPCS) 3.3.5.2.2 (a,b,c) RPV Inventory Control - LPCI B and Reactor Vessel Level 1 low level Level Instrumentation C Subsystems 3.3.5.2.3 RPV Inventory Control - HPCS Subsystem Reactor Vessel Level 2 low level Level Instrumentation N/A. Component not explicitly modeled, surrogate 3.3.5.2.4 RHR Isolation RPV Water Level 3 RHR Isolation Valves Fail to Close for pump start failure can be used.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 68 of 78 Docket No. 50-410 ISOLATION ACTUATION INSTRUMENTS MODELED TS TABLE 3.3.6.1-1 FUNCTION EXAMPLE OF MODELED COMPONENTS INSTRUMENT TYPE

1. Main Steam Isolation Vessel Low Level Switch Fails Level Switch

a. Reactor Vessel Water Level - Low, Level 1 Relay Fails to Drop Out Relay Vessel Level Transmitter Fails High Level Transmitter N/A. Component not explicitly modeled, surrogate MSIVs can be used. MSIVs are closed with a one (1)

b. Main Steam Line Pressure Low Main Steam Isolation Valve Transfers Closed out of two (2) twice logic. Each logic channel can be actuated on low steam line pressure.

2. Primary Containment Isolation Vessel Low Level Signal "A" Relay Fails to Pick Up. Relay

a. Reactor Vessel Water Level - Low, Level 2 Vessel Low Level Switch Fails to Operate Level Switch Reactor Water Low Level Transmitter Fall Level Transmitter

b. Drywell Pressure High Drywell High Pressure Switch Fails Pressure Transmitter N/A. Component not explicitly modeled; surrogate pressure transmitter can be used. RCIC Isolation is not

3. RCIC Isolation Vessel Pressure Transmitter Fails explicitly modeled, therefore surrogate mapping to the Div I/II Redundant Reactivity Control System (RRCS) transmitter is appropriate.

Circuit Breaker Fails to Close Breaker

4. Reactor Water Cleanup (RWCU) Isolation Relay To RWCU Outboard Iso Valve Fails Relay

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 69 of 78 Docket No. 50-410 Response to RAI-15 b)

As mentioned in the response to RAI-15 part a response (above) for components not explicitly included in the PRA, a surrogate is identified. The surrogates are basic events that can be used to model bounding impacts of removing the instruments from service. One to one mapping is maintained; meaning that only one surrogate is identified for one component (refer to tables provided in RAI-15 part a response).

Response to RAI-15 c)

Digital Feedwater Level Control was installed at NMP2 is this most recent outage (March 2020).

This modification has not yet been incorporated in the PRA. However, a bounding sensitivity has been performed. With regard to digital feedwater level control, level control malfunctions could cause a loss of feedwater flow to the RPV. Conversely, a spurious low RPV level signal could cause an RPV overfill challenge. The PRA includes feedwater-level control failure modes which could cause a failure of feedwater and this modeling has been adapted for additional digital control failure modes as part of this sensitivity. This new failure mode is assigned a value of 1E-4 for this sensitivity via judgement. Also, the NMP2 PRA addresses plant overfull by assuming a Level 8 trip challenge for all transients; nominally because HPCS automatically operates and, absent operator intervention, this would challenge the Level 8 trip system. The Level 8 trip is an analog system which senses high RPV level and trips feedwater, HPCS and RCIC to prevent RPV overfill. Such an overfill could cause water to enter the RCIC and MSIV steam lines rendering RCIC and the main heat sink systems unavailable. Since the model assumes this challenge, a spurious high RPV level caused by the digital feedwater level control is bounded in the model.

For the digital feedwater level control system sensitivity, the NMP2 model was edited for the following:

• Under gate FWSEQUIPT, OR-in a new BE called ZZFWD_FWLCS-LVHI Level Control Failure Senses Spurious High RPV Level and Closes FW FCVs.

• Set ZZFWD_FWLCS-LVHI Equal to 1E-4.

The results of this sensitivity show that the system has a negligible impact on RICT results and are provided in Table 1-2.

Table 1-2 Digital Feedwater Level Control Sensitivity ID TS Condition Function LAR Sensitivity Results 3-3-5-3-B_1 RCIC System Instrumentation - As Reactor Vessel Water Level 30 days 30 days required by Required Action A.1 and - Low Low, Level 2 referenced in Table 3.3.5.3-1.

3-3-5-3-B_2 RCIC System Instrumentation - As Reactor Vessel Water Level 30 days 30 days required by Required Action A.1 and -High, Level 8 referenced in Table 3.3.5.3-1.

3-3-5-3-D_1 RCIC System Instrumentation - As Pump Suction Pressure - 30 days 30 days required by Required Action A.1 and Low referenced in Table 3.3.5.3-1.

3-3-5-3-D_2 RCIC System Instrumentation - As Pump Suction Pressure - 30 days 30 days required by Required Action A.1 and Timer referenced in Table 3.3.5.3-1.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 70 of 78 Docket No. 50-410 Table 1-2 Digital Feedwater Level Control Sensitivity ID TS Condition Function LAR Sensitivity Results 3-5-1-B_1 High Pressure Core Spray (HPCS) High Pressure injection into 30 days 30 days System inoperable. the RPV 3-5-1-C_4 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_7 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_8 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_9 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-1-C_10 Two ECCS injection subsystems RPV injection and decay 30 days 30 days inoperable OR One ECCS injection heat removal and one ECCS spray subsystem inoperable.

3-5-3-A-2_1 RCIC System Inoperable. Supply high pressure 30 days 30 days makeup water to the RPV.

RAI 16

NEI 06-09, Revision 0-A states concerning the quality of the PRA model that:

RG 1.174, Revision 1, and RG 1.200, Revision 1 define the quality of the PRA in terms of its scope, level of detail, and technical adequacy. The quality must be compatible with the safety implications of the proposed TS change and the role the PRA plays in justifying the change.

LAR Attachment 6 lists six implementation items that must be complete prior to implementation of the RICT program. The attachment table (1) identifies for each implementation item the modeling that needs to be incorporated (2) makes the commitment to update the "PRA model" and (3) provides other details such as clarification that the success criteria associated with the PRA update will match the design basis success criteria. The LAR attachments do not explicitly state whether the fire PRA models as well as the internal events PRA models will be updated or whether the RTR model will be updated.

In light of the observations above, clarify that the internal events and fire PRA models and the RTR model will all be updated to incorporate the implementation items prior to implementation of the RICT program. Otherwise, justify not incorporating the update into the fire PRA or RTR model.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 71 of 78 Docket No. 50-410 Exelon Response to RAI 16 Both the FPIE and Fire PRA models as well as the RTR tool will be updated with the items identified in Attachment 6 prior to implementation of the RICT program at NMP2.

RAI 17

The NRC will provide RAI Question 17 on a separate request.

RAI 18

The LAR provides the history of the FPRA peer review but does not discuss methods used in the FPRA. In Section 4 of Enclosure 9 to the LAR, it is stated that NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities" (ADAMS Accession Nos.

ML052580075, ML052580118, and ML103090242) was used to guide the development of the FPRA. It is unclear in the LAR whether methods may have been used in the FPRA that deviate from guidance in NUREG/CR-6850 or other acceptable guidance (e.g., frequently asked questions (FAQs), NUREGs, or interim guidance documents).

a. Identify methods used in the FPRA that deviate from guidance in NUREG/CR-6850 or other acceptable guidance.

b. If such deviations exist, then justify their use in the FPRA, any impact on the RICT, and describe and justify any replacement methods to be used.

Exelon Response to RAI 18 a) No methods were used in developing the NMP2 Fire PRA that deviated from acceptable guidance. This conclusion was independently derived but consistent with the BWROG RG 1.200 Fire PRA Peer Review Report from October 2018 which did not identify any F&Os for use of an unreviewed analysis method (UAM) as defined in NEI 07-12 R1.

b) Not applicable.

RAI 19

The key factors used to justify using transient fire-reduced heat release rates (HRRs) below those prescribed in NUREG/CR-6850 are discussed in the June 21, 2012, NRC letter to Nuclear Energy Institute (NEI), "Recent Fire PRA Methods Review Panel Decisions and EPRI 1022993, Evaluation of Peak Heat Release Rates in Electrical Cabinet Fires" (ADAMS Package Accession No. ML12172A406).

In Table E9-3 of Enclosure 9 to the LAR, it is stated that HRR is an input parameter to the analysis to translate a fire initiating event into a set of consequences. If any reduced transient HRRs below the bounding 98 percent HRR of 317 kilowatts (kW) from NUREG/CR-6850 were used, discuss the key factors used to justify the reduced HRRs. Include in this discussion:

a. Identification of the fire areas where a reduced transient fire HRR is credited and what reduced HRR value was applied.

b. A description for each location where a reduced HRR is credited and a description of the administrative controls that justify the reduced HRR, including how location-specific attributes and considerations are addressed. Include a discussion of the required controls for ignition sources in these locations and the types and quantities of

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 72 of 78 Docket No. 50-410 combustible materials needed to perform maintenance. Also, include discussion of the personnel traffic that would be expected through each location.

c. The results of a review of records related to compliance with the transient combustible and hot work controls.

Exelon Response to RAI 19 Only the 98th percentile heat release rate (HRR) of 317 kW (or its applicable gamma distribution) from NUREG/CR-6850 was used in developing transient fire scenarios for the NMP2 Fire PRA. Refer to Section 3.1.10 of the FSS Summary Notebook N2-PRA-021.07.01 Rev 1. Therefore, this question is not applicable to NMP2.

RAI 20

In Section 4 of Enclosure 9 to the LAR, it is stated that the FPRA methods were based, in part, on published FPRA FAQs, but the specific FAQs were not identified. FAQ 13-0004, "Clarifications on Treatment of Sensitive Electronics" (ADAMS Accession No. ML13322A085),

provides supplemental guidance for application of the damage criteria provided in Sections 8.5.1.2 and H.2 of NUREG/CR-6850, Volume 2, for solid-state and sensitive electronics.

a. Describe the treatment of sensitive electronics for the FPRA and explain whether it is consistent with the guidance in FAQ 13-0004, including the caveats about configurations that can invalidate the approach (i.e., sensitive electronics mounted on the surface of cabinets and the presence of louver or vents).

b. If the approach cannot be justified to be consistent with FAQ 13-0004, then justify that the treatment of sensitive electronics has no impact on the RICT calculations.

c. If the approach cannot be justified as consistent with FAQ13-004, and it has an impact on the RICT calculations, describe and justify how this issue will be resolved.

Exelon Response to RAI 20 As discussed in Section 3.11.2 and Appendix B of the FSS Summary Notebook , the approach applied to sensitive electronics was based on the guidance provided in FAQ 13-0004. FAQ 13-0004 supports use of the damage threshold for thermoset cables for assessing the potential for thermal damage to solid-state and sensitive electronics within an electrical cabinet. The caveats concerning sensitive electronics mounted on the surface of cabinets and the presence of louvers or vents were applied during the screening process for sensitive electronics. The identification and disposition of sensitive electronics was accomplished thru a series of screening measures including basic event screening to eliminate modeled equipment not associated with sensitive electronics such as passive equipment (check valves, tanks, etc.) or electro-mechanical components (pumps, MOVs). Initial screening is then followed by identification of the locations where sensitive electronics may be located. The locations are based on the endpoints for the cables associated with each component that survived initial screening. A subsequent screening of endpoints is performed to address the potential for radiant exposure impact due to surface mounting and/or the location of ventilation openings. If either of those conditions is found, the endpoint (or cabinet) does not screen as a target based on the damage criteria from FAQ 13-0004. For those cases, the damage threshold provided in Section H.2 of NUREG/CR-6850 would apply. Targets based on the review of sensitive electronics as described above were identified for inclusion in the applicable fire scenarios.

Part b and Part c to RAI 20 are not applicable to NMP2.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 73 of 78 Docket No. 50-410

RAI 21

In Table E9-3 of Enclosure 9 to the LAR, the human error probabilities (HEP) used in the FPRA are discussed, but does not explicitly identify the method (i.e., guidance) used to determine the GEP values or list the minimum joint HEP value. NUREG-1921, "EPRI/NRC-RES Fire Human Reliability Analysis Guidelines - Final Report," (ADAMS Accession No. ML12216A104),

discusses the need to consider a minimum value for the joint probability of multiple human failure events in HRAs.

NUREG-1921 refers to Table 2-1 of NUREG-1792, "Good Practices for Implementing Human Reliability Analysis (HRA)" (ADAMS Accession No. ML051160213), which recommends that joint HEP values should not be below 1E-5. Table 4-4 of EPRI TR-1021081, "Establishing Minimum Acceptable Values for Probabilities of Human Failure Events," provides a lower limiting value of 1E-6 for sequences with a very low level of dependence. Therefore, the guidance in NUREG-1921 allows for assigning joint HEPs that are less than 1E-5, but only through assigning proper levels of dependency. The NRC staff notes that underestimation of maximum joint probabilities could result in non-conservative RICTs of varying degrees for different inoperable SSCs.

The LAR does not provide this information and does not explain what minimum joint HEP value is currently assumed in the internal events PRA or FPRA. Also, even if the assumed minimum joint HEP values are shown to have no impact on the current risk estimates, it is not clear to the NRC staff how it will be ensured that the impact remains minimal for future PRA model revisions.

a. Explain what minimum joint HEP (JHEP) value was assumed in the internal events and the fire PRAs.

b. If a minimum JHEP value less than 1E-6 was used in the internal events PRA, or less than 1E-5 was used in the FPRA, then provide a description of the sensitivity study that was performed and the quantitative results that justify that the minimum JHEP value has no impact on the RICT application.

c. If, in response part (b), it cannot be justified that the minimum JHEP value has no impact on the application, then confirm that each JHEP value used in the internal events PRA below 1E-6 and each JHEP used in the FPRA below 1E-5 includes its own justification that demonstrates the inapplicability of the NUREG-1792 lower value guideline (i.e.,

utilizing the dependency factors identified in NUREG 1921). Provide an estimate of the number of these JHEP values below 1E-6 for the internal events PRA and below 1E-5 for the FPRA, discuss the range of values, and provide at least two different examples, separately for the internal events and the fire PRAs, where this justification is applied.

d. During the regulatory audit conducted May 4 to 7, 2020, the licensee identified that no JHEPs less than 1.0E-05 were used in the FPRA for the RICT although no lower limit on the JHEP was imposed. Absent an imposed lower limit, indicate how do you intend to track JHEPs in your FPRA as it evolves. Also, indicate a plan for your evolving FPRA to address JHEPs lower than 1.0E-05 consistent with part b) or part c) of this RAI.

Exelon Response to RAI 21 Response to RAI-21 a)

The approach to addressing the minimum joint HEP in the full power internal events (FPIE) HRA is based on Section 5.1 of EPRI 3002003150: a minimum JHEP value of 1.0E-06 is applied to

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 74 of 78 Docket No. 50-410 the base model with the option to relax the minimum value for specific combinations if a justification is provided for the relaxation. For NMP2, a justification was developed to address combinations of actions that are involved in long term loss of decay heart removal (DHR) scenarios. Based on both qualitative and quantitative arguments, the minimum JHEP value was slightly reduced from 1.0E-06 to 9.5E-07 for the failure to establish long term decay heat removal (i.e., to prevent containment failure) and to justify independence of this function from others actions in the model. A sensitivity analysis of the impact of the floor is also directed as part of the dependency process.

As was discussed in the regulatory audit conducted between May 4th and May 7th, the NMP2 Fire model of record did not formally impose a minimum JHEP value because all the non-loss of DHR JHEPs in the model of record were above 1.0E-05 and a basis was provided for the independence of the long term, loss of DHR events. For the 2020 update of the Fire PRA, the minimum JHEP value has been established based on the guidance in NUREG-1921. The last sentence of Section 6.2 of NUREG-1921 clearly states For Fire HRA, it is recommended that the application of a lower bound follow the same guidance as was applied to the internal events PRA. Therefore, the minimum JHEP for the 2020 Fire PRA is 1.0E-06 with the same option for relaxation that is described in the preceding paragraph for the loss of DHR events. A sensitivity analysis on the floor value is also required as part of the dependency methodology.

Response to RAI-21 b)

The sensitivity analyses that were performed for the FPIE and Fire models indicate that apart from combinations involving the loss of DHR events in the FPIE model, the base model results are not highly sensitive to the use of a minimum JHEP value.

For the FPIE model, a minimum JHEP value of 1.0E-06 is applied to all combinations of actions other than those associated the mitigation of long-term loss of DHR. A sensitivity analysis was performed to approximate the CDF and LERF when the minimum JHEP value of 1.0E-06 is also imposed on the loss of DHR action combinations. Using the 2019d PRA model, the CDF increased from 1.69E-06/yr to 2.70E-06/yr (60%) while LERF increased from 2.21E-07/yr to 2.98E-07/yr (35%).

While these increases in the CDF and LERF are large relative to the baseline FPIE results, the impact on the aggregate results is muted. The aggregate CDF increases about 7% from 1.91E-05 (1.75E-05 + 1.69E-06) to 2.05E-05 (1.78E-05 + 2.7E-06) and the LERF increases 2% from 5.78E-06 (5.56E-06 + 2.21E-07) to 5.89E-06 (5.59E-06 + 2.98E-07). These are small changes that would have very limited, if any, impact on the RICT results, and all of the changes would be driven the probability assumed for the failure of the operators to establish a means of DHR in very long term scenarios (i.e., beyond 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />). It is already well known that these actions are important to CDF and LERF results, and this sensitivity analysis provides no new insights into potential plant or procedure improvements. Finally, the NMP2 HRA provides a justification for the lower values used to model combinations of actions with those associated with the DHR function, and the reduced values are considered to be appropriate and to help ensure other potentially important contributors are not masked by this issue.

For the Fire PRA, the increases in CDF and LERF resulting from the application of the 1.0E-05 minimum JHEP value were for all combinations of operator actions were less than 2% each using the 2020 Fire PRA. CDF increased from 1.75E-05/yr to 1.78E-05/yr while LERF increased from 5.56E-06/yr to 5.59E-06/yr.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 75 of 78 Docket No. 50-410 Response to RAI-21 c)

Based on the response to part b, which identifies that the application of the proposed minimum JHEP values would not impact the RICT results, a response to this question is not required.

Response to RAI-21 d)

As described in the response to part a above, the Fire PRA now uses the same approach to addressing the minimum JHEP value as the FPIE model, and the Fire HRA methodology section has been updated to dictate the use of this process.

RAI 22

In Table E9-3 of Enclosure 9 to the LAR, it is stated that the heat release rates from NUREG-2178, "Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE -FIRE), Volume 1, "Peak Heat Release Rates and Effect of Obstructed Plume,"

(ADAMS Accession No. ML16110A14016) are used. NUREG-2178, Volume 1 contains refined peak HRRs, compared to those presented in NUREG/CR-6850, and guidance on modeling the effect of plume obstruction. Additionally, NUREG-2178 provides guidance that indicates that the obstructed plume model is not applicable to cabinets in which the fire is assumed to be located at elevations of less than one-half of the cabinet.

a. If obstructed plume modeling was used, then indicate whether the base of the fire was assumed to be located at an elevation of less than one-half of the cabinet.

b. Justify any modeling in which the base of an obstructed plume is located at less than one half of the cabinets height.

Exelon Response to RAI 22 Obstructed plume modeling was applied to the NMP2 Fire PRA. The base of the fire was assumed to be located above 1/2 panel height for all panels. Consistent with FAQ 08-0043, the base height of the fire was generally located 1 ft below the top of the panel.

Part b to RAI 22 is not applicable to NMP2.

RAI 23

In Section 4 of Enclosure 9 to the LAR, it is stated that the FPRA methods were based, in part, on published FPRA FAQs, but the specific FAQs were not identified. Guidance in FAQ 08-0042 from Supplement 1 of NUREG/CR-6850 applies to electrical cabinets below 440 volts (V). With respect to Bin 15, as discussed in Chapter 6, it clarifies the meaning of "robustly or well-sealed."

Thus, for cabinets of less than 440 V, fires from well-sealed cabinets do not propagate outside the cabinet. For cabinets of 440 V and higher, the original guidance in Chapter 6 indicates that Bin 15 panels that house circuit voltages of 440 V or greater are counted because an arcing fault could compromise panel integrity (an arcing fault could burn through the panel sides, but this should not be confused with the high energy arcing fault type fires). FPRA FAQ 14-0009, "Treatment of Well-Sealed MCC Electrical Panels Greater than 440V" (ADAMS Accession No. ML15119A176), provides the technique for evaluating fire damage from motor control center (MCC) cabinets having a voltage greater than 440 V. Therefore, propagation of fire outside the ignition source panel must be evaluated for all MCC cabinets that house circuits of 440 V or greater.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 76 of 78 Docket No. 50-410

a. Describe how fire propagation outside of well-sealed MCC cabinets greater than 440 V is evaluated.

b. If well-sealed cabinets less than 440 V are included in the Bin 15 count of ignition sources, justify that this approach has an inconsequential impact on the RICT calculations.

Exelon Response to RAI 23 Response to RAI-23 a)

The methodology specified in FAQ-14-0009 was applied to fire scenario development for well-sealed and robustly-secured motor control centers (greater than or equal to 440v) including assuming the propagation of fire outside of the enclosure in the determination of target damage for the applicable fraction of fire events.

Response to RAI-23 b)

Well-sealed and robustly secured cabinets confirmed to house circuits less than 440v were not counted. However, given the voltage level was not readily apparent for all cabinets during ignition source counting, some cabinets were recently flagged as housing circuits below 440v and re-evaluated to determine whether these cabinets should be screened from the count.

Specifically, 19 Fire Protection Monitoring (FPM) Panels (representing a count of 36 of the total Bin 15 population of over 2500) were confirmed to house circuits below 440v. Upon further review, it was concluded that the FPM panels do not strictly meet the well-sealed definition.

Therefore, all of the FPM panels were appropriately retained as ignition sources and some were analyzed as propagating. Accordingly, no well-sealed cabinets confirmed to house circuits less than 440v are included in the Bin 15 count of ignition sources.

RAI 24

In Section 4 of Enclosure 9 to the LAR, it is stated that the FPRA methods were based, in part, on published FPRA FAQs, but the specific FAQs were not identified. NUREG/CR-6850, Section 6, and FAQ 12-0064, "Hot Work/Transient Fire Frequency Influence Factors" (ADAMS Accession No. ML12346A488), describe the process for assigning influence factors for hot work and transient fires. Provide the following regarding application of this guidance:

a. Indicate whether the methodology used to calculate hot work and transient fire frequencies applies influencing factors using NUREG/CR-6850 guidance or FAQ 12 0064 guidance.

b. Indicate whether administrative controls are used to reduce transient fire frequency, and if so, describe and justify these controls.

c. Indicate whether you have any combustible administrative control that were not meet and discuss your treatment of not meeting these administrative controls for the assignment of transient fire frequency influence factors. For those cases where you have violations and have assigned an influence factor of 1 (low) or less, indicate the value of the influence factors you have assigned and provide your justification.

d. If you have assigned an influencing factor of "0" to maintenance, occupancy, storage, or hot work for any fire physical analysis units provide justification.

e. If a weighting factor of "50" was not used in any fire physical analysis unit, justify this in light of the guidance in FAQ 12-0084.

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 77 of 78 Docket No. 50-410 Exelon Response to RAI 24 Response to RAI-24 a)

The methodology specified in FAQ 12-0064 was applied in assigning influence factors for determining the hot work and transient fire frequency. An informal expert panel approach was used. As indicated in item b) below, the expert panel relied on historical knowledge, plant experience, and the FAQ guidance to assign the relative rankings. To that end, the current rankings are considered to be aligned with the intent of the FAQ, suitable for a best-estimate analysis, and preferable to a default ranking that could be assumed without benefit of expert panel insights. Additionally, the influence factors were peer reviewed and found to be reasonable.

Response to RAI-24 b)

Transient influence factors were ranked according to their relative likelihood using an informal expert panel approach using the guidance outlined in FAQ 12-0064. Administrative controls were not applied to reduce any transient fire frequencies.

Response to RAI-24 c)

Not applicable. As indicated in response to b) above, transient influence factors were assigned based on input from station personnel with historical knowledge and relevant plant experience.

Response to RAI-24 d)

An influence factor of 0 for storage was applied to the suppression pool (RB-POOL) and hydrogen storage (SITE-43) PAUs. The entire Bin 17 frequency associated with fixed hydrogen tanks was assigned to SITE-43 which influenced the decision to eliminate the additional contribution from transient fires due to storage. An influence factor of 0 for maintenance, occupancy, or hot work was not assigned to any PAUs.

Response to RAI-24 e)

The weighting factor of 50 - applicable to a rank of very high for maintenance or hot work - was not assigned to any PAUs. Typically, a 2-unit site will assign a 50 to the shared Turbine Deck to account for the staging of combustible materials prior to and during a refueling outage while the other unit remains at power. However, NMP1 and NMP2 do not share a common Turbine Building. Accordingly, it was determined that none of the PAUs warranted a significantly higher than average rank during implementation of the process.

RAI 25

In Section 4 of Enclosure 9 to the LAR, it is stated that the FPRA methods were based, in part, on published FPRA FAQs, but the specific FAQs were not identified. Traditionally, the cabinets on the front face of the main control board (MCB) have been referred to as the MCB for purposes of FPRA. Appendix L of NUREG/CR-6850, "EPRI/NRC Fire PRA Methodology for Nuclear Power Facilities" (ADAMS Accession Nos. ML052580075), provides a refined approach for developing and evaluating those fire scenarios. Fire PRA FAQ 14-0008, "Main Control Board Treatment," dated July 22, 2014 (ADAMS Accession No. ML14190B307), clarifies the definition of the MCB and effectively provides guidance for when to include the cabinets on the back side of the MCB as part of the MCB for FPRA. It is important to distinguish between MCB and non-MCB cabinets, because misinterpretation of the configuration of these cabinets can

Response to Request for Additional Information Attachment 1 Adopt Risk Informed Completion Times Page 78 of 78 Docket No. 50-410 lead to incomplete or incorrect fire scenario development. This FAQ also provides several alternatives to NUREG/CR-6850 for using Appendix L to treat partitions in an MCB enclosure.

Therefore, address the following:

a. Briefly describe the MCB configuration and describe whether cabinets on the rear side of the MCB are a part of the MCB.

b. If the cabinets on the rear side of the MCB are part of a single integral MCB enclosure, describe and justify the approach used to develop fire scenarios in the MCB and determine the frequency of those scenarios.

c. If the cabinets on the rear side of the MCB are part of a single integral MCB enclosure, describe and justify how the fire scenarios for the backside cabinets are developed.

d. Describe and justify the impact of the current treatment of the MCB and those cabinets on the rear side of the MCB on the RICT calculations.

Exelon Response to RAI 25 The NMP2 MCB configuration does not include any walk-thru segments as described in FAQ 14-0008. The NMP2 MCB consists of a collection of relatively small, narrow console type panels that, with minor exceptions, do not have controls on the rear side. Typically, the backside of the MCB consists of blank access panels. Where rear devices are present, those failures were determined to be included or subsumed by the failures assumed on the front side of the MCB. Note: MCB fire scenarios developed using the NUREG/CR-6850 Appendix L methodology have since been replaced during the 2020 update of the NMP2 Fire PRA with the event tree approach provided in NUREG-2178 Volume 2. The updated treatment was subject to a focused scope peer review and the results from that review have been addressed in the applicable FPRA notebook.