Text

License Amendment Request TSCR-175, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors
	ML17243A469
Person / Time
Site:	Duane Arnold
Issue date:	08/31/2017
From:	Dean Curtland; NextEra Energy Duane Arnold
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	NG-17-0169
	Download: ML17243A469 (59)
	v • d • e

{{#Wiki_filter:NEXTeraM EN ERGY~ DUANE ARNOLD August 31, 2017 NG-17-0169 10 CFR 50.90 10 CFR 50.69 U. S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTN : Document Control Desk Duane Arnold Energy Center Docket No. 50-331 Renewed Facility Operating License No. DPR-49 License Amendment Request TSCR-175, Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures. Systems. and Components (SSCs) for Nuclear Power Reactors" In accordance with the provisions of 10 CFR 50.69 and 10 CFR 50.90, NextEra Energy Duane Arnold, LLC (NextEra) is requesting an amendment to the license of Duane Arnold Energy Center (DAEC) . The proposed amendment would modify the licensing basis by the addition of a license condition to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation) . For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety. The enclosure to this letter provides the basis for the proposed change to the DAEC operating license. The categorization process being implemented through this change is consistent with NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0 dated July 2005 which was endorsed by the NRC in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance", Revision 1 dated May 2006. Attachment 1 of the enclosure provides a list of categorization prerequisites. Use of the categorization process on a plant system will only occur after these prerequisites are met. NextEra Energy Duane Arnold, LLC , 3277 DAEC Road, Palo, IA 52324

Document Control Desk NG-17-0169 Page2 The NRG has previously reviewed the technical adequacy of the DAEC Probabilistic Risk Assessment (PRA) model identified in this application in License Amendment Request TSCR-128, "Transition to 10 CFR 50.48(c) - NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (2001 Edition) (TSCR-128)," which was approved on September 10, 2013(ML13210A449). The NRG also previously reviewed the technical adequacy of the DAEC PRA models in License Amendment Request TSCR-120, "Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (TSTF-425; Rev. 3)," which was approved on February 24, 2012(ML120110282). NextEra requests that the NRG utilize the reviews of the PRA technical adequacy for those applications when performing the review for this application. NextEra requests approval of the proposed license amendment by September 1, 2018, with the amendment being implemented within 90 days. In accordance with 10 CFR 50.91, a copy of this application, with attachments is being provided to the designated Iowa official. This letter contains no NRG commitments . If you should have any questions regarding this submittal, please contact J. Michael Davis, Licensing Manager, at 319-851-7032. I declare under penalty of perjury that the foregoing is true and correct. Executed on August .3( , 2017. Sincerely,

~~

Dean Curtland Site Director NextEra Energy Duane Arnold, LLC

Enclosure:

Evaluation of the Proposed Change cc: Regional Administrator, USNRC, Region Ill, Project Manager, USNRC, Duane Arnold Energy Center Resident Inspector, USN RC, Duane Arnold Energy Center A. Leek (State of Iowa)

Enclosure NG-17-0169 Page 1 of 57 Enclosure Evaluation of the Proposed Change TABLE OF CONTENTS 1 Summary Description ........................................................................................ 3 2 Detailed Description .......................................................................................... 3 2.1 Current Regulatory Requirements ................................................................ 3 2.2 Reason for Proposed Change ...................................................................... 4 2.3 Description of the Proposed Change ............................................................ 5 3 Technical Evaluation .......................................................................................... 6 3.1.1 Overall Categorization Process ........................................................ 7 3.1.2 Passive Categorization Process ........................................................ 9 3.2 Technical Adequacy Evaluation (10 CFR 50.69(b)(2)(ii)) .............................. 10 3.2.1 Internal Events and Internal Flooding ............................................. 11 3.2.2 Fire Hazards .................................................................................. 11 3.2.3 Seismic Hazards ............................................................................ 11 3.2.4 Other External Hazards .................................................................. 12 3.2.5 Low Power & Shutdown ................................................................. 12 3.2.6 PRA Maintenance and Updates ....................................................... 12 3.2.7 PRA Uncertainty Evaluations .......................................................... 12 3.3 PRA Review Process Results (10 CFR 50.69(b)(2)(iii)) ................................. 14 3.4 Risk Evaluations (10 CFR 50.69(b)(2)(iv)) .................................................. 15 4 Regulatory Evaluation ....................................................................................... 16 4.1 Applicable Regulatory Requirements/Criteria ............................................... 16 4.2 No Significant Hazards Consideration Analysis ............................................. 16 4.3 Conclusions ............................................................................................... 18 5 Environmental Consideration ............................................................................. 19 6 References .......................................................................................................20

Enclosure NG-17-0169 Page 2 of 57 LIST OF ATTACHMENTS ATTACHMENT 1: LIST OF CATEGORIZATION PREREQUISITES .................................. 22 ATTACHMENT 2: DESCRIPTION OF PRA MODELS USED IN CATEGORIZATION ........... 23 ATTACHMENT 3: DISPOSITION AND RESOLUTION OF OPEN PEER REVIEW FINDINGS AND SELF-ASSESSMENT OPEN ITEMS ............................................................... 24 ATTACHMENT 4: EXTERNAL HAZARDS SCREENING ................................................. .45 ATTACHMENT 5: PROGRESSIVE SCREENING APPROACH FOR ADDRESSING EXTERNAL HAZARDS .........................................................................................................48 ATTACHMENT 6: DISPOSITION OF KEY ASSUMPTIONS/SOURCES OF UNCERTAINTY .................................................................................................49

Enclosure NG-17-0169 Page 3 of 57 1

SUMMARY

DESCRIPTION The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety. 2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach. This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. Those SSCs necessary to defend against the DBEs are defined as "safety-related," and these SSCs are the subject of many regulatory requirements, herein referred to as "special treatments," designed to ensure that they are of high quality and high reliability, and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations. The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related "and "basic component" are defined in the regulations, while "important to safety," used principally in the general design criteria (GDC) of Appendix A to 10 CFR Part 50, is not explicitly defined.

Enclosure NG-17-0169 Page 4 of 57 2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner. To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety. The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories. The determination of safety significance is performed by an integrated decision-making process, as described by NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline" (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability, and is a function of the SSC categorization results and associated bases. Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements. The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the

Enclosure NG-17-0169 Page 5 of 57 rule allows an alternative risk-informed approach to treatment that provides reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements. Implementation of 10 CFR 50.69 will allow NextEra Energy Duane Arnold, LLC (NextEra) to improve focus on equipment that has safety significance resulting in improved plant safety.

2.3 DESCRIPTION

OF THE PROPOSED CHANGE NextEra proposes the addition of the following condition to the operating license of Duane Arnold Energy Center (DAEC) to document the NRC's approval of the use 10 CFR 50.69. NextEra Energy Duane Arnold, LLC is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) specified in the license amendment dated [DATE]. Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Enclosure NG-17-0169 Page 6 of 57 3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2), which states: A licensee voluntarily choosing to implement this section shall submit an application for license amendment under§ 50.90 that contains the following information: (i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs. (ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs. (iii) Results of the PRA review process conducted to meet§ 50.69(c)(1)(i). (iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy§ 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions, and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions). Each of these submittal requirements is addressed in the proceeding sections. The NRC has previously reviewed the technical acceptability of the DAEC Probabilistic Risk Assessment (PRA) model identified in this application for transition of the Duane Arnold Energy Center fire protection program to a risk-informed, performance-based program based on National Fire Protection Association Standard 805 (NFPA 805), "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition, in accordance with 10 CFR 50.48(c) where the PRA model technical adequacy was reviewed by the NRC on September 10, 2013 (ML13210A449). The NRC also previously reviewed the technical adequacy of the DAEC PRA models in License Amendment Request TSCR-120, "Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (TSTF-425, Rev. 3)," February 23, 2011 (ML110550570). NextEra requests that the NRC utilize the review of the PRA technical adequacy for those applications when performing the review for this application.

Enclosure NG-17-0169 Page 7 of 57 3.1 CATEGORIZATION PROCESS DESCRIPTION {10 CFR 50.69{b){2){i)) 3.1.1 Overall Categorization Process NextEra will implement the risk categorization process in accordance with the NEI 00-04, Revision 0, as endorsed by RG 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," (Reference 2). NEI 00-04 Section 1.5 states "Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety- significant." Separate evaluation is appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors. The following are clarifications to be applied to the NEI 00-04 categorization process:

The Integrated Decision Making Panel (IDP) will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.
The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs including requirements for design basis events; PRA fundamentals; details of the plant specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.
The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to § 50.69(f)(1) will be documented in NextEra procedures. Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. If a resolution cannot be achieved concerning the safety significance of an SSC, then the SSC will be classified as safety-significant.
Passive characterization will be performed using the processes described in Section 3.1.2.
An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen as it is representative of the typical error factor of basic events used in the PRA model.

Enclosure NG-17-0169 Page 8 of 57

NextEra will require that if any SSC is identified as high safety significant (HSS) from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6 of NEI 00-04), the associated system function(s) would be identified as HSS.
Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The IDP must intervene to assign any of these HSS Function components to LSS.
With regard to the criteria that considers whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, NextEra will not take credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator training.

The risk analysis being implemented for each hazard is described:

Internal Event Risks: Internal events including internal flooding PRA model version Revision 7, DAEC07.CAF, June 2017. The NRC has previously reviewed the technical adequacy of previous versions of the DAEC Probabilistic Risk Assessment (PRA) model, Revision 6, identified in this application for the following applications:

           -   Transition to 10 CFR 50.48(c) - NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (ML13210A449)
           -   Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program (TSTF-425, Rev. 3)

(ML120110282)

Fire Risks: Fire PRA model DAEC13A FIRE, January 2014. The NRC has previously reviewed the technical adequacy of this PRA model identified in this application for Transition to 10 CFR 50.48( c) - NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants (ML13210A449) with routine maintenance updates applied).
Seismic Risks: Safe Shutdown Equipment List (SSEL). Duane Arnold Energy Center, "Individual Plant Examination of External Events (IPEEE)", November 1995, accepted by NRC safety evaluation dated March 10, 2000 (Reference 3).
Other External Risks (e.g., tornados, external floods, etc.): Using the IPEEE IES Utilities, Inc. Duane Arnold Energy Center, "Individual Plant Examination of External Events (IPEEE)", November 1995, as accepted by NRC safety evaluation dated March 10, 2000 (Reference 3). Attachment 4, External Hazards Screening, summarizes an update of the disposition of each hazard addressed in the IPEEE.

This screening was updated using criteria from ASME/ANS RA-Sa-2009, Part 6 (Reference 4).

Enclosure NG-17-0169 Page 9 of 57

Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, "Guidance for Industry Actions to Assess Shutdown Management" (Reference 5), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach) will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs

9. Results of periodic reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Risk-Informed Repair/Replacement Activities (RI-RRA) methodology consistent with the Safety Evaluation Report (SER) by the Office of Nuclear Reactor Regulation "Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10-Year In-service Inspection Intervals', dated April 22, 2009 (ML090930246) (Reference 6).

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., defense in depth, safety margins) in determining safety significance. Component supports are assigned the same safety

Enclosure NG-17-0169 Page 10 of 57 significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. The requirements of 10 CFR 50.69 are consistent with AN0-2 RI-RRA License Amendment as the rule does not remove the repair and replacement provisions of the ASME Code required by § 50.55a (g) for ASME Class 1 SSCs, even if they are categorized as RISC-3, since those SSCs constitute principal fission product barriers as part of the reactor coolant system or containment. This is further clarified in the rule's Statement of Considerations. However, since the scope of 10 CFR 50.69 addresses additional requirements, this methodology will be applied to determine the safety significance of ASME Class 1 SSCs, some of which may be evaluated to be RISC-3. The ASME classification of the SSC does not impact the methodology as it is only evaluates the consequence of a rupture of the SSC's pressure boundary. As stated in the ANO SER, "categorizing solely based on consequence which measures the safety significance of the pipe given that it ruptures is conservative compared to including the rupture frequency in the categorization and the categorization will not be affected by changes in frequency arising from changes to the treatment." Therefore, this methodology is appropriate to apply to ASME Class 1 SSCs, as the consequence evaluation and deterministic considerations are independent of the ASME classification when determining the SSCs safety significance and will maintain this acceptable level of conservatism. The use of this method was previously approved to be used for a 10 CFR 50.69 application by NRC in the final Safety Evaluation for Vogtle dated December 17, 2014 (Reference 7). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization, as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Therefore, the RI-RRA methodology for passive categorization is acceptable and appropriate for use at DAEC for 10 CFR 50.69. 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii)) The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. All the PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models credited in this request are the same PRA models credited in the applications for NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants, and for the Technical Specification Change

Enclosure NG-17-0169 Page 11 of 57 Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, with routine maintenance updates applied. 3.2.1 Internal Events and Internal Flooding The DAEC categorization process for the internal events and flooding hazard will use the plant-specific PRA model. The NextEra risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for DAEC. Attachment 2 at the end of this enclosure identifies the applicable internal events and internal flooding PRA models. 3.2.2 Fire Hazards The DAEC categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes methods previously accepted by the NRC. The NextEra risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for DAEC. Attachment 2 at the end of this enclosure identifies the applicable Fire PRA model. 3.2.3 Seismic Hazards The DAEC categorization process will use the seismic margins analysis (SMA) performed for the Individual Plant Evaluation-External Events (IPEEE) in response to GL 88-20 (Reference 8) for evaluation of safety significance related to seismic hazards. No plant specific approaches were utilized in development of the SMA. The NEI 00-04 approved use of the SMA SSEL as a screening process identifies all system functions and associated SSCs that are involved in the seismic margin success path as HSS. Since the analysis is being used as a screening tool, importance measures are not used to determine safety significance. The NEI 00-04 approach using the SSEL would identify credited equipment as HSS regardless of their capacity, frequency of challenge or level of functional diversity. An evaluation will be performed of the as-built, as-operated plant against the SMA SSEL. The evaluation will compare the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences will be reviewed to identify any potential impacts to the equipment credited on the SSEL. Appropriate changes to the credited equipment will be identified and documented. This documentation will be available for audit once complete. The NextEra risk management program will ensure that future changes to the plant will be evaluated to determine their impact on the SMA and risk categorization process.

Enclosure NG-17-0169 Page 12 of 57 3.2.4 Other External Hazards The DAEC categorization process will use screening results from the Individual Plant Evaluation of External Events (IPEEE) in response to GL 88-20 (Reference 8), as updated, for evaluation of safety significance. Other external hazards were screened from applicability to DAEC per a plant-specific evaluation in accordance with GL 88-20 and updated to use the criteria in ASME PRA Standard RA-Sa-2009, Part 6. Attachment 4 provides a summary of these "Other External Hazards" screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards. 3.2.S Low Power & Shutdown The DAEC categorization process will use the shutdown safety management plan described in NUMARC 91-06 for evaluation of safety significance related to low power and shutdown conditions. 3.2.6 PRA Maintenance and Updates The NextEra risk management process ensures that the applicable PRA model(s) used in this application continues to reflect the as-built and as-operated plant for DAEC. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated. In addition, NextEra will implement a process that addresses the requirements in NEI 00-04, Section 11, "Program Documentation and Change Control." The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization. 3.2.7 PRA Uncertainty Evaluations Uncertainty evaluations associated with baseline PRA model(s) used in this application were evaluated during the assessment of PRA technical acceptability and confirmed through the self-assessment and peer review processes as discussed in Section 3.3 of

Enclosure NG-17-0169 Page 13 of 57 this enclosure. Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed in NEI 00-04 Section 8 and in the prescribed sensitivity studies discussed in Section 5. NextEra will utilize a factor of 3 to increase the unavailability or unreliability of LSS components consistent with that approved for Vogtle in Reference 7. Consistent with the NEI 00-04 guidance, NextEra will perform both an initial sensitivity study and a cumulative sensitivity study. The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in PRAs for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study. Sources of model uncertainty and related assumptions have been identified for the DAEC PRA base models using the guidance of NUREG-1855 (Reference 9) and EPRI TR-1016737 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 10). The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was primarily developed to evaluate the key sources of uncertainties associated with the internal events PRA model. In addition, the evaluation of uncertainties associated with Fire, Seismic, LPSD, and Level 2 is provided in EPRI TR1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (Reference 14). The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the DAEC PRA model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on the base model that will be used for the 50.69 application. Only those assumptions or sources of uncertainty that could significantly impact the risk ranking calculations were considered key for this application. DAEC PRA model assumptions and sources of uncertainty for this application are evaluated and documented in Attachment 6. The conclusion of the review for this application is that no additional sensitivity analyses are required to address DAEC PRA model specific assumptions or sources of uncertainty.

Enclosure NG-17-0169 Page 14 of 57 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii)) The PRA models described in Section 3.2 have been assessed against RG 1.200, "An Approach for Determining the Technical Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2 (Reference 11) consistent with NRC RIS 2007-06. The internal events PRA model was subject to a self-assessment and a peer review conducted in December 2007 and a focused peer review in March 2011. The fire PRA model was subject to a self-assessment and a peer review conducted in November 2010. Closed findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) (Reference 12) as accepted by NRC in the staff memorandum dated May 3, 2017 (ML17079A427) (Reference 13). The results of this review have been documented and are available for NRC audit. provides a summary of the remaining findings and open items, including:

Open findings and disposition from the DAEC peer reviews.
Identification of and basis for any sensitivity analysis needed to address open findings.

This information demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(l)(i).

Enclosure NG-17-0169 Page 15 of 57 3.4 RISK EVALUATIONS {10 CFR 50.69{b){2){iv)) The DAEC 10 CFR 50.69 categorization process will implement the guidance in NEI 00-

04. The overall risk evaluation process described in the NEI guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of §50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF).

The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, human errors, etc.). Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data, and provide timely insights into the need to account for any important new degradation mechanisms.

Enclosure NG-17-0169 Page 16 of 57 4 REGULATORY EVALUATION 4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

The regulations at Title 10 of the Code of Federal Regulations (10 CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."
NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006.

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Revision 2, April 2015.

Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, US Nuclear Regulatory Commission, March 2009.

The proposed change is consistent with the applicable regulations and regulatory guidance. 4.2 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS NextEra proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

Enclosure NG-17-0169 Page 17 of 57 NextEra has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No. The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No. The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not change the functional requirements, configuration, or method of operation of any SSC. Under the proposed change, no additional plant equipment will be installed. Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Enclosure NG-17-0169 Page 18 of 57

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No. The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations. The proposed change does not affect any Safety Limits or operating parameters used to establish the safety margin. The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to perform any beyond design basis functions consistent with the categorization process and results. Therefore, the proposed change does not involve a significant reduction in a margin of safety. Based on the above, NextEra concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance 'of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Enclosure NG-17-0169 Page 19 of 57 5 ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

Enclosure NG-17-0169 Page 20 of 57 6 REFERENCES

1. NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005.

2. NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006.

3. NRC letter "Review of Individual Plant Examination of External Events (IPEEE)

Submittal, Duane Arnold Energy Center," (TAC No. M83618), March 10, 2000.

4. ASME/ANS RA-Sa-2009, Standard for Level I/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009.

5. NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991.

6. ANO SER Arkansas Nuclear One, Unit 2 - Approval of Request for Alternative AN02-R&R-004, Revision 1, Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems (TAC NO. MD5250) (ML090930246), April 22, 2009.

7. Vogtle Electric Generating Plant, Units 1 and 2 -Issuance of Amendments Re:

Use of 10 CFR 50.69 (TAC NOS. ME9472 AND ME9473), December 17, 2014 (ML14237A034)

8. Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4," USNRC, June 1991.

9. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

10. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

11. Regulatory Guide 1.200, "An Approach for Determining the Technical Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, US Nuclear Regulatory Commission, March 2009.

12. NEI Letter to USNRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," February 21, 2017 (ML17086A431).

13. USNRC Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," May 3, 2017, (ML17079A427).

Enclosure NG-17-0169 Page 21 of 57

14. EPRI TR1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty.

Enclosure NG-17-0169 Page 22 of 57 Attachment 1: List of Categorization Prerequisites

1. NextEra will establish procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision Making Panel (IDP) member qualification requirements
Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary HSS or LSS based on the seven questions in Section 9 of NEI 00-04 (see Section 3.2). Any component supporting an HSS function is categorized as preliminary HSS. Components supporting, an LSS function are categorized as preliminary LSS.
Component safety significance assessment. Safety significance of active components is assessed through a combination of PRA and non-PRA methods, covering all hazards. Safety significance of passive components is assessed using a methodology for passive components.
Assessment of defense in depth (DID) and safety margin. Components that are categorized* as preliminary LSS are evaluated for their role in providing defense-in-depth and safety margin and, if appropriate, upgraded to HSS.
Review by the Integrated Decision-making Panel. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.
Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to core damage frequency (CDF) and large early release frequency (LERF) and meets the acceptance guidelines of RG 1.174.
Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those SSCs that have been categorized.
Documentation requirements per Section 3.1.1

2. NextEra will perform an evaluation of the as-built, as-operated plant against the SMA SSEL The evaluation will compare the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences will be reviewed to identify any potential impacts to the equipment credited on the SSEL

3. Prior to implementation, the noted findings in Attachment 3 will either be closed or a sensitivity study case will be performed to determine the impact on the CDF and LERF results for those categorizations that could be adversely affected by the finding.

Enclosure NG-17-0169 Page 23 of 57 Attachment 2: Description of PRA Models Used in Categorization Hazard Baseline Baseline Comments CDF LERF INTERNAL These models will be used for categorization. EVENTS and 2.98E-06 6.70E-07 The NRC has reviewed the technical adequacy of INTERNAL these models for transition of the DAEC fire FLOODING protection program to a risk-informed, performance-based program based on NFPA 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition, in accordance FIRE l.20E-05 7.49E-06 with 10 CFR 50.48(c) in License Amendment Request TSCR-128 where the PRA model technical adequacy was reviewed by the NRC on September 10, 2013 (ML13210A449).

Not used for categorization.

DAEC is classified as a 'Reduced Scope' plant per SEISMIC n/a n/a Table 3.1 of NUREG-1407 and performed a Seismic Margins Assessment.

Model not used for categorization.
For the IPEEE a high winds PRA was developed HIGH WINDS l.41E-7 <lE-07 to show CDF is less than lE-06/yr. The high winds PRA was not peer reviewed.

OTHER

Not used for categorization.

EXTERNAL <lE-06 <lE-07

All other external hazards screened.

HAZARDS TOTAL l.61E-05 8.36E-06 Notes:

1. Total CDF meets the RG 1.174 acceptance guideline of <lE-4 per year.

2. Total LERF meets the RG 1.174 acceptance guideline of <lE-5 per year.

Enclosure NG-17-0169 Page 24 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             {CC)

The internal events model was supplemented by the MSO I expert panel process. No clear This F&O states that two fire gates are documentation as to incorporation of those components into the model. This includes a list of action items, with no documented follow-up in the FPRA. In addition, the MSO lists some MSOs as not documented in the Fire Model report for MSO 2h, but the gates could not be found in the Fire PRA modeled in the PRA based on the 2008 report, but this status was not accurate - based on questions to model. The MSO causes diversion of RHR flow the PRA staff. For example, MSO scenarios 4B, 4C, 4D, containment overpressure NPSH impacts, into the primary containment. Given the indicated review for possible PRA inclusion. However, it is not evident in the current FPRA model. (This relatively high significance of the RHR system, F&O originated from SR ES-A4) inclusion of this additional failure mode for RHR, Not 1-1 ES-A4 if needed, is unlikely to affect categorization of Met Recommended Action: Table G-1 was added in the Fire Model Development Report, 493080001.02, to components in the risk-informed 50.69 disposition each MSO and incorporated in the Fire PRA as applicable. application. Acceptability Evaluation: Table G-1 is in the Fire Model Development Report mentioned. All of the Prior to implementation, either this finding will be dispositions are reflected in the model except for MSO 2h, gates "FIRE-02" & "FIRE-12" are not present. closed or a sensitivity study case will be MSO 2h & 2k are the same. The gates are in the .RR file, but not in the logic model. Table E-1 says that performed to determine the impact on the CDF the fault tree logic is included but the MSO review document suggests that this is not needed. This and LERF results for those categorizations that F&O remains open pending resolution of the documentation to reflect the actual model developed. could be adversely affected by this finding DAEC FPRA model followed the FPIE model. However, the modeling of CCF for expanded model is not fully developed and documented. Examples include the MSIV failure to close basic events added in the FPRA model. Other added components should also be considered for CCF. {This F&O originated from SR SY-Bl). Recommended Action: Fire Model Development Report, 493080001.02, was updated consistent with Methodology complies with requirements for SR-SY-Bl to show that CCF for fire-induced failures do not impact the results and therefore are not Not resolution of Finding. 2-8 PRM-B9 modeled. The discussion in the report in Table E-1 was updated to provide clarity to the process in Met which failure modes were not included in the system model consistent with SR-SY-Al5. Minor update of the Fire Model Development Acceptability Evaluation: The Fire Model Development Report, 493080001.02 and the FPRA were Report is needed to close this F&O. reviewed. The events added for fire were not added for internal event tree initiators. The events were only affected by fire. Therefore, there is no need to add CCF since fire events only affect one train of equipment due to separation. The report needs to add a statement noting that if events are added just for fire initiators, then CCF will not be addressed. This F&O is considered to still be open until this documentation update is made. DAEC report 0493080001.003, DAEC Fire PRA Fire Scenario Report, Section 6 and Appendix E document the FPRA HRA development and results. No new operator recovery actions have been identified in the Recovery actions to restore offsite power and Not 2-13 FQ-A3 FPRA model. However, a review of top CDF/LERF cutsets show that some potential recovery actions other internal event functions are either not Met should have been considered for significant accident sequences. Note the following examples are credited or are given limited credit only in the included for demonstration purpose only and other cases can be identified when a systematic review is Fire PRA. This treatment is conservative with performed for potential operator recovery actions. For example, operator actions to restore offsite respect to the risk-informed 50.69 application.

Enclosure NG-17-0169 Page 25 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC) power to the unaffected essential switchgear after the fire should be considered, especially in long-term LERF sequences. In another example, additional external injection sources should be considered,         Prior to implementation, either this finding will be which are independent of the modeled LP injection sources that have been failed in SBO-type                  closed or a sensitivity study case will be sequences in the LERF sequences. The additional external injection sources currently are modeled             performed to determine the impact on the CDF under gate RX-LP-EXTHW- Fin the LERF XINIT fault tree with a failure rate of 1.0. Two events,                and LERF results for those categorizations that DFPROTDN--- INJECTF-- & DWELLWDN---INJECTF--are modeled for firewater and well water injections.             could be adversely affected by this finding It is expected that the operator actions will be the dominant contributors to the failures of these two events. (This F&O originated from SR HRA-Dl)

Recommended Action: Section 5 of the Fire PRA Quantification Report, 493080001.04, was updated to discuss the results of the review of recovery actions. Recovery of fire-induced loss of offsite power due to damage to the protective relays is not considered feasible. The other specific examples provided in the finding are related to items that have been reviewed for the FPIE model and are not considered feasible. Acceptability Evaluation: Section 5 of the Fire PRA Quantification Report was reviewed. This section describes the CDF and LERF results by fire sequence/scenario and includes whether the scenario considers equipment recovery. A summary of the recovery review is not provided. Based on review of the sequence/scenarios, no credit for any fire-related recoveries (example - recovery of offsite power following fire damage) is taken. In the response to the F&O, it is stated that recovery actions to restore offsite power and other internal events functions were judged not feasible. Although this is stated, a systematic review and assessment of potential recovery actions was not provided. Therefore, the fire model could potentially provide somewhat conservative CDF/LERF results verses a more realistic evaluation of significant accident sequences. While the change in CDF and LERF will likely not be significant with assumed limited credit for recovery actions, a systematic review and assessment should be documented to identify and disposition potential recovery actions. This F&O is considered to remain open pending addition of this documentation. The "state-of- knowledge" correlation between fire-specific event probabilities (e.g., suppression system unavailability, fire ignition frequencies, hot short conditional probabilities, etc.) hasn't yet been applied. As a result, QU-A3 CC-II requirement is considered not met. (This F&O originated from SR QU- Methodology complies with requirements for A3) resolution of Finding. Not 2-17 FQ-A4 Met Recommended Action: The parametric uncertainty analysis was re-performed applying the state of Closure of this F&O only requires the Fire knowledge correlation between basic event probabilities as applicable and documented in the Fire PRA Quantification notebook to be updated with a Quantification Report, 493080001.04. more complete discussion of parametric uncertainty. Acceptability Evaluation: Section 9.0 of the Fire Risk Quantification report was reviewed. The uncertainty analysis uses UNCERT 3.0 and includes a Monte Carlo Sampling Method. The fire PRA

Enclosure NG-17-0169 Page 26 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC) uncertainty results show that there is very reasonable agreement between the point estimate CDF/LERF calculated by CAFTA and the CDF/LERF true mean of the propagated uncertainty distribution.

The report states that the fire PRA uncertainty analysis was performed consistent with the FPIE model. Review of the internal events uncertainty analysis indicates that the SOKC among basic events is accounted for via the consistent assignment of the type-codes. Thus, it appears that the SOKC has been adequately considered in the fire model uncertainty evaluation for typical component basis events modeled in the internal events and fire models. What is not explained, however is how the SOKC is applied to suppression system unavailability, fire ignition frequencies, hot short conditional probabilities, and whether the SOKC applies to these aspects of the fire model. Additional discussion/detail should be provided as to how the SOKC is specifically applied to the fire model uncertainty evaluation. This F&O remains open pending discussion of the fire SOKC items. The Cable Spreading Room (CSR - PAU 11A) fire scenario is a bounding scenario (11A-A01}, which accounts for all the fire ignition sources. The final quantification result for this scenario has a CDF of 7.52E-08 /yr. A discussion with DAEC staff/contractor showed that the fire ignition frequency for this scenario in the final XINIT model is 7.52E-8/yr, which includes factors to account for procedure non-compliance, which is covered in F&O 5-29. This frequency also includes a CCDP of 0.01 for the administrative controls imposed on the CSR, such as locked during operation, Cardox system, a posted guard, and the use of alternate shutdown panels outside of main control room for a loss of Div 2 components. The above stated basis is considered as double counting since the CSR has been considered with low transient influencing factors as documented in Table B-1 of the Plant Partitioning Model changes comply with requirements for and Fire Ignition Frequency Development report. (This F&O originated from SR FQ-A4) resolution of Finding. Not 2-20 FQ-A4 Recommended Action: The CSR qualitative discussion is revised to clearly identify basis for applied Closure of this F&O only requires update of the Met conditional probabilities and CCDP. While transient influence factors are applied in the frequency Fire PRA Overview and Documentation Roadmap calculation, these factors do not consider administrative controls as specified by SR IGN-A9. A revised notebook to eliminate its reference to the subject CCDP is applied based on Div. 1 components being available for shutdown from the main control room procedural non-compliance factor. (i.e., CSR contains Div. 2 component cables). See Fire Scenario Report, 493080001.03, Attachment A.l, Fire Scenario Summary for llA-AOl. Acceptability Evaluation: The Cable Spreading Room Fire Scenario and Quantification Report and the Scenario report have been updated to remove fire scenario llA-AOl and replace it with seven more detailed fire scenarios which do not apply a procedural non-compliance factor, or an assumed CCDP of 0.01 for administrative controls. However, the Fire PRA Overview and Documentation Roadmap still describes the use of the 0.01 hot work non-suppression probability in scenario llA-AOl and needs to be updated. This F&O is considered to be open. Not 3-7 FSS-G2 Section 5.3 and Appendix C of the Fire Scenario Report fully define the probability of failure for each Met fire barrier element contained in a fire barrier screening criteria used to perform the multi- Review of barrier failure probabilities in the

Enclosure NG-17-0169 Page 27 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) category Description Disposition for 50.69

  #             (CC) compartment analysis. Most of the screening criteria align with the guidance provided in NU REG/CR         multi-compartment analysis {MCA} is needed for 6850, however differences were identified. Additional justification of the differences from the criteria   closure ofthis F&O. However, since MCA identified in NUREG/CR 6850 should be provided. {This F&O originated from SR FSS-G2}                       scenarios contribute less than 1 percent of total CDF, this F&O is unlikely to affect categorization Recommended Action: The guidance in NUREG/CR-6850 and used in the Fire PRA postulates only one             of components in the risk-informed 50.69.

barrier failure. Appendix C of the Fire Scenario Report, 493080001.03, was updated to explicitly define the criteria used. Prior to implementation, either this finding will be closed or a sensitivity study case will be Acceptability Evaluation: Appendix C of the Fire Scenario Report was updated to define the criteria performed to determine the impact on the CDF used, but instead of only postulating a single barrier failure element or a combination based on the and LERF results for those categorizations that types of barrier elements present in the barrier (i.e. damper probability+ door probability}, table C.2-1 could be adversely affected by this finding of the HGL Analysis and MCA report counts the number of each barrier element types in each interface and multiplies the generic element frequency by that count and sums the results for the present elements. One thing to note however, only a maximum of 1 penetration is ever listed in any barrier. There should be some barriers that have multiple penetrations and begs the question as to how the failure probability was applied (e.g., failure applied as a component type). This would conflict with the application of doors and dampers, which were counted and the failure probability for each was summed. This F&O is determined to remain open. Additional review is needed for final disposition Logic under gate HPCl-MSL-FLD appears to be incorrect. As developed, both a HPCI valve failure and of this F&O. However, the current logic is judged Level 8 Failure are required. However, even if level 8 occurs, the valve failure can result in overfeed to be conservative with respect to the risk-continuing. (This F&O originated from SR PRM-89} informed 50.69 application since failure of the Not 4-7 PRM-89 Level 8 trip signal is assumed to fail HPCI and RCIC Met Recommended Action: Logic corrected and requirement for Level 8 failure removed. with certainty. Acceptability Evaluation: The FPRA model was reviewed to verify logic under gate HPCl-MSL-FLD. The Prior to implementation, either this finding will be logic was not corrected to remove Level 8 logic. This F&O is considered to still be open. closed or a sensitivity study case will be performed to determine the impact on the CDF and LERF results for those categorizations that could be adversely affected by this finding Section 6.5 of the Fire Model Development Report discusses change to the LERF model. Based on this, PRM- Not no changes were performed other than those changes affecting the level 1 model. However, in Minor corrections to fire PRA inputs are needed 4-12 814 Met discussions on the details of what was reviewed, it appears as if the Level II model was not reviewed for for closure of this F&O. However, based on a potential changes as a result of fire impacts. A review of the DAEC Level JI PSA Analysis was performed review of model results, impact of the identified forth is review. Modeling features such as AC Power Recovery, Containment Isolation, Operator issues is judged minimal with respect to the risk-

Enclosure NG-17-0169 Page 28 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding Description SR(s) Category Disposition for 50.69

  #            (CC)

Depressurizes Reactor Vessel, Core Melt Progression, Combustible as Venting, and other features are informed 50.69 application. potentially impacted by Fire. Fire Impacts of these should be reviewed to determine any potential changes, including those involving spurious operation. Reviews at similar plants indicated fire-induced Prior to implementation, either this finding will be impacts of DW and WW Integrity, including containment flooding, WW venting, and fire-induced closed or a sensitivity study case will be failures of support systems and cooling. (This F&O originated from SR PRM-B14) performed to determine the impact on the CDF and LERF results for those categorizations that Recommended Action: Section 6.5 of the Fire Model Development Report, 493080001.02, was updated could be adversely affected by this finding. to include a detailed LERF model review. No changes were identified given the events in the Level 2 model are generally conditional events, phenomenon events, and long term human actions. None of these events would be considered impacted by a fire as discussed in the review Acceptability Evaluation: Section 6.5 of the report provides a detailed review of the Level II model. Based on the detailed assessment of the LERF accident sequence event tree models, no new "model" changes were required to the Level 2 model as a result of fire. The evaluation was performed, but the results were not fully implemented. Upon review, HFE "DSYSTM-NOP-RECVRRX- Operator Fails to Recover Injection Before RPV Melt" should have been set to 1.0, but is still listed as 9E-1 in the fault tree and does not appear in the recovery rule file. Similar for event "DRHR---NPHRHRRCCE-RHR Not Recovered". Also, even though most of the recovery of AC Power is not credited in the FPRA, the following two events are not set to 1.0 in the recovery rule file like the others: DSWYRDENOPSl26P-CE-- AC Non-Recovery, 26 hours Conditional, SI Timeframe, Plant Centered DSWYRDENOPSl26PCE--AC Non-Recovery, 26 hours Conditional, SI Timeframe, Plant Centered Also, the following 2 events below should have been set to false similar to the other AC Power Recovery events, but were not: DSWYRDENOPPACDAYRX-PROBAILITY OF RECOVERY OF OFFSITE OR LOCAL POWER IN MISSION TIME (PLANT CENTERED) DSWYRDENOPPACDAYRX-AC Power Recovered, 2.5 Hours Conditional, SI Timeframe, Plant Centered This F&O remains open pending correction of the above-noted items. Since no impacts were identified as requiring any changes to the Level II model, this SR cannot be fully reviewed. The finding on PRM-B14 will likely result in impacts being identified and changes to the LERF Closure of this F&O is contingent on correction of model. These impacts as well as the existing changes made to the CDF model would need to be items identified in F&O 4-12. As stated in the PRM- Not reviewed against LE-A/B/C/D. An initial review indicated a number of potential issues with the present 50.69 disposition for F&O 4-12, impact of the 4-15 B15 Met Fire PRA model, due to failure to consider the impacts of fire on the level II model. However, since the identified issues is judged minimal with respect likely model changes from the SR-Bl4 Finding will require re-review of the referenced SRs, this SR to the risk-informed 50.69 application. (PRM-B15) is not reviewed for this peer review. In reviewing the LE referenced SRs, a number of areas in the Level II model that will likely be impact by Fire were identified. These include things like -- Prior to implementation, either this finding will be Adverse Reactor Building Conditions Cause Failure, Instruments needed to "properly diagnose the need closed or a sensitivity study case will be

Enclosure NG-17-0169 Page 29 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s} Category Description Disposition for 50.69

  #             {CC) to implement emergency RPV depressurization," ADS-INITIATE (some impacts included in the level I},       performed to determine the impact on the COF DADS--- NPHSRVSTKCE--, CET NODE OP FAULT TREE QUANTIFICATION, and others. Based on similar               and LERF results for those categorizations that reviews at other plants, a significant number of changes are expected when the independent level II      could be adversely affected by this finding.

modeling issues, listed in Appendix C of the Level II report, are reviewed for fire impacts. (This F&O originated from SR PRM-B15} Recommended Action: Section 6.5 of the Fire Model Development Report, 493080001.02, was updated to include a detailed LERF model review. No changes were identified given the events in the Level 2 model are generally conditional events, phenomenon events, and long term human actions. None of these events would be considered impacted by a fire as discussed in the review. Given that no additional changes were identified in the process of upgrading the documentation this finding is considered closed by the resolution of 4-12. Acceptability Evaluation: Section 6.5 of the Fire Model Development report was reviewed. See the issues identified in F&O 4-12. This report section provides a detailed assessment of the fire impacts on the Level 2 I LERF model. The internal events PRA Level 2 I LERF model is used for the fire PRA. Based on the detailed assessment of the LERF accident sequence event tree models, no new "model" changes were required to the Level 2 model as a result of fire. Level 2 model phenomena events and longer term actions are generally not impacted by the fire events and this is adequately described in Section 6.5. However, this F&O is considered to remain open until the F&O 4-12 items are corrected. The Fire PRA model does not appear to model Fire-Induced Opening of all SRVs, as required by the MSO list scenario 3A. The scenario can be more limiting than 2 SRVs or ADS, due to the thermal transient that results. This could result in a change to the success criteria, accident sequences, etc. that are presently modeled in the FPRA. (This F&O originated from SR PRM-B5} Model changes comply with requirements for resolution of Finding. Recommended Action: The Fire PRA models multiple SRVs opening consistent with the FPIE PRA model Not 4-16 PRM-B5 and the defined success criteria based on the supporting thermal hydraulic analysis. Table G-1 of the Met Only a minor update of the Fire Model Fire Model Development Report, 493080001.02, was updated as such. Development Report is needed to close this F&O. Acceptability Evaluation: The fire PRA model was updated to include the spurious opening of all SRVs as a large steam LOCA. The impacts of this event would be bounded by the large LOCA event and appears to be appropriate. Appendix G of the Fire Model Development Report notes that consideration of the all SDVs open condition (MSO scenario 3A} has been addressed. However, the discussion of the changes made to the internal events model in Appendix E (see figure E-19} does not reflect the current fault tree logic. This F&O will remain open pending update of the Appendix E figure. Not The FPRA model changes do not include the model for those systems that are required for initiation 4-17 PRM-B9 Met and actuation. For example, the MSIV fail to close logic does not include the associated Additional review is needed for final disposition instrumentation, controls, or operator actions. (This F&O originated from SR SY-BlO} of this F&O. However, for most of the MSOs

Enclosure NG-17-0169 Page 30 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC) listed in Table E-1 of the Fire Model Development Recommended Action: The fire induced MSIV failure to close logic is updated to include operator           Report, additional system modeling is stated to action and fire induced failure of a single automatic actuation signal. This modeling is conservative     be unnecessary based on the random impact of given that there are several automatic actuation conditions. The operator action to close MSIVs is        the MSO itself being negligible. As such, the considered a minimum conservatism in the PRA. The F-V is ~lE-4 for the LERF model and even lower          potential for this issue to affect categorization of for the CDF model. The Table E-1 in the Fire PRA Model Development Report, 493080001.02, was              components under the risk-informed 50.69 updated to discuss the new logic.                                                                         application is low.

Acceptability Evaluation: Review of table E-1 of the Fire Model Development Report shows that the Prior to implementation, either this finding will be operator action to close MSIVs has been added in the logic. However, no fire-induced failure of a closed or a sensitivity study case will be "single automatic actuation signal" was included as described in the "Description of Resolution". Also, performed to determine the impact on the CDF Table E-1 states, "The many additional automatic trip functions are not included." In addition, the and LERF results for those categorizations that operator action was modeled but the instruments and controls required for actuation of the MSIV was could be adversely affected by this finding. not modeled. Not including the automatic actuation or if the operator action had not been added would result in a conservatism since no credit would be taken for the recoveries. However, the finding seems to represent much more than just the one MSIV example given while the resolution is only focused on the MSIVs. This F&O is considered to still be open. The MCR Analysis includes numerous scenarios for fire burnout of an entire board, as well as pinch point analysis for a loss of function. This includes the top MCB scenario, %FR-12A_F07. For these scenarios, use of the ASC is credited at 0.1. However, the analysis does not include consideration of It is not anticipated this activity will require whether ASC will function. As a point of clarification, for loss of function scenarios, the fire damage significant changes to model inputs and as such, could result in spurious operation (including MSOs) that could fail the ASC function. This might include the potential for this issue to affect starting an EDG without cooling water, running cooling water pumps with the discharge closed, categorization of components under the risk-overfilling the vessel (assuming the ASC using a TD pump for operation) and other similar scenarios. informed 50.69 application is low. Without consideration for these types of events, the analysis can be non-conservative. Additionally, Not the analysis, as performed, does not look at the MSO issue for the control room. As such, the FPRA Update of the Fire Scenario Report and the Fire 4-21 FSS-A6 Met does not address the risk significance of possible MSOs in the control room Another point of PRA Quantification Report is needed to clarification is that although it is recommended to take MSOs into account for any loss of function accurately describe final modeling and results of scenario analyzed in the MCR analysis, it is not recommended that in lieu of the analysis, the MCR the MCR analysis. abandonment CCDP be set to 1.0 in order to be conservative. Although the use of 0.1 could be non-conservative (MSO = 0.3

0.3, HEP= 0.1, CCDP = 0.2), the use of 0.1 is more accurate than using a Prior to implementation, either this finding will be CCDP of 1.0. Rather, some attempt to consider the MSO scenarios in the CCDP is recommended. (This closed or a sensitivity study case will be F&O originated from SR FSS-A6) performed to determine the impact on the CDF and LERF results for those categorizations that Recommended Action: The MCR analysis is updated. The CCDP for non-abandonment is based on could be adversely affected by this finding.

functional failures as well as multiple spurious operations (MSO). Alternate Shutdown Capability (ASC)

Enclosure NG-17-0169 Page 31 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             {CC)

CCDP is assigned based on ASC functional failures, as well as MSO probability. Section 5.2 of the Fire Scenario Report, 493080001.03, was updated to document the CCOP for each scenario. Acceptability Evaluation: In section 5 of the Scenario report, no documentation was found for the CCOP of Non-Abandonment MCR fire scenarios. The CCOP development for the abandonment scenarios is documented on page 5-34. The control room abandonment scenarios listed in table 5.2-5 of the Fire PRA Scenario Report are not reflected in the FPRA FRANX model. Only a single "12A_F61- MCR Abandonment" scenario is provided in the FRANX model. Currently the only MCR scenario which has any MSO consideration is 12A_F43 as shown below: Scenario BE Event 12A_F43 FLLSRVNFSVV4400-RC-- FLLSRVNFSVV4400-RC--_0.06 12A_F43 FLLSRVNFSVV4401-RC-- FLLSRVNFSVV4401-RC--_0.06 12A_F43 FLLSRVNFSVV4402-RC-- FLLSRVNFSVV4402-RC--_0.06 12A_F43 FLLSRVNFSVV4405-RC-- FLLSRVNFSVV4405-RC--_0.06 12A_F43 FLLSRVNFSVV4406-RC-- FLLSRVNFSVV4406-RC--_0.06 12A_F43 FLLSRVNFSVV4407-RC-- FLLSRVNFSVV4407-RC--_0.06 Five areas were excluded: 02H, 02L, 02M, 070 and 09B page 19 of P0493080001-3475. Need to annotate the reason for the exclusion - can't be programmatic (administrative}, it must be physical. Area 09B has access doors and is administratively controlled based on high radiation area so should not be excluded. (This F&O originated from SR IGN-A9} Closure of this F&O requires reconciliation of Recommended Action: The fire ignition frequency for PAUs 02H, 02L, 02M, 070, and 09B were updated minor discrepancies between documented fire to include potential for transient combustible fires. The Plant Partitioning and FIF Report, ignition frequency values and values actually used 493080001.01, was updated as applicable. (see also F&O 5-9} in the Fire PRA. The combined contribution to COF of the cited physical analysis units (PAUs} is Not less than 1 percent. As such, the potential for 1-4 IGN-A9 Acceptability Evaluation: PAU 02H: The Plant Partitioning and FIF report shows a FIF of 9.29E-05 which Met includes transient contribution. However, the scenario development notebook & FRANX shows a affecting categorization of components under the frequency of 1.16E-7 and has this note, "A 0.01 conditional probability is applied for transients in the risk-informed 50.69 application is very low. fire zone". Prior to implementation, either this finding will be PAU 02L: FIF report shows 8.62E-6, but the Scenario report and FRANX show 1.16E-5 with the following closed or a sensitivity study case will be note, "The pipe chase is inaccessible during operation; therefore hot work fires are not postulated. A performed to determine the impact on the CDF 0.1 factor is applied given that it is a pipe chase that is inaccessible and that only one set of cable trays and LERF results for those categorizations that go through the area" could be adversely affected by this finding. PAU 02M: FIF report shows 8.62E-6, scenario report & FRANX shows l.16E-5 with the note, "Chase is

Enclosure NG-17-0169 Page 32 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s} Category Description Disposition for 50.69

  #             (CC) inaccessible during operation. Hot work fires not considered."

Similar discrepancies exist for PAU 07D and PAU 098. Due to these discrepancies, this F&O cannot be closed. Fire Suppression was applied for a limited number of scenarios in the Fire PRA. See results table A-1, where scenarios include a non-1.0 factor in the non-suppression column. In cases where suppression is credited, the factors listed in CC II do not appear to be evaluated. The following is not addressed for non-suppression: a) the credited system is installed and maintained in accordance with applicable A minor update of the Fire Scenario Report to Not codes and standards, and b) the credited system is in a fully operable state during plant operation, and describe DAEC's NFPA 805 monitoring program is 4-35 FSS-D7 Met c) the system has not experienced outlier behavior relative to system unavailability. (This F&O needed to close this item. originated from SR FSS-D7) Acceptability Evaluation: A review of the DAEC fire detection and suppression systems has not been performed as per the SR. There is no evidence of development of a suppression system monitoring system nor implementation of monitoring reliability attributes. As such, this finding remains open. A set of.sensitivity runs were performed using FRANC and XINIT setting spurious operations (originally set to 1) to a typical value (0.6 or 0.3). As a result, a number of MSOs were identified that were significant, based on the standard definition of significant. As a result, the requirement to analyze This F&O states that important multiple spurious significant circuit failures using plant specific circuit analysis based on the specific circuit configuration operation (MSO) events should be identified and under consideration was considered not performed. (This F&O originated from SR CF-Al) have realistic circuit failure probability values applied. The current model is therefore Recommended Action: Section 4.0 of the Fire Scenario Report, 493080001.03, provides the list of basic conservative with respect to categorization of events for which the appropriate circuit failure mode conditional probability was applied. Section 8.3 components under the risk-informed 50.69 of the Quantification Report, 493080001.04, documents the sensitivity study performed to ensure the application. Not significant spurious operations circuit failure mode were considered. Based on the sensitivity, two 4-40 CF-Al Met additional spurious operations had a F-V slightly greater than 0.005. Therefore, the intent of the Fire zones lE and 3D contribute less than 1% of requirement for CC II has been achieved and significant spurious operations were analyzed based on the total CDF for fire. As such, the potential for the circuit configuration. affecting categorization of components under the risk-informed 50.69 application is very low. Acceptability Evaluation: Section 8.3 of the Quantification Report does mention the results of a sensitivity study done to identify potential conservatisms with AOVs and MOVs only. Two components Prior to implementation, either this finding will be currently set to "TRUE" in the model have a F-V>0.005, but neither have had a hot short probability closed or a sensitivity study case will be applied to the scenarios in the fire zones listed in the quantification report. The F&O then looks at performed to determine the impact on the CDF possible removal of conservatism. There is a disconnect between the F&O and how it was resolved. and LERF results for those categorizations that The model should be looked at for MSOs and not just for conservatism. This F&O is considered to still could be adversely affected by this finding. be open.

Enclosure NG-17-0169 Page 33 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC)

Event DFEED-CNOP-NOTTFRX--{recovery of feedwater) should be set to 1.0 for scenarios where MFW is not credited. It appears this event is not changed for the Fire PRA, but it does show up in the Cutsets. {This F&O originated from SR PRM-BlO) Recommended Action: The Feedwater recovery event is only modeled in logic with the Loss of Review of Feedwater system fault tree logic PRM- Not 4-41 Feedwater Initiator. As described in Section 3 of the equipment selection report the turbine trip is used shows that recovery of Feedwater is not credited BlO Met as the default initiator for general transients. Therefore, the recovery of Feedwater is not credited. when either train is damaged by fire. Acceptability Evaluation: The event DFEED-CNOP-NOTTFRX appears to be "ANDed" with "Non-Loss of Feedwater", which is inconsistent with the description provided in the notebook. To correct this issue, DFEED-CNOP-NOTTFRX should be set to 1.0. This F&O remains open. Although the internal events PRA, which provides the basis for the FPRA model, has been reviewed for modeling consistency and operational consistency, no such review has been documented for FPRA Discussion of modeled MSO scenarios and human scenarios. Such a review may include at least the following: failure events with respect to modeling and a) Review of modeled MSO scenarios to ensure impacts to plant response are properly represented; operational consistency is needed for closure of b) Review of human failure events to ensure failure events are applicable to the cutsets/sequences to this item. Based on the substantial level of which they are applied; review already performed on model cutsets as c) Review of sequence cutsets for fire specific initiating events, if any, to ensure accident sequences and documented in Section 5.0 of the Fire PRA success criteria are reasonable. {This F&O originated from SR QU-D2) Quantification Report, inclusion of these Not 5-2 FQ-El additional items is not likely to affect Met Recommended Action: Section 5 of the Fire PRA Quantification Report was updated to document categorization of components under the risk-review of the CDF/LERF results. Section 7 documents insights from the reviews which show model and informed 50.69 application. operational consistency. Prior to implementation, either this finding will be Acceptability Evaluation: The Fire PRA Quantification Report, 493080001.04, section 5.0 was reviewed. closed or a sensitivity study case will be The F&O states that the FPRA results should be reviewed for modeling consistency and operational performed to determine the impact on the CDF consistency. This involves reviewing the cutsets, the operator actions, and multiple spurious shorts. and LERF results for those categorizations that The cutsets for both fire CDF and LERF were reviewed and discussed. Neither the operator action nor could be adversely affected by this finding. the multiple spurious shorts were reviewed or discussed. This F&O was not fully resolved and remains open. No review of non-significant cutsets appears to have been documented. Such a review would provide Methodology complies with requirements for assurance that the FPRA plant response model is logical, accurate and producing the intended results. resolution of Finding. Not This documentation may include the following: 5-5 FQ-El Met Only enhanced documentation of the "bottom a) a review of cutsets from a sample of scenarios with non-significant frequencies; cutset" review process is needed to close this b) a review of non-significant cutsets from a sample of significant scenarios; F&O.

Enclosure NG-17-0169 Page 34 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC)

This review may include the following for example:

                         *The bottom 5 non-significant cutsets from 5% of the significant fire scenarios;

Five non-significant cutsets from 5% of the non-significant fire scenarios. (This F&O originated from SR QU-D5}

Recommended Action: Section 5.2.3 and 5.3.3 of the Fire PRA Quantification Report was updated to document the review of non-significant cutsets. Acceptability Evaluation: Although there is a statement in section 5.2.3 of the Quantification Report concerning a review of "bottom cutsets" for both CDF and LERF, there is no documentation provided concerning how the review was performed, how many cutsets were reviewed (and how they were selected}, etc. Given the lack of documentation of these reviews, this F&O is considered to be open. The DAEC Fire PRA assigns an ignition frequency, greater than zero to every plant physical analysis unit, with the exception of PAUs 02L, 02M and 09B. The Standard requires a non-zero ignition frequency for all plant analysis units that have not been qualitatively screened. (This F&O originated from SR IGN-A8} Closure of this F&O requires reconciliation of Recommended Action: The Fire PRA is updated to include a fire ignition frequency for all PAUs. (see minor discrepancies between documented fire also F&O 1-4) ignition frequency values and values actually used in the Fire PRA. The combined contribution to Acceptability Evaluation: A review of the current Fire PRA Plant Partitioning and FIF Report CDF of the cited physical analysis units (PAUs} is demonstrates that all non-screened PAUs now have an ignition frequency. Section 4.4 of the report less than 1 percent. As such, the potential for Not describes the ignition frequency calculation methodology and Table 5.1-1 summarizes the ignition 5-9 IGN-A8 affecting categorization of components under the Met frequencies for each PAU. However, various inconsistencies are noted between the reports and the risk-informed 50.69 application is very low. FRANX model: Prior to implementation, either this finding will be PAU 02L: FIF report shows 8.62E-6, but the Scenario report and FRANX show l.16E-5 with the following closed or a sensitivity study case will be note, "The pipe chase is inaccessible during operation; therefore hot work fires are not postulated. A performed to determine the impact on the CDF 0.1 factor is applied given that it is a pipe chase that is inaccessible and that only one set of cable trays and LERF results for those categorizations that go through the area" could be adversely affected by this finding. PAU 02M: FIF report shows 8.62E-6, scenario report & FRANX shows 1.16E-5 with the note, "Chase is inaccessible during operation. Hot work fires not considered." PAU 09B: reports & model don't agree, but there is FIF assigned. This F&O is considered to still be open. The sources of LERF model uncertainty and related assumptions have not been identified or Fire related uncertainties in the Level 2 PRA need Not 5-16 FQ-El documented. (This F&O originated from SR LE-F3} to be discussed in the Fire PRA Quantification Met Report for closure of this item. Based on the Recommended Action: The quantification and summary report is updated to document the sources of conservative nature of DAEC's Level 2 PRA,

Enclosure NG-17-0169 Page 35 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC)

LERF model uncertainty and assumptions. The Fire PRA used the FPIE PRA LERF model. The FPIE PRA inclusion of fire related uncertainties is not likely Level 2 Report, DAEC-PSA-L2-15, and Summary Report, DAEC-PSA-QU-14, documents assumptions and to affect categorization of components under the model uncertainty of Level 2 model. risk-informed 50.69 application. Acceptability Evaluation: While parametric uncertainty is discussed for the fire PRA model in section 9.0 Prior to implementation, either this finding will be of the Fire PRA Quantification Report, there is no discussion of sources of LERF modeling uncertainty closed or a sensitivity study case will be pertaining to the fire PRA included in this report. It is noted that the fire LERF model is based on the performed to determine the impact on the CDF internal events LERF model. The Internal Events PRA Summary Report (DAEC-PSA-QU-14) includes an and LERF results for those categorizations that assessment of modeling uncertainties for the entire PRA model, including the Level 2/LERF portions. could be adversely affected by this finding. While the identification of internal events sources of uncertainty appears appropriate, there is no discussion in the fire PRA documentation that indicates that a specific review for any fire-related uncertainties was performed. This F&O is to remain open until such a discussion is included in the fire PRA documentation. Documentation is not provided in all cases to confirm satisfactory electrical overcurrent protection for common enclosure issues. For example, the evaluation of 4KV and 480V electrical coordination in CAL-E08-006 Revision 0 doesn't document consideration of overcurrent protection for common enclosure issues. (This F&O originated from SR CS-Bl) Recommended Action: Section 4.4 of the Fire PRA Model Development Report, 493080001.02, was updated to document that DAEC meets the guidance of NEI 00-01, Revision 1 and NUREG/CR-6850 for As stated in the Description column, it is not common enclosure concerns. expected that resolution of this F&O will have a significant effect on the PRA analysis due to Acceptability Evaluation: Although the explicit F&O finding (i.e., the documentation of common inherent separation of DC control cables and AC Not enclosure concern in the PRA) is addressed in the Fire PRA Model Development Report, 493080001.02, power cables in most fire areas. 5-22 CS-Bl Met the intended evaluation of common enclosure concern for 480V and 4kV breaker coordination is not explicitly addressed in either 493080001.02 or CAL-E08-006. The intent of the F&O is still not Prior to implementation, either this finding will be satisfactorily addressed. CS-Bl is not met for this F&O, and this F&O remains open. closed or a sensitivity study case will be performed to determine the impact on the CDF The F&O is intended to have a consideration of whether a fire induced Joss of control power to and LERF results for those categorizations that associated 4kV and 480V breakers with subsequent fire induced short circuiting of the breaker's power could be adversely affected by this finding. cables could result in unanalyzed breaker coordination concerns and possibly secondary fires. The discussion added to Fire PRA Model Development Report, 493080001.02 regarding the controls in ACP 1203.59 and requirements of DBD-A61-009 does not consider that overcurrent trip devices may be rendered inoperable because of fire effects on the breaker control power. It is not expected that the resolution of this F&O will have a significant effect on the PRA analysis due to inherent separation of DC control cables and AC power cables in most fire areas. Methodology complies with requirements for 5-27 HRA-A4 Not resolution of Finding Although the FPRA documentation indicates that operator interviews were conducted, no

Enclosure NG-17-0169 Page 36 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC)

Met documentation of these interviews was found and relatively few fire-specific insights from operators were incorporated into the HRA. Talk throughs or reviews with plant operations are needed to confirm Revision to the Fire Scenario Report to describe the interpretation of the procedures relevant the human failure events modeled in the FPRA. These adequacy of operator interviews is necessary for interactions with operations helps to confirm that the HRA is consistent with plant operational and closure of this F&O item. training practices. (This F&O originated from SR HRA-A4} Recommended Action: The Fire PRA documentation is updated to include documentation of the operator interviews in Appendix E of the Fire Scenario Report, 493080001.03 Acceptability Evaluation: Appendix E of the Fire PRA Scenario Report discusses the post-fire Human Reliability Analysis. Appendix E.1 specifically discusses the operator interviews that were conducted. However, based on the information provided, only 2 specific fire scenarios appear to be discussed (Feedwater Pump Lube Oil fires and a 4KV circuit breaker fire). It is not obvious from the documentation why these two scenarios were selected and if they are typical of all of the post-fire HEPs that are included in the model. Additional documentation needs to be added to discuss the adequacy of the interviews. A 0.01 factor was applied to the hot work fire ignition frequency (Table 5-1 and Section 5.1.5.1 of the FPRA Plant Partitioning and Fire Ignition Frequency Development report 493080001.001} for failure to protect the target given procedural non-compliance. This approach represents an extra layer of adjustment however, since the ignition frequency already reflects a population of .plants, most of which likely have procedural controls for hot work. A review was performed of the ERIN Engineering report supporting this 0.01 adjustment as well as other transient fire severity factors described in Appendix C. Model complies with requirements for resolution This includes: a) 'Control/Aux/RB', b} 'Turbine Bldg' c} plant-wide' transient fires. The basis for these of Finding. factors include a review of a small number of fires that do not substantiate a lE-02 factor. For example, for cable fires caused by welding, 12 TB fire events were reviewed in the last 20 years. Some The original treatment of fire in the cable of these events do not appear to have sufficient description to determine the extent of the fire. Not spreading room was replaced by a revised 5-29 IGN-A7 Additionally, if none of the fires caused cable damage, a more appropriate value would have been to Met treatment, results of which are reflected in the use a Jeffrey's non-informative prior, or a failure rate of 1 in 24, at best. However, events where it final quantification report. Minor updating of the cannot be determined if cable fire occurred should be excluded from such a calculation. (This F&O Overview and Documentation Roadmap and of originated from SR IGN-A7} the initial quantification report is needed for closure of this F&O item. Recommended Action: The 0.01 factor was removed from all the hot work fire ignition frequency for all scenarios except the bounding Cable Spreading Room scenario, llA-AOl. The factor is considered appropriate for the Cable Spreading Room given the sensitive nature of the room. Section 6 of the Overview Report, 493080001.00 documents the revised treatment. Acceptability Evaluation: The bounding Cable Spreading Room scenario, 11A-A01, is no longer present in the FRANX model or scenario report documentation. It has been replaced with the seven scenarios

Enclosure NG-17-0169 Page 37 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC) described in the CSR Fire Scenario and Quantification Report. This report does not use the 0.01 factor for the hot work fire ignition frequency, but the other reports (Overview Report & Fire PRA Quantification Report) still discuss this bounding CSR scenario and the use of the 0.01 factor. This F&O remains open pending correction of the documentation.

No simulator observations or talkthroughs with operators have been performed to confirm the response models for fire scenarios modeled. This step involves reviewing scenarios I cutsets modeled in the FPRA to ensure they are reasonable from an operations perspective, including the modeling of Operator interviews on additional important fire human failure events modeled in those scenarios. (This F&O originated from SR HR-E4} initiated scenarios are needed for closure of this F&O item. Although HRA failure rates could be Recommended Action: The Fire PRA documentation is updated to include documentation of the adjusted as a result of this activity, fire scenarios operator interviews in Appendix E of the Fire Scenario Report, 493080001.03. are not likely to be restructured in a manner where key systems are added or removed. As Acceptability Evaluation: The Fire Scenario Report, 493080001.03, Appendix E.1 was reviewed. The SR Not such, the potential for affecting categorization of 5-30 HRA-A4 requires: Met components under the risk-informed 50.69 application is low. TALK THROUGH (i.e., review in detail) with plant operations and training personnel the procedures and sequence of events to confirm that interpretation of the procedures is consistent with plant Prior to implementation, either this finding will be observations and training procedures. closed or a sensitivity study case will be performed to determine the impact on the CDF Two operator interviews were conducted and were performed as a general overview of the response to and LERF results for those categorizations that a fire. There was not a review in detail nor a talk-through on the important scenario to confirm that the could be adversely affected by this finding. HRA represented the actual response to the plant condition with a fire. Operator interviews should be performed with at least the significant scenarios being talked through so that the applicable human failure analysis can be confirmed to be consistent with plant observations and training procedures .. Additional considerations required for operator timelines. Here are two examples: a) 10 minutes is assumed for time delay needed to address actions in the fire procedure AOP-913. This Methodology complies with requirements for estimate was based on queries with operators, but no documentation of this interview was provided. resolution of Finding Also this 10 minutes was applied to time delay, where as it is generally more appropriate, probably, to Not apply whatever time is needed for AOP- 913 to the median response time. 5-38 HRA-B3 Treatment of procedure implementation delay Met b) for D250DCENOPCB4023HE--, the cue defined for FPRA is when the battery has depleted (charger and alternate battery charging with respect to trouble alarm is not on the SSEL and not credited). However, the system time window modeled for the operator timelines needs to be described in the action is the full four hour battery life, which is not correct. The four hours is more appropriately apply Fire Scenario Report for closure of this item. to the time delay. The 10 minutes for AOP 913 are not applicable to the timeline. The system time window needs to be the 4 hour battery life plus whatever time is found to be available to perform this action, given that the battery is depleted, before the undesired consequence applicable for this action occurs. (This F&O originated from SR HRA-B3}

Enclosure NG-17-0169 Page 38 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s} Category Description Disposition for 50.69

  #            (CC)

Recommended Action: Section E.4 was added to the HRA documentation in the Fire Scenario Report, 493080001.03, to provide basis for scenario specific fire impacts. Section E.S was added to discuss operator interviews. In addition, each action in the HRAC was reviewed for available cue and fire impacts on PSFs. Acceptability Evaluation: The methodology for addressing HRA Timelines is adequately addressed in Section 4 of Fire Scenario Report, 493080001.03 and Section Stakes into account Operator interviews and input. Section E.4 does not address the 10-minute delay due to implementation of the fire AOPs. Also the depletion of the battery, D2SODCENOPCB4023HE, is not discussed in section E.4. This was not addressed by section E.4 and needs further clarification of these items to close this F&O. This F&O is considered to still be open. The PRA documentation does not identify limitations in the LERF analysis that would impact applications. (This F&O originated from SR LE-GS) Recommended Action: The Fire PRA used the FPIE PRA LERF model. The FPIE PRA Summary Report, DAEC-PSA-QU-14, Section 3.4, documents limitations of the Level 2 model. Section 7 of the Fire PRA Methodology complies with requirements for Quantification Report, 493080001.04, was updated to discuss limitations of the estimated LERF. resolution of Finding Acceptability Evaluation: Section 7 of the Fire PRA Quantification Report states that, "The estimated Quantification results without the use of Not CDF and LERF incorporate two Unapproved Methods (UAMs), Section 6.3 of this report addresses the S-46 FQ-Fl Unapproved Methods (UAMs) are reflected in the Met impact of these methods and concludes that any change to either method would have a the fire PRA." final quantification report (0493080001.006). Section 6.3 does discuss two UAMs, a Hot work pre-initiator (0.01 Factor) and a Transient HRR Discussion on the use of UAMs in the initial reduction to 69 kW from the typical 317 kW fire. Neither of these UAMs are currently present in the quantification report (0493080001.004) needs to FPRA model. As such, the Fire PRA Quantification report needs to be updated. The Fire PRA Level 2 be deleted for closure of this F&O item. model is based on the internal events PRA Level 2 model. A discussion of the limitations of this model is provided in the internal events PRA summary notebook (DAEC-PSA-QU-14), Section 3.4. Section 7 ("Risk Insights") of the Fire PRA Quantification and Summary Notebook includes several discussion items pertaining to the Level 2 risk results; however, the items noted are not necessarily "limitations". This F&O is considered to remain open, pending correction of the UAM documentation and the need to indicate that there are no additional fire Level 2 PRA limitations. The Switchyard is excluded from the Global Analysis Boundary. Table 2.1-1 note states that it is bounded by the loss of off site power, however the document does not include an explanation on how Treatment of switchyard fire needs to be Not 6-2 PP-Al this "bounding" conclusion was reached. At this point in the analysis, without knowingthe ignition described in the Fire Scenario Report for closure Met frequency, the bounding analysis does not appear to be substantiated. Also, the CCDP/CLERP for a fire of this F&O item. Since the Fire PRA is dominated event may be higher than a similar event caused by a random LOP, especially given no credit to by loss of offsite power accident scenarios, recovery offsite power following a fire. (This F&O originated from SR PP-Al) addition of new scenarios initiated by switchyard

Enclosure NG-17-0169 Page 39 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

   #           (CC) fire, if necessary, is unlikely to affect Recommended Action: Section 1.3 was updated to remove screening criteria related to areas that may       categorization of components under the risk-be bounded by an internal events initiator. The switchyard was added to Table 2.2-1 and a FIF was        informed 50.69 application.

developed as documented in Table 5.1-1. Prior to implementation, either this finding will be Acceptability Evaluation: The Fire PRA Plant Partitioning and FIF Report, 493080001.01 Table 2.2-1 and closed or a sensitivity study case will be Table 5.1-1 were reviewed. The switchyard was added to these tables. The switchyard was not performed to determine the impact on the CDF addressed in the model nor in the fire scenarios. and LERF results for those categorizations that could be adversely affected by this finding. No evidence exists that a confirmatory walkdown was performed. (This F&O originated from SR PP-87) Methodology complies with requirements for Recommended Action: Section 2.2 of the Plant Partitioning and FIF Report, 493080001.01 was updated resolution of Finding Not 6-6 PP-87 to document that a confirmatory walkdown was performed during fire scenario analysis. Met Details of confirmatory walkdowns (i.e., Acceptability Evaluation: The Fire PRA Plant Partitioning and FIF Report, 493080001.01, section 2.2 was walkdown dates and objectives) need to be reviewed. This section states walkdowns were performed to verify PAUs. There are no notes, tables, included in the Plant Partitioning and Fire Ignition or evidence that walkdowns were performed. Frequency Report for closure of this F&O item. Several findings and suggestions (from the original peer review) under HLR-A and HLR-B have been dispositioned/resolved, but the subsuming (IE-83) and screening (IE-C4) of initiating events does not meet the standard. The following provides example summarizes {IE Notebook, including Appendix H):

                        -RBCCW (fails CRD, which is credited for early injection) is subsumed by TT, but RBCCW is not failed given TT.
                        -GSW (fails RBCCW, CRD, Feedwater, etc.) is subsumed by TC, but these systems are not failed given TC.

Model changes comply with requirements for IE Not resolution of Finding. IE-83 -The impacts of Reference and Variable Leg Breaks are not adequately described and are subsumed by OlA Met Loss of FW. Most likely would be a manual shutdown with complications verses a Loss of FW. Given that immediate shutdown would occur given a break, these should be modeled. Section 2.4.8 Documentation update in progress. described the low risk from these, but this does not meet standard for screening.

                        -1Al/1A2 bus failures and partial loss of feedwater (one pump) are binned to TT, but this impact is not modeled given TT.
                        - 1A3/1A4 bus failures are subsumed with TT. Impact on loss of chargers [TS 3.8.4.] etc. and possibility that failure is a problem could lead to an immediate shutdown. Notes 11 and 12 suggest that only normal power source is lost, but emergency power is also unavailable if bus fails.

Enclosure NG-17-0169 Page 40 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #             (CC)

Resolution Summary: This Finding has been addressed and closed by actions as follows: (1) the same support system initiating event fault tree methodology that was reviewed as part of the focused peer review was used to complete the support system initiating event fault trees implemented in the Rev. 7 model. This included support system initiators for River Water Supply, General Service Water, and the 1Al/1A2/1A3/1A4 buses. (2) Initiating events for reference and variable leg breaks and for loss of RBCCW were not incorporated into the Rev. 7 model. The reasons for not explicitly modeling sensing line breaks and loss of RBCCW as initiating events are:

Sensing Line Breaks: A break in a reference or variable leg sensing line is excluded because of the very small contribution to risk. Using the Rev 7 model, the conditional core damage probability (CCDP} was calculated assuming a plant trip and loss of FW, HPCI, and RCIC. The resulting CCDP was 2.60E-5. The total frequency for instrument sensing line breaks (reference and variable legs) is approximately 1.34E-04/yr. The associated CDF is therefore: 1.34E-4/yr x 2.6E-5 =3.SE-09/yr (0.12%

of the Rev. 7 PRA CDF), which is very small and can be screened. In addition, there are conservative factors inherent in these bounding values; (a) two leaks must occur in close proximity of each other to result in a plant trip; (b) operators may detect a leak and take corrective actions before the second leak occurs; (c} a sensing line leak is more likely to occur than a break and mitigation of leaks will likely be successful.

Loss of RBCCW: The impact of loss of RBCCW is not significant and its frequency and consequence are reasonably accounted for via the loss of general service water initiating event, which is explicitly modeled.

Independent Review: Reviewed the Initiating Events Notebook, Appendix Hand table H-1 to verify that the support system initiators are addressed. The reference and variable leg breaks were adequately described and justification provided for not included as a system initiator in section Reactor Water Level Reference Line Leak or Break of the Initiating Events Notebook. Table H-1 has not been updated and does not indicate that the system initiators have been developed and added to the plant PRA model. The PRA model was reviewed. It was verified that the support system initiators were added to the PRA model. This F&O is considered open due the documentation not supporting the addition of support system initiators to the PRA model. Model changes comply with requirements for Table P-1 and P-2: plant position is that initiating event fault trees are not required by the standard (IE) QU-D6- Not resolution of Finding. QU-DSa and therefore equipment level of detail is not available or required to meet this SR. A future OlA Met enhancement has been identified to document in the notebooks the importance of operator actions in Documentation update in progress. support system initiating events, but is awaiting industry clarification. Fault trees are required for

Enclosure NG-17-0169 Page 41of57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC) support system initiating events in order to satisfy this SR.

Recommended Action: Fault trees for support system initiating events have been developed and incorporated into the Revision 7 PRA as discussed in the description of resolution for finding IE-B3-01A. Acceptability Evaluation: DAEC performed an assessment of the initiating events and has including initiating event fault trees in the model. The need to include initiating event fault trees was identified in F&O IE-B3-01A, which is resolved, but requires improvement to the documentation. This finding is judged as a duplicate to B3-01A. Refer to B3-01A. HRA Notebook (Appendix J, Table J-1) includes a systematic approach to identifying calibration activities through a system by system review of potential miscalibrations. This meets the high level requirement to use a "systematic approach" and is judged to be adequate by the Peer Review team. However, the SR wording requires "through a review of procedures and practices" which was not Methodology complies with requirements for followed. As a result, the PR team must assess this SR as "not met." resolution of Finding. HR-A2- Not HR-A2 Recommended Action: As noted in the finding description, the systematic approach used is judged to For closure of this item, the HRA notebook needs OlA Met be adequate by the Peer Review team. Elements of the method used were subsequently evaluated to be updated to describe how the process used against corresponding elements of the HR-A2 prescribed method and found to be equivalent. As such, for reviewing procedures and practices meets the the Standard requirement for HR-A2 has been met. [The HRA Notebook has not yet been updated .. ] intent of supporting requirement HR-A2. Acceptability Evaluation: The method clearly includes a review of procedures and practices. This is a duplicate item to F&O IE-6. This F&O can be closed once the documentation as described in IE-6 has been updated. F&O IE-6 refers to F&O HR-Al-OlA The remarks made by the previous peer review under finding SY-A3-03 are still open and still valid. Failure of either vital 4kV bus Start Up Transformer (SUT) breaker, 1A302 [1A402], to trip on LOSP is not modeled - this failure would prevent associated EDG breaker from closing onto the bus. Omission of this is non-conservative. The model should include the necessary dependencies for this event. Model changes comply with requirements for Specifically, the fault tree model omits a dependency; the failure of the normal supply breaker to each resolution of Finding. vital 4kV bus to trip upon a loss of offsite power to allow the associated EDG to close onto the bus. SY-A3- Not SY-A3 More importantly, a common cause failure between the two breakers for the two busses is omitted. For closure of this item, discussion on failure of 03A Met This CCF may contribute significantly to SBO sequences. Also, not modeling these breakers will have an breakers 1A302 and 1A402 during loss of offsite impact on the fire model. power needs to be added to the AC Power Notebook. Recommended Action: This finding was closed by adding startup transformer breakers 1A302 and 1A402 to the PRA model. The change includes new random and CCF basic events for these breakers. D4160VENCB1A302-FO--

Enclosure NG-17-0169 Page 42 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC)

CCF-CKTB-04160-FT0_1_2 Breakers 1A302 and 1A402 are described in the AC Power System Notebook, Revision 4. Acceptability Evaluation: Reviewed the AC Power Notebook to verify that startup transformer breakers 1A302 and 1A402 were analyzed for failure and the subsequent plant effects. The breakers were discussed in the AC Power Notebook but there is no discussion on the failure of these breakers if there is a loss of offsite power. Reviewed the model to verify that the breakers were added to the model. The breakers were added as basic events and the dependencies were accounted for. This F&O is only partial met and will require that the discussion of the failure of the breakers to open on a loss of offsite power. The SBO event tree does not take credit for containment venting using an alternate alignment when the pneumatic supply is lost. DAEC procedure SAMP 706 provides detailed direction for venting PC [Primary Containment] given an unavailable pneumatic supply. The Containment Vent notebook does not credit/discuss this procedure. Model changes comply with requirements for Recommended Action: Fault tree logic for venting the primary containment using SAMP 706 was resolution of Finding. developed for the Revision 7 PRA Update. SY-AS- Not For closure of this item, details regarding manual SY-AS OlA Met Acceptability Evaluation: The Containment venting fault tree model was revised to include credit for opening of containment vent valves under SBO the alternate manual opening of the vent valves under SBO conditions in which the normal pneumatic conditions need to be described in the supplies (instrument air and the installed accumulators) are unavailable. However, the process (as Containment Vent system notebook and in the described in SAMP-706} involves the connection of portable air bottles and the manipulation of various Event Tree notebook. manual valves. The venting actions are described in the PRA Update notebook. However, these actions are not discussed in the Containment Vent system notebook. The PRA Update Notebook also presents updated event trees for SBO. However, the Event Tree notebook does not reflect the current SBO modeling and does not include consideration of venting. The finding is resolved but should remain open due to the need to update the model documentation. Model changes comply with requirements for There is no Fire Water System (Alternate Injection) notebook or equivalent information in another resolution of Finding. notebook. The operator action to align fire water for injection is modeled but the components are SY-C2- Not based on the argument that the probability of the action subsumes the component failure rates. SY-C2 For closure of this item, the new human actions OlA Met for alignment of fire water during SBO, as noted Recommended Action: New HEPs for aligning the in-situ diesel and electric fire pump were updated in the Description, need to be included in the and failure rates for key components were added. A fire water notebook was prepared but still needs HRA notebook. to be reviewed and approved.

Enclosure NG-17-0169 Page 43 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC)

Acceptability Evaluation: Reviewed the Fire Water Notebook. The notebook was developed. It was detailed and contained detail modeling of the fire water system. This included the system pumps, and valves. This notebook meets the requirement for a notebook and a detailed model of the fire water system. The human action to align the fire water system for injection during an SBO was added to the fault tree. This action was analyzed using the HRA calculator. Several HFEs were added due to different timeframes. However, the HRA notebook needs to be updated to incorporate the new HFEs from this F&O. This F&O remains open until documentation updates are complete. HRA Notebook {Appendix J, Table J-1) includes a systematic approach to identifying calibration activities through a system by system review of potential miscalibrations. This meets the high level requirement to use a "systematic approach" and is judged to be adequate by the Peer Review team. However, the SR wording requires "through a review of procedures and practices" which was not followed. As a result, the PR team must assess this SR as "not met." Model changes comply with requirements for Recommended Action: As noted in the finding description, the systematic approach used is judged to resolution of Finding. be adequate by the Peer Review team. Elements of the method used were subsequently evaluated HR-Al- Not against corresponding elements of the HR-Al prescribed method and found to be equivalent. As such, HR-Al For closure of this item, the HRA notebook needs OlA Met the Standard requirement for HR-Al has been met. [The HRA Notebook has not yet been updated.] to be updated to describe how the process used Acceptability Evaluation: DAEC performed an assessment of the process used to identify pre-initiator for reviewing procedures and practices meets the HFEs against the specific requirements of the ASME standard. The comparison shows that the DAEC intent of supporting requirement HR-Al. process met the intent of the standard for performing a review of procedures and practices. The DAEC process identified a comprehensive list of pre-initiator interactions and HFEs. The process used meets the intent of the Standard, which is to involve a systematic approach to identifying possible calibration-related activities and associated HFEs and that could have an influence on the PRA results. This is a duplicate item to IE-12. However, the HRA Notebook has not yet been updated .. This F&O can be closed once the documentation has been updated. A number of pre-IE [initiating event] HFEs are identified for modeling in the PRA. Generally these HFEs are at the train or system level, as appropriate. However, a small set were identified at the system level Methodology complies with requirements for without related train-level HFEs. It is possible that the train level HFE may be important to system resolution of Finding. HR-Cl- Not unavailability. For example, miscalibration of DG fuel oil level transmitters is done at the system level, HR-Cl OlA Met but not at the train level. At the train level, the HFE would be 8e-3, compared with independent failure For closure of this item, incorporation of train of the level transmitter of Se-4. In other cases, the HFE is at the train level, but no corresponding level pre-initiating events into the PRA needs to system level dependent HFE is included. For example, failure to restore RHR SW post TM [testing and be described in the HRA notebook. maintenance] is developed at the train level, but no common misalignment of both trains is considered.

Enclosure NG-17-0169 Page 44 of 57 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items Capability Finding SR(s) Category Description Disposition for 50.69

  #            (CC)

Recommended Action: Train level pre-initiating event HFEs were added to the Revision 7 PRA. These are described in Excel spreadsheet 'Mapping of old Pre-Initiators to new.xlsx'. Acceptability Evaluation: Reviewed the Mapping of old Pre-Initiators to new.xlsx EXCEL spreadsheet. This spreadsheet establishes the change from the system level to the train level for the pre-initiators. The HFEs are now analyzed at the train level. The spreadsheet needs be added to the HRA notebook as an attachment so that this new analysis is traceable. This F&O is considered to still be open until this is done.

Enclosure NG-17-0169 Page 45 of 57 Attachment 4: External Hazards y Screened based on low probability of aircraft crash

Aircraft Impact PS4 and small tar et size of SR structures.

y Excluded due to site topography that would not Avalanche C3 su ort snow buildu that would lead to an avalanche. Biological Event - y C4 Included implicitly in LOOP initiator. Animal Infestation cs Slow develo in with limited im act. Organic Material in Water is a more credible scenario Biological Event - to cause intake blockage than normal aquatic growth. Aquatic Grown y cs Slow developing hazard, can be detected and mana ed. Biological Event - Organic Material y C3 Excluded due to location of plant on a river. in Water Coastal Erosion y C3 Excluded based on river volume and flowrate providing Drought y cs a Ion warnin time. Included in FLEX-FLOOD MSA, "Mitigating Strategies Cl Assessment for Flooding Hazard Reevaluation" and External Flooding Y (see comments) C3 UFSAR Section 3.4, "Water Level Flood Design". High tide and hurricane cannot occur close to lant. Extreme Wind or Y (see comments) PS4 CDF < lE-6 /yr based on IPEEE. Tornado Fog and mist may increase the frequency of accidents y involving aircraft, ships, or vehicles. This weather Fog C4 condition is included implicitly in the accident rate data for these Trans ortation Accidents. Included implicitly in LOOP initiator. Forest & grass Forest or Range y C3 are somewhat distant from the plant with no Fire C4 immediate im act on e ui ment. Frost y C4 y Cl Building design for high wind and missiles is bounding. Hail C4 Included im licit! in weather-related LOOP initiator. High Summer y Cl Plant AC ventilation is designed for extreme heat load. Tern erature - Air cs Lon time for air tern erature rise High Summer y Cl Plant is designed for extreme high river temperature. Temperature - Water cs Long time for river temperature rise. High Tide, Lake Level, or River y Cl Plant is designed for extreme high river level. Sta e y Not applicable to Duane Arnold since Duane Arnold is Hurricane C3 not located in a Hurricane zone. Ice Cover y C4

Enclosure NG-17-0169 Page 46 of 57 Attachment 4: External Hazards S,Creening criterion Note a There are no military facilities within S miles of Duane Arnold. There is a quarry within about 3 miles of the site which does use dynamite. Small quantities ( S to Industrial or y Cl 10 lb) may be kept at quarry. Analyzed by John Military Facility C3 Blume & Associates. Max seismic acceleration due to Accident dynamite at quarry would be 0.002g. Negligible impact.

                                     - Bounded b on-site hazard ro ane tank Internal Floodin   N         n/a     Internal Floodin PRA documented in PRA Notebook.

Internal Fire N n/a Internal Fire PRA documented in PRA Notebooks. y Excluded due to site topography that would not Landslide C3 su art landslide of an si nificance. Included implicitly in weather-related LOOP. The plant grounding system provides protection to y Cl emergency AC power to reduce the likelihood of Lightning C4 lightning-induced failure. The plant lightning system provides lightning arrestors to prevent lightning failures Cl Plant designed for low river level. Excluded based on Low Lake Level or y river volume & flowrate and long warning time. Also, C4 historical low level is well above low level. Loss of UHS River Stage included in PRA Notebook. cs Low Winter y Cl Seasonal Readiness process prepares site for reliable Tern erature - Air cs o eration sustained cold weather eriods. Low Winter y C4 Implicitly included in loss of river water supply Temperature - Water cs initiating event. Would take a long time to develop. Extremely unlikely for satellite debris of any significant size to hit the site. Any such strike would be localized Meteorite or y C2 and not expected to cause direct core damage. This Satellite Impact hazard is bounded by heavy load drop and turbine-enerated missile hazards. DAEC IPEEE determined gas pipelines around the y C2 Pipeline Accident DAEC site present negligible risk to the safe operation C3 of DAEC due to their size and location. Release of y Plant is designed for hazardous chemicals which are Chemicals in Cl stored on site. Onsite Stora e River Diversion y C3 Excluded due to river flow ath.

Enclosure NG-17-0169 Page 47 of 57 Attachment 4: External Hazards S.creen.ed? _ (Y/N) Plant equipment is protected from or designed to Sand or Dust y Cl preclude foreign material. Storm C3 Excluded due to lack of large quantities of loose sand on site or nearb . Seiche y C3 Excluded due to lant location. Seismic margins analysis (SMA) performed for the Seismic Activity N n/a Individual Plant Evaluation-External Events IPEEE . Cl Plant design includes snow loads and other bounding Snow y C4 loads. cs Included im licitl in weather-related LOOP initiator. Soil Shrink-Swell y Excluded based on structures founded on bedrock C3 Consolidation and/or en ineered fill. Storm Surge y C3 Toxic Gas y Cl Cl Transportation y C2 Conservative bounding assessment shows that these Accident C3 events can be screened. C4 y Not applicable to Duane Arnold since Duane Arnold is Tsunami C3 not located on an ocean. Turbine- Cl Screened based on low probability of turbine wheel Generated y C2 failure for a monoblock design and low probability of Missiles cs im actin SR e ui ment. y Excluded due to distance from nearest potentially Volcanic Activity C3 active volcano. Waves Y Cl Plant is designed for effect of waves. Note a - See Attachment S for descri tions of the screenin criteria.

Enclosure NG-17-0169 Page 48 of 57 Attachment 5: Progressive Screening Approach for Addressing External Hazards E~~nt <'.,',; Analy$is . ¢riteri<>11 '~o~rce .. corrimer.ts Initial Event damage potential is < NUREG/CR-2300 and Preliminary Cl events for which plant is ASME/ANS Standard RA-Sa-Screeninq desiqned 2009 Event has lower mean NUREG/CR-2300 and frequency and no worse C2 ASME/ANS Standard RA-Sa-consequences than other 2009 events analyzed. Event cannot occur close NUREG/CR-2300 and C3 enough to the plant to affect ASME/ANS Standard RA-Sa-it 2009 Not used to NUREG/CR-2300 and Event is included in the screen. Used only C4 ASME/ANS Standard RA-Sa-definition of another event. to include within 2009 another event. Event develops slowly, allowing adequate time to cs eliminate or mitigate the ASME/ANS Standard threat. Design basis hazard cannot Progressive ASME/ANS Standard RA-Sa-PS1 cause a core damage Screening 2009 accident Design basis for the event NUREG-1407 and meets the criteria in the NRC PS2 ASME/ANS Standard RA-Sa-1975 Standard Review Plan 2009 (SRP). Design basis event mean NUREG-1407 as modified in frequency is < lE-5/y and PS3 ASME/ANS Standard RA-Sa-the mean conditional core 2009 damage probability is < 0.1 NUREG-1407 and Bounding mean CDF is < lE-PS4 ASME/ANS Standard RA-Sa-6/y. 2009 Screening not successful. NUREG-1407 and PRA needs to meet Detailed PRA ASME/ANS Standard RA-Sa-requirements in the 2009 ASME/ANS PRA Standard.

Enclosure NG-17-0169 Page 49 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Recently the stability of at NUREG/CR-6890 [B-6] is used to The overall approach for the least some local areas of develop the prior distribution for the LOOP frequency and fail to the electric power grid has LOOP initiator frequency and recover probabilities utilized is been questioned. The incorporates four causal categories considered an industry good potential duration and (Plant centered, Switchyard practice, but is not yet considered complexities of recovery centered, Grid related, and Weather a consensus model approach. from such events are hard related). The priors utilize industry This includes issues with grid to dismiss. Three different data for the plant centered, stability. aspects relate to this issue: switchyard centered, and weather It is retained as a candidate la. LOOP Initiating LOOP categories; however, region modeling uncertainty. Event Frequency specific grid related LOOP data that Conditional LOOP frequency is lb. Conditional LOOP is utilized for the prior. A Bayesian based on NRC recommendations Frequency update for each category with plant and is considered realistic. Not a le. Availability of DC specific data from 1/1/03 - 6/30/08 source of model uncertainty in power to perform is utilized to obtain a total plant most applications. restoration actions specific LOOP and frequency. The availability of DC power to Conditional LOOP is consistent with perform restoration actions is NRC recommendations. Restoration realistic with a slight conservative activities are dictated by procedure. bias on the recovery times utilized. Not a source of model uncertainty in most applications Increasing use of plant- The CCF for the fail-to-run terms is Slight conservative bias since specific models for support based on annualized mission times Alpha factors are known to be system initiators (e.g., loss using generic alpha factors, but with high when utilized in an of SW, CCW, or IA, and loss plant-specific information for the annualized fashion and compared of AC or DC buses) have led independent failure rate. to plant-specific experience. to inconsistencies in The support system initiating events No recovery items are identified approaches across the are used as is with no additional as a candidate source of model industry. A number of credit for recovery except for Loss uncertainty. challenges exist in of RW. These should not be a source of modeling of support model uncertainty in most system initiating events: applications. 2a. Treatment of common cause failures 2b. Potential for recovery

Enclosure NG-17-0169 Page 50 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition It is difficult to establish The pipe break portion of the LOCA The LOCA frequency values values for events that have initiating event frequencies are represent a slight conservative never occurred or have based on a pipe segment count and bias. rarely occurred with a high per segment failure probabilities This should not be a source of level of confidence. The from the EPRI methodology [B-9]. model uncertainty in most choice of available data The component rupture portion of applications. sets or use of specific the LOCA initiating event methodologies in the frequencies are based on the determination of LOCA component rupture data and frequencies could impact methodology utilized in the NRC base model results and RMIEP study [B-10]. some applications. Station Blackout events are No credit is taken for continued No credit for equipment operation important contributors to operation of any systems without after battery depletion may baseline CDF at nearly DC power that normally require DC represent a slight conservative every US NPP. In many power for operation. This includes bias. cases, battery depletion HPCI, RCIC and the SRVs. This should not be a source of may be assumed to lead to model uncertainty in most loss of all system applications. capability. Some PRAs have credited manual operation of systems that normally require de for successful operation (e.g., turbine driven systems such as RCIC and HPCI}. Many BWR core cooling No credit is taken for the use of No credit for these systems after systems utilize the injection systems with suction from uncontrolled containment venting suppression pool as a the suppression pool following or large containment failure water source. Venting of uncontrolled containment venting or represents a slight conservative containment as a decay the induced containment failure. bias based on thermal hydraulic heat removal mechanism analyses. or containment failure can This should not be a source of substantially reduce NPSH, model uncertainty in most even lead to flashing of the applications. pool. This rapid drop in containment pressure may lead to local steaming that causes steam binding in pumps taking suction on the suppression pool. The treatment of such scenarios varies across BWRPRAs.

Enclosure NG-17-0169 Page 51 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Loss of containment heat With containment venting No credit for LP ECCS, HPCI or removal leading to long- unsuccessful: RCIC systems after containment term containment over- Limited credit is taken for continued failure may represent a slight pressurization and failure injection after containment failure. conservative bias. can be a significant FW/CD and CRD are the only viable Credit for other alternate low contributor in some PRAs. high pressure injection sources. pressure injection systems such Consideration of the At DAEC, these are motor driven as CD and RHRSW/GSW/ESW containment failure mode systems, with FW/CD being located crossties is taken because their might result in additional in the Turbine Building and CRD in alignment is outside of the reactor mechanical failures of the Reactor Building . building and can be performed for credited systems. Credit is not taken for LP ECCS certain containment failure Containment venting (located in the basement corner modes. Credit for these systems is through "soft" ducts or rooms) following containment realistic containment failure can failure (due to NPSH and These should not be a source of result in loss of core environmental issues). model uncertainty in most cooling due to Condensate (located in the turbine applications. environmental impacts on building), and RHRSW/GSW/ESW FW/Condensate/CRD and equipment in the reactor crossties are credited. alternate crossties injection building, loss of NPSH on capability after large catastrophic ECCS pumps, steam containment failure is identified as binding of ECCS pumps, or a candidate source of model damage to injection piping uncertainty. or valves. The DAEC hard pipe vent options will make these effects probabilistically small. There is no definitive reference on the proper treatment of these issues.

Enclosure NG-17-0169 Page 52 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Loss of HVAC can result in A combination of design basis Electrical Switchgear HVAC is room temperatures calculations for technical judged to be realistic and exceeding EQ limits. specifications and supporting consistent with operating Treatment of HVAC calculations are referenced to experience. requirements varies across determine the HVAC requirements This may be a candidate source of the industry and often in the model. model uncertainty given the PRA within a PRA. There are industry sensitivity to SWGR room two aspects to this issue: cooling and assumptions of the (1) whether the SSCs SWGR failure temp. affected by loss of HVAC RCIC, CS/LPCI and control room are assumed to fail {i.e., cooling is NOT required consistent there is uncertainty in the with calculations for these fragility of the systems. This is realistic and components); and (2) how should not be a source of model the rate of room heatup is uncertainty in most applications. calculated and the Room cooling is assumed to be assumed timing of the required for HPCI extended failure. operation for SBO and 24 hour mission times. This is realistic and should not be a source of model uncertainty in most applications. Station Blackout events are Battery life for DAEC is 5 hours The 5 hr battery life without load important contributors to without load shedding and 7 hours shed is reasonable and maybe baseline CDF at nearly with load shedding. For SBO slightly conservative. every US NPP. Battery life scenarios, the 7 hour battery life is The 7 hr battery life with load is an important factor in used. These estimates are based shedding is also judged assessing a plant's ability on battery discharge tests and reasonable. to cope with an SBO. Many discussions with system managers. The model explicitly accounts for plants only have design DC load shedding to extend the basis calculations for battery life. battery life. Other plants This aspect is judged not source have very plant/ condition- of model uncertainty in most specific calculations of applications. battery life. Failing to fully credit battery capability can overstate risks, and mask other potentially contributors and insights. Realistically assessing battery life can be complex.

Enclosure NG-17-0169 Page 53 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition All BWRs have improved The failure cause and likelihood of The incorporation of their suppression pool suppression pool suction strainers unrecoverable global CCF term for strainers to reduce the are expected to be significantly simultaneous clogging of all potential for plugging. different, depending on what type suppression pool strainers is However, there is not a of accident sequence is being judged to represent a slightly consistent method for the analyzed. Therefore, global conservative bias. treatment of suppression scenario-specific CCF terms for all This should not be a source of pool strainer performance. suppression pool strainers are model uncertainty in most included in the model. applications. Certain scenarios can lead Failure of a sufficient number of These are low significance to RCS/RPV pressure safety relief valves to open when scenarios to the risk profile. transients requiring required may lead to excessive Scenarios are realistic or slightly pressure relief. Usually, reactor vessel pressure and a conservative. This should not be a there is sufficient capacity potential LOCA condition. The source of model uncertainty in to accommodate the success criteria for the reactor most applications. pressure transient. pressure control function is However, in some established for various scenarios scenarios, failure of since the number of the relief valves adequate pressure relief required to open (or relief valve can be a consideration. capacity) varies for different Various assumptions can accident sequences. be taken on the impact of inadeauate pressure relief. Due to the scope of PRAs, Generally, credit for operation of This is retained as a candidate scenarios may arise where systems beyond their design-basis model uncertainty. equipment is exposed to environment is not taken. beyond design basis Severely degraded plant conditions environments (w/o room may impose environmental cooling, w/o component conditions that are beyond the cooling, w/ deadheading, design basis envelope. These in the presence of an un- conditions may lead to higher isolated LOCA in the area, failure rates. Models affected etc.). include: LPCI/CS for loss of NPSH LPCI/CS for loss of cooling HPCI for loss of lube oil cooling Control Room equipment

Enclosure NG-17-0169 Page 54 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Most PRAs do not give Generally, credit for initiation of Credit for some direction from the much, if any credit, for actions from the ERO is not taken in ERO for this action is a realistic initiation of the Emergency the Level 1 core damage sequence assumption. Minimal credit is Response Organization analysis. Exceptions are noted in imposed for the ERO presence in (ERO), including actions the next column. support of the Level 1 PRA. The included in plant-specific Credit for the SAMGs is taken in the Level 2 PRA relies on the ERO SAMGs and the new BSb detailed Level 2 analysis. presence for effective SAMG mitigation strategies. The implementation. additional resources and The HRA Dependency "floor" capabilities brought to bear limits the credit that can be via the ERO can be achieved even when ERO is substantial, especially for credited. long-term events. This should not be a source of model uncertainty in most aoolications. One of the most important, Internal flood analysis and initiating Use of generic flood frequencies is and uncertain, inputs to an event frequencies for spray, flood, considered an industry good internal flooding analysis is and major flood scenarios practice approach, but is not yet a the frequency of floods of developed consistent with the EPRI consensus model approach. Also, various magnitudes (e.g., methodology [B-6]. there could be sneak paths not small, large, catastrophic) identified by design or walkdowns from various sources (e.g., that could propagate flood to clean water, untreated unanalyzed areas. Therefore, water, salt water, etc.). these is a candidate for model EPRI has developed some uncertainty. data, but the NRC has not Spray flood scenarios have a formally endorsed its use. slight conservative bias employed in the undeveloped spray scenarios that are subsumed in with the other flood scenarios in the same region. Flood and major flood have a slight conservative bias in that the system may not be totally disabled in all cases. These should not be a source of model uncertainty in most applications.

Enclosure NG-17-0169 Page 55 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition Typically, the treatment of In LOOP/SBO events, credit for core Realistic with slight conservative core melt arrest in-vessel melt arrest in-vessel prior to vessel bias. has been limited. failure is accounted for with This should not be a source of However, recent NRC work adjustments to the LOOP fail to model uncertainty in most has indicated that there recover. applications. may be more potential than Only marginal credit for recovery is previously credited. A taken for events that remain at high Changing the modeling approach possible example is credit pressure between core damage and would not cause the risk metrics for CRD in BWRs as fully vessel failure. to approach any acceptance capable of arresting core If RPV depressurization occurs after guidelines. Not a source of model melt progression in-vessel core damage, but before the time at uncertainty. per MELCOR calculations. which vessel breach cannot be precluded, then core melt arrest in- The assumption of LP ECCS vessel is credited if LP ECCS or restoration assuring that vessel alternate injection is available. failure is avoided is not identified If containment failure occurs prior as a candidate source of model to core damage due to dynamic uncertainty. containment loading failure no injection is credited to provide core melt arrest in-vessel. Changing the modeling approach would not cause the risk metrics to approach any acceptance guidelines. Not a source of model uncertainty The progression of core Very unlikely based on reference to In some cases, phenomenological melt to the point of vessel generic studies and identification of failure probabilities chosen failure remains uncertain. plant-specific features. represent a slight conservative Some codes {MELCOR) bias given the current predict that even vessels understanding of these issues. with lower head In other cases the phenomena is penetrations will remain deterministically modeled or intact until the water has calculated. evaporated from above the These should not be a source of relocated core debris. model uncertainty in most Other codes {MAAP), applications. predict that lower head penetrations might fail early. The failure mode of the vessel and associated timing can impact LERF determination, and may influence OCH characteristics {especially for some BWRs and PWR ice condenser plants).

Enclosure NG-17-0169 Page 56 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition The lower vessel head of 1) Ex-vessel cooling of the lower No credit for ex-vessel cooling of some plants may be head cannot occur quickly enough the lower head represents a submerged in water prior to prevent vessel failure and the a realistic treatment with slight to the relocation of core potential for LERF scenarios. conservative bias. debris to the lower head. 2) Core Spray is required to keep Therefore, changing the modeling . This presents the potential the core cooled while the approach would not cause the risk for the core debris to be containment flooding process is metrics to approach any retained in-vessel by ex- initiated. acceptance guidelines. vessel cooling. This is a These issues should not be a complex analysis impacted source of model uncertainty in by insulation, vessel design most applications. and degree of submergence. In some plants, core debris This issue is explicitly modeled and The approach is considered can come in contact with quantified consistent with the realistic. Modeling uncertainty the containment shell (e.g., assessment performed by exists primarily on reducing the some BWR Mark Is, some Theofanous in NUREG/CR-5423 and LERF risk metric. PWRs including free- NUREG/CR-6025. Modeling uncertainty is not standing steel expected to challenge any containments). Molten acceptance guidelines for core debris can challenge anticipated applications. This is the integrity of the not retained as a candidate containment boundary. modeling uncertainty. Some analyses have This should not be a source of demonstrated that core model uncertainty in most debris can be cooled by applications. overlying water pools. ISLOCA is often a 1) Common cause factors are not The approach for the ISLOCA significant contributor to major contributors to ISLOCA frequency determination is LERF. One key input to the frequencies at DAEC due to the considered an industry good ISLOCA analysis are the diversity in PCIVs and PCIV failure practice, but is not yet considered assumptions related to modes. a consensus model approach. common cause rupture of 2) The failure probability for each Therefore, ISLOCA frequency is isolation valves between flow path given exposure to high retained as a candidate model the RCS/RPV and low pressure RPV conditions is uncertainty. pressure piping. There is appropriately represented by the no consensus approach to formulae in NUREG/CR-5603. the data or treatment of this issue. Additionally, given an overpressure condition in low pressure piping, there is uncertainty surrounding the failure mode of the piping.

Enclosure NG-17-0169 Page 57 of 57 Attachment 6: Disposition of Key Assumptions/Sources of Uncertainty Assumption/ Uncertainty Discussion Disposition The amount of hydrogen Past operating experience data on The approach is considered burned, the rate at which it time deinerted is applicable to realistic. Modeling uncertainty is generated and burned, future plant operation. exists primarily on reducing the the pressure reduction Slightly conservative assessment of LERF risk metric. mitigation credited by the hydrogen combustion. Modeling uncertainty is not suppression pool, ice The assumption that the time expected to challenge any condenser, structures, etc., deinerted may correspond to a time acceptance guidelines for can have a significant of increased initiating event anticipated applications. This is impact on the accident frequency (start up or shutdown) not retained as a candidate sequence progression but a time of decreased decay heat modeling uncertainty. development. generation is not included in the model quantification.}}

v t e Letter Sequence Request
CAC:MG0199, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5B (Withdrawn, Closed)
Initiation Request, Request Acceptance... Administration Questions Answers Results Withdrawal Other: ML18046A988, ML18108A310, ML18199A603
MONTHYEAR2018-04-12 [Table View]

NG-17-0169, License Amendment Request TSCR-175, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

Text

Enclosure:

SUMMARY

2.3 DESCRIPTION

4.3 CONCLUSION

Navigation menu

NG-17-0169, License Amendment Request TSCR-175, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for Nuclear Power Reactors

Text

Enclosure:

SUMMARY

2.3 DESCRIPTION

4.3 CONCLUSION

Navigation menu

Search