Text

Supplement to License Amendment Requesting Adoption of TSTF-505, Revision 2
	ML22067A171
Person / Time
Site:	Susquehanna
Issue date:	03/08/2022
From:	Cimorelli K; Susquehanna, Talen Energy
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	PLA-7984, TSTF-505, Rev 2
	Download: ML22067A171 (219)
	v • d • e

Kevin Cimorelli Susquehanna Nuclear, LLC Site Vice President 769 Salem Boulevard Berwick, PA 18603 Tel. 570.542.3795 Fax 570.542.1504 Kevin.Cimorelli@TalenEnergy.com March 8, 2022 Attn: Document Control Desk 10 CFR 50.90 U. S. Nuclear Regulatory Commission Washington, DC 20555-0001 SUSQUEHANNA STEAM ELECTRIC STATION SUPPLEMENT TO LICENSE AMENDMENT REQUESTING ADOPTION OF TSTF-505, REVISION 2 Docket No. 50-387 PLA-7984 and 50-388

References:

1) Susquehanna letter to NRC, Proposed Amendment to Licenses NPF-14 and NPF-22: License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (PLA-7897), dated April 8, 2021 (ADAMS Accession No. ML21098A206).

2) NRC letter to Susquehanna, Regulatory Audit Plan in Support of License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times (EPID L-2021-LLA-0062), dated June 15, 2021 (ADAMS Accession No. ML21153A137).

Pursuant to 10 CFR 50.90, Susquehanna Nuclear, LLC (Susquehanna), submitted, in Reference 1, a request for an amendment to the Technical Specifications (TS) for the Susquehanna Steam Electric Station (SSES), Units 1 and 2, Facility Operating License numbers NPF-14 and NPF-22. The proposed amendment would modify TS requirements to permit the use of Risk Informed Completion Times in accordance with Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times, RITSTF Initiative 4b.

The NRC notified Susquehanna in Reference 2 of the intent to conduct a regulatory audit virtually from June 28 through December 31, 2021. During the virtual audit, Susquehanna personnel and associated contractors met with members of the NRC staff to discuss specific questions provided by the NRC staff.

Document Control Desk PLA-7984 to this letter provides a response to several of the audit questions posed by the NRC staff during the regulatory audit. As a result of the responses to several of the questions included in Enclosure 1, Susquehanna identified some revisions necessary to enhance the information provided in Tables E l-I, E l-2, and E l-4 of Enclosure 1 to Reference 1. Enclosure 2 to this letter provides revised versions of the tables and supersede the previously provided versions in their entirety. to this letter provides revised TS markup pages as a result of responses to audit questions. Enclosure 4 provides the corresponding clean TS pages. Enclosure 5 provides revised TS Bases markups and is provided for information only.

Susquehanna has reviewed the inf01mation supporting a finding of No Significant Hazards Consideration and the Environmental Consideration provided to the NRC in Reference 1 and determined the information provided herein does not impact the original conclusions in Reference 1.

There are no new or revised regulat01y commitments contained in this submittal.

Should you have any questions regarding this submittal, please contact Ms. Melisa Krick, Manager-Nuclear Regulat01y Affairs, at (570) 542-1818.

I declare under penalty of pe1jmy that the foregoing is trne and correct.

Executed on March 8, 2022 K. Cimorelli

Enclosures:

1. Response to Regulat01y Audit Questions

2. Revised Enclosure 1 Tables

3. Marked-Up Technical Specification Pages

4. Revised (Clean) Technical Specification Pages

5. Marked-Up Technical Specification Bases Pages (Provided for Information Only)

Document Control Desk PLA-7984 Copy: NRC Region I Mr. C. Highley, NRC Sr. Resident Inspector Ms. A. Klett, NRC Project Manager Mr. M. Shields, PA DEP/BRP

Enclosure 1 of PLA-7984 Responses to Regulatory Audit Questions

Enclosure 1 to PLA-7984 Page 1 of 105 Response to Regulatory Audit Questions On April 8, 2021, Susquehanna Nuclear, LLC (Susquehanna), submitted a license amendment request (LAR) for the Susquehanna Steam Electric Station (SSES), Units 1 and 2 (Reference 1).

Specifically, Susquehanna requested a revision to the Technical Specifications (TS) to permit the use of Risk Informed Completion Times (RICTs) in accordance with Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times, RITSTF Initiative 4b. By letter dated June 15, 2021, the NRC informed Susquehanna of the intent to conduct a regulatory audit virtually from June 28 through December 31, 2021 (Reference 2). During the virtual audit, Susquehanna personnel and associated contractors met with members of the NRC staff to discuss specific questions provided by the NRC staff. Selected NRC questions and the Susquehanna responses are provided below.

Audit Question Q-001

[Provide] Additional justification for adding following isolation in the completion times for Actions A.2, C.2, and D.2 in TS 3.6.1.3.

Susquehanna Response The proposed changes to TS 3.6.1.3, Required Actions A.2 and C.2 are consistent with the changes proposed to the BWR/4 Standard TS in TSTF-505 (Reference 3) for Limiting Condition for Operation (LCO) 3.6.1.3, Required Actions A.2 and C.2. These changes are discussed in Section 2.2.3 of the Revised Model Safety Evaluation for applications adopting TSTF-505 (Reference 4). Therefore, the proposed changes to SSES Required Actions A.2 and C.2 are encompassed within the generic approval of TSTF-505 and do not require further justification.

Condition D, however, is a Susquehanna-specific Condition for which there is no commensurate Condition in the standard TS. The Condition exists to reflect the unique design of the H2O2 Analyzer penetrations at SSES. A Risk Informed Completion Time (RICT) is not proposed to be applied to Required Action D.1, and the phrase following isolation is proposed to be added to the Completion Time for Required Action D.2 for consistency with the remainder of TS 3.6.1.3.

The following discussion should have been included in Attachment 1, Section 2.3 of Reference 1.

Susquehanna proposes to make a change to the Completion Time for TS 3.6.1.3, Required Action D.2. Currently, the Required Action is to Verify the affected penetration flow path is isolated with a Completion Time of Once per 31 days. Susquehanna is proposing to revise the Completion Time to Once per 31 days following isolation; i.e., to add the phrase following isolation to the end of the Completion Time. The proposed change is consistent with changes proposed to the Completion Times of Required Actions A.2 and C.2 of TS 3.6.1.3.

The change was necessary for the Completion Time for Required Action A.2 to account for the

Enclosure 1 to PLA-7984 Page 2 of 105 ability to use a RICT in Required Action A.1. By adding the flexibility to use a RICT to determine a time to isolate the penetration as required by Required Action A.1, the periodic verification in Required Action A.2 must then be based on the time "following isolation." A RICT cannot be applied to Required Action C.1, but the same change is made to the Completion Time for Required Action C.2 for consistency with the Completion Time for Required Action A.2 in TSTF-505. Susquehanna proposes to make the same change to the Completion Time for Required Action D.2 for consistency with the Completion Times for Required Actions A.2 and C.2.

Because a RICT cannot be applied to Required Action D.1, the isolation of the penetration must always occur within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of identifying inoperable PCIVs. Thus, the proposed change would allow at most a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months extension prior to the first performance of Required Action D.2, which is less than the potential 30 day extension allowed for the initial performance of Required Action A.2, as approved by TSTF-505. Additionally, the potential 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months extension prior to the first performance of Required Action D.2 is less than the 186 hour0.00215 days 0.0517 hours 3.075397e-4 weeks 7.0773e-5 months extension allowed for all subsequent performances of Required Action D.2 per Surveillance Requirement 3.0.2. Further, operations policy statements and procedures provide guidance for equipment control throughout the plant and require use of status change mechanisms for any component manipulations. Thus, components are not expected to be found in a state other than the ones in which they are left, thereby providing confidence that the maximum additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to perform the initial verification in Required Action D.2 will not result in anything other than satisfactorily demonstrating the penetration flow path remains isolated.

Audit Question Q-002 EITHER:

Confirm that F&O [Fact & Observation Finding] 1-18 has been resolved by showing that Susquehanna has (1) reviewed and updated the list of internal events PRA [Probabilistic Risk Assessment] modeling assumptions and sources of uncertainty based on the disposition of the 2020 F&O closure review team, (2) provided dispositions that are specific to this application, and (3) addressed, in accordance with NEI [Nuclear Energy Institute (NEI) Topical Report]

06-09, Revision 0-A, any assumptions or sources of uncertainty determined to be potentially key to this application (e.g., performed a sensitivity study demonstrating that they have an inconsequential impact on the risk-informed completion time (RICT) calculations, or identified programmatic changes to compensate for this modeling uncertainty). Also, confirm whether Report EC-RISK-0056, Assessment of Key Assumptions and Sources of Uncertainty for Risk-Informed Applications (dated February 08, 2021), which predates the TSTF-505 LAR dated April 8, 2021, represents the review update of the internal events PRA uncertainty analysis.

OR:

Enclosure 1 to PLA-7984 Page 3 of 105 If the licensee cannot confirm that F&O 1-18 has been resolved per the above, then explain how the licensee will ensure (e.g., via a license condition or an implementation requirement), prior to implementation of the Risk-Managed Technical Specifications (RMTS) program, that it will:

(1) review and update the list of internal events PRA modeling assumptions and sources of uncertainty, (2) update the associated dispositions that are specific to this application, and (3) fully address any impacts on the RMTS program (including those determined to be key for this application) in accordance with NEI 06-09, Revision 0-A.

Susquehanna Response The Full Power Internal Events (FPIE) F&O 1-18 was closed during the 2021 F&O Closure Review Meeting which was performed in accordance with the NEI Appendix X Process (Reference 61). Susquehanna document NQPA-B-NA-012, (Reference 5), provides the response to F&O 1-18. Appendix B of NQPA-B-NA-012 outlines the review of SSES FPIE assumptions, and sources of uncertainty.

Audit Question Q-003

a. Describe how the plant configurations (i.e., TS LCO conditions) were chosen in the sensitivity studies to assess the impact of potential key assumptions and sources of uncertainty. Also include in this discussion the bases for selecting these plant configurations.

b. Justify how the process described in part (a), above, is sufficient to conclude that, based on the sensitivity study RICT estimates, the impact of the associated modeling uncertainty on the RICT calculations is inconsequential.

Susquehanna Response Question 3.a Where applicable, the plant configurations (i.e., TS LCO conditions) were chosen based on the safety function that the system in question supported and what LCOs would likely have elevated importance values given the issue in question. If the source of uncertainty was not directly tied with a system, then a variety of TS LCO conditions were chosen. The sensitivity analyses included an examination of the base case results as well as the results of the impact on the RICT values for the chosen TS LCO conditions. Table Q3-1 provides more information about the selected TS LCO conditions explored for the sensitivity cases.

Enclosure 1 to PLA-7984 Page 4 of 105 Table Q3-1 Basis for Chosen TS LCO Conditions Sensitivity Description Chosen LCO Conditions Case 1 Room heatup TS LCO Conditions were chosen based on relationship calculations with the ESSW pumphouse equipment (Emergency (Emergency Service Water (ESW) and Residual Heat Removal Safeguard Service Service Water (RHRSW)). This included Residual Heat Water (ESSW) Removal (RHR) suppression pool cooling, an RHRSW pumphouse subsystem, one diesel generator (DG), and an ESW ventilation with doors subsystem.

open) 2 Vapor suppression Representative TS LCO Conditions were chosen to capabilities at vessel explore a range of cases that might be susceptible to the failure calculated Large Early Release Frequency (LERF) values that would be impacted by this source of uncertainty. This included Reactor Protection System (RPS), Emergency Core Cooling System (ECCS)

Instrumentation, one low pressure ECCS system, High Pressure Coolant Injection (HPCI), Reactor Core Isolation Cooling (RCIC), and one DG.

3 Control Rod Drive TS LCO Conditions were selected to explore a range of (CRD) injection cases that might be susceptible to loss of containment capability after heat removal scenarios that would be impacted by this containment failure source of uncertainty. This included suppression pool cooling, RHRSW, ESW, and one DG. These systems were deemed to be more risk significant given an increase in the likelihood that the containment failure size disrupts the capability to inject with CRD.

4 Potential for TS LCO Conditions were selected to explore a range of inadvertent flooding cases that might be susceptible to loss of Reactor of steam lines to fail Pressure Vessel (RPV) depressurization capabilities that the Safety Relief would be impacted by this source of uncertainty. This Valves (SRVs) included HPCI, RCIC, and suppression pool cooling.

These systems were deemed to be more risk significant given an increase in the likelihood that the SRVs fail given inadvertent flooding of the steam lines.

Enclosure 1 to PLA-7984 Page 5 of 105 Table Q3-1 Basis for Chosen TS LCO Conditions Sensitivity Description Chosen LCO Conditions Case 5 Potential for TS LCO Conditions were selected to explore a range of inadvertent flooding cases that might be susceptible to loss of HPCI or RCIC of steam lines to fail that would be impacted by this source of uncertainty.

HPCI and RCIC This included HPCI, RCIC, one DG, and an ESW subsystem. These systems were deemed to be more risk significant given an increase in the likelihood that HPCI or RCIC fail given inadvertent flooding of the steam lines.

6 Portable Equipment TS LCO Conditions were selected to explore a range of Reliability cases that might be susceptible to loss of the portable equipment that would be impacted by this source of uncertainty. This included HPCI, suppression pool cooling, one or two offsite Alternating Current (AC) power circuits, one DG, and also the combination of one offsite circuit and a DG. These systems were deemed to be more risk significant given an increase in the failure probabilities associated with the portable equipment credited in the model.

Question 3.b The process which included an examination of the changes to the base case results as well as changes to judiciously selected sample TS LCO conditions is consistent with the guidance in NEI 06-09, Revision 0-A, (Reference 8) which indicates the following with respect to the performance of sensitivity studies:

Although this assessment is not intended to be exhaustive, the general guidance should be that the impact of the key modeling uncertainties and associated key assumptions is limited when reasonable alternate modeling assumptions do not result in significant increases to plant risk.

Based on the results presented and discussed in EC-RISK-0056 (Reference 6) and the revised results for the ESSW pumphouse ventilation in response to audit question Q-004, the impact of the associated sources of uncertainty do not warrant any additional Risk Management Actions (RMAs) for RICT implementation.

Enclosure 1 to PLA-7984 Page 6 of 105 Audit Question Q-004 EITHER:

Report the results of a sensitivity study in which the increase in the operator failure probability in the sensitivity case is set low enough that it is not unrealistic but high enough that it tests the modeling uncertainty to demonstrate that this modeling uncertainty is not key for the RMTS program and has an inconsequential impact on the RICT calculations. Also, describe this sensitivity study and justify the appropriateness of the selected operator failure probability used in the sensitivity case. Provide the bases for the chosen plant configurations (i.e., TS LCO conditions) in this sensitivity study.

OR:

Describe the programmatic changes to compensate for this modeling uncertainty and the basis for them (e.g., identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty). This discussion should also identify the TS LCO conditions in scope of RMTS for which the RICT calculations are impacted by this uncertainty and discuss how the RICTs are impacted (e.g., describe and provide the results of applicable sensitivity studies). If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A; and (2) provide RMA examples that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty, and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

OR:

Provide a detailed justification (e.g., propose an implementation item to update the PRA to address this modeling uncertainty and discuss how this update addresses this uncertainty; describe and provide the results of a different type of sensitivity study) that this modeling uncertainty does not need to be addressed in the RMTS program as required by Section 2.3.4 of NEI 06-09-A.

Susquehanna Response Additional sensitivity studies were performed to assess the impact of uncertainty associated with the operator action to open the pump house doors. A factor of 3x was chosen as a reasonably conservative value for the dependent and independent human error probabilities (HEPs) (i.e., set low enough that it is not unrealistic but high enough that it tests the modeling uncertainty). A factor of three is appropriate as a sensitivity value because it is representative of

Enclosure 1 to PLA-7984 Page 7 of 105 the change in reliability between a mean value and an upper bound (95th percentile) for typical reliability distributions. For example, for a lognormal distribution the ratio of the 95th percentile to the mean value would be approximately 2.4 for an error factor of 3 and 3.5 for an error factor of 10.

TS LCO Conditions were selected to explore a range of cases that might be susceptible to the operator action for opening the pumphouse doors. This included RHR suppression pool cooling, an RHRSW subsystem, an ESW subsystem, and one DG. These systems were deemed to be more risk significant given an increase in the HEP for opening the ESSW Pumphouse doors. The changes to the operator action for the sensitivity cases are shown in Table Q4-1.

The results are summarized in Table Q4-2.

Table Q4-1 Pumphouse Ventilation Operator Actions Sensitivity Basic Event Description Base Value Value 016-N-N-VENT-O Operator Fails to Open ESSW 1.16E-03 3.48E-03 (FPIE Model) Pumphouse for RHRSW Ventilation 016-N-N-VENT-OF Operator Fails to Open ESSW 1.09E-02 3.27E-02 (FPRA Model) Pumphouse for RHRSW Ventilation 016-N-N-VENT-O Operator Fails to Open ESSW 1.20E-03 3.60E-03 (Flood Model) Pumphouse for RHRSW Ventilation Various Multiple dependent HEPS involving Various All set to 3x 016-N-N-VENT-O or 016-N-N- base value VENT-OF

Enclosure 1 to PLA-7984 Page 8 of 105 Table Q4-2 Pumphouse Ventilation Human Error Probability Sensitivity RICT Estimate Results Base Model Sensitivity Percent Percent RICT RICT TS TS/LCO Condition Change for Change for Estimate Estimate Total CDF Total LERF (days) (days) 3.6.2.3.A One RHR suppression 30 30 2.2% 0.5%

pool cooling subsystem inoperable 3.7.1.B One RHRSW 30 30 1.7% 0.5%

subsystem inoperable 3.7.2.C One ESW subsystem 2.7 2.6 1.3% 0.2%

inoperable 3.8.1.B One DG inoperable 30 30 25.7% 10.5%

As can be seen in Table Q4-2, the RICTs are not very sensitive to the assumed pumphouse ventilation HEP values. Most of the cases resulted in no more than about 1 percent change in the total Core Damage Frequency (CDF) and LERF values and either no or very small change to the calculated RICT values. TS 3.8.1, Condition B showed the largest increase, but this case had calculated RICTs from CDF much greater than the backstop of 30 days and were more limited by the total LERF value. That is, the calculated RICT for TS 3.8.1, Condition B went from 41.4 to 33.3 days. As such, this is not judged to be significant given the conservative nature of this sensitivity study.

Based on the results of the sensitivity studies described above, the pumphouse ventilation HEP is not identified as a key source of uncertainty for the RICT Program. Additionally, as noted in 2 of Reference 1, RMAs will be informed by the Real-Time Risk (RTR) tool, station procedures, and other information to help identify configuration-specific RMA candidates to manage the risk associated with internal events, internal flooding, and fire events. These RMAs can include the identification of important operator actions for incorporation into briefings when they are significant to the configuration.

Audit Question Q-005 Describe the FLEX [Diverse and Flexible Coping Strategies] strategies credited for the internal events (including internal flooding) and fire PRA models.

Susquehanna Response There are three high level FLEX strategies credited in the FPIE and Fire PRA (FPRA) models.

This includes aligning two of the three turbine marine generators to the Engineered Safeguard

Enclosure 1 to PLA-7984 Page 9 of 105 System (ESS) 4160 VAC buses, venting containment via the Hardened Containment Vent System (HCVS), and providing extended RPV injection via RCIC with eventual transition to portable pumper truck injection. Each of these are discussed in turn.

Alignment of Turbine Marine Generators The alignment of the FLEX turbine marine generators is dictated by Susquehanna procedure DC-FLEX-010 (Reference 9). The purpose of DC-FLEX-010 is to provide instructions to supply 4160 VAC power to the eight ESS buses (1A201, 1A202, 1A203, 1A204, 2A201, 2A202, 2A203, and 2A204) within six hours after an Extended Loss of AC Power (ELAP) is declared.

The procedure connects temporary turbine marine generators to the DG and ESS bus to energize the Class 1E 480 VAC electrical distribution system and repower the Class 1E battery chargers.

Note that electrical alignments, load shedding, and fuel oil strategy deployment and assembly are performed in parallel with FLEX electrical equipment deployment. Success of this strategy involves Direct Current (DC) load shed, deployment & alignment of the turbine marine generators, AC load shedding, and refueling the turbine marine generators.

Venting Containment via HCVS Venting containment through the HCVS is dictated by Susquehanna procedures ES-173-007 and ES-273-007, for Units 1 and 2, respectively (References 10 and 11). This procedure is used to vent the suppression chamber through the HCVS. Success of this flowpath vents the drywell through the suppression pool and out of the HCVS directly outside of secondary containment.

This vent path is available in a Station Blackout (SBO) and is the preferred vent path in an ELAP or a Beyond Design Bases Event. This is also the preferred vent path for anticipatory venting in an ELAP event.

Extended RPV Injection The FLEX strategy for RPV injection includes initial injection from RCIC. Extended RCIC operation requires successful alignment of the turbine marine generators to provide power to the Class 1E battery chargers as described above such that DC power remains available to RCIC.

Extended RCIC operation with suction from the suppression pool also requires alignment of the portable pumper truck to provide lube oil cooling. For Unit 1, this action is directed by DC-FLEX-101 (Reference 12); the commensurate Unit 2 procedure is DC-FLEX-201 (Reference 13). Long term success requires eventual transition of RPV injection to a low-pressure system (i.e., portable pumper truck, but this function can also be provided by the installed diesel driven fire pump). Transition to the low-pressure injection system also requires that RPV pressure be reduced to between 150-300 psig while RCIC is operating and prior to depressurizing further to allow low pressure injection to provide inventory makeup.

Enclosure 1 to PLA-7984 Page 10 of 105 Audit Question Q-006 Identify the FLEX equipment credited and whether that equipment is portable or permanently installed, and:

a. Discuss whether the credited FLEX equipment (regardless of whether it is portable or permanently installed) is similar to other plant equipment credited in the PRA (e.g., systems, structures, and components (SSCs) with sufficient plant-specific or generic industry data).

b. For credited FLEX equipment that is not similar to other plant equipment credited in the PRA:

i. Discuss the data and failure rates used to support its modeling and provide the rationale for using the chosen data and any conservative adjustments that were made to the generic reliability values for similar equipment. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS [American Society of Mechanical Engineers / American Nuclear Society] PRA Standard, as endorsed by RG [Regulatory Guide] 1.200, Revision 2.

ii. Describe the sensitivity study performed to assess the impact of uncertainty associated with equipment failure probabilities on calculated RICTs and present the results of that study. Justify how the increase in equipment failure probabilities used in the sensitivity case constitutes bounding realistic estimates. Also, discuss the bases for the chosen TS LCO conditions in the sensitivity study. Because the 30-day RICT back-stop condition could mask the impact of this uncertainty in the sensitivity study, discuss whether the RICTs for plant configurations involving more than one LCO entry (e.g., where the calculated RICTs are less than the 30-day backstop) are significantly impacted by this uncertainty.

iii. Discuss whether the uncertainty associated with equipment failure probabilities is a key source of uncertainty for the RMTS program. If this uncertainty is key, then describe and provide a basis for how this uncertainty will be addressed in the RMTS program (e.g., programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty).

If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A; and (2) for those TS LCOs in LAR Enclosure 12 (Risk Management Action Examples) that are significantly impacted by this uncertainty, provide updated RMAs that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty, and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

Enclosure 1 to PLA-7984 Page 11 of 105 Susquehanna Response Question 6.a The credited FLEX equipment includes the 4160 VAC turbine marine generators, the HCVS, and the pumper truck. The unique equipment reliability values are based on similarities to other equipment. The 4160 VAC turbine marine generators are assumed to be similar to the DGs, the HCVS did not introduce any unique component types, and pumper truck is assumed to be similar to diesel driven pumps.

Question 6.b.i The data and failure rates for the turbine marine generators and pumper truck are shown in Table Q6-1. A factor of 2x the data for similar component types was judged as reasonably conservative until more appropriate generic data becomes available. A lognormal distribution with an error factor of 5 is assumed for these type codes which is sufficient to meet the PRA standard for these non-risk significant component types.

Table Q6-1 FLEX Equipment Type Codes Type Description Basis Failure Code Rate DGT 1 Start and Run Failure Rate for FLEX 4160 2 x [(DGS + 23 x (DGR)] 5.37E-02 V Turbine Generators 2 x [7.4E-3 + 23 x 8.5E-4]

PTT 2 Start and Run Failure Rate for Fire 2 x [(DDP + 23 x (DDR)] 1.53E-02 Protection Pumper Truck 2 x [5.5E-3 + 23 x 9.5E-5]

1. Start and run failure rate for turbine marine generators.

2. Start and run failure rate for fire protection pumper truck.

Question 6.b.ii Additional sensitivity studies were performed to assess the impact of uncertainty associated with the FLEX equipment failure probabilities on calculated RICTs. A factor of 5x was chosen as a very conservative bounding value for the FLEX portable equipment failure probabilities. TS LCO Conditions were selected to explore a range of cases that might be susceptible to the FLEX portable equipment reliability values. This included HPCI, RHR suppression pool cooling, one offsite AC power circuit, one DG, and the combination of one offsite circuit and a DG.

Sensitivity studies were also included for additional select LCO combinations that have RICTs

Enclosure 1 to PLA-7984 Page 12 of 105 less than 30 days. This included one Automatic Depressurization System (ADS) valve and one Core Spray (CS) Loop, one ESW pump in each subsystem, and two offsite AC power circuits.

The results are summarized in Table Q6-2.

As can be seen in Table Q6-2, the RICT Completion Times are not very sensitive to the assumed FLEX equipment reliability values. Most cases resulted in less than a five percent change in the total CDF and LERF values and either no or very small change to the calculated RICT values.

Two cases were slightly above five percent (i.e., LCO 3.8.1, Conditions B and D) but both of these cases were above the backstop RICT value of 30 days. One case (LCO 3.8.1, Condition C) did impact the calculated RICT value by a little more than ten percent, but this is judged not be significant considering the TS Condition and the very bounding nature of the sensitivity study.

Table Q6-2 FLEX Equipment Reliability Sensitivity RICT Estimate Results Base Model Sensitivity Percent Percent RICT RICT Change for Change for TS TS/LCO Condition Estimate Estimate Total CDF Total LERF (days) (days) 3.5.1.D HPCI system inoperable 30 30 2.3% 0.0%

3.5.1.G One ADS valve and 10.2 10.2 0.4% 0.0%

Condition A (i.e., one CS Loop) 3.6.2.3.A One RHR suppression 30 30 2.9% 0.0%

pool cooling subsystem inoperable 3.7.2.A One ESW Pump in 3.7 3.7 2.4% 0.8%

Each Subsystem 3.8.1.A One offsite AC power 30 30 4.3% 0.3%

circuit inoperable 3.8.1.B One DG inoperable 30 30 7.2% 0.1%

3.8.1.C Two or more offsite AC 6.8 6.0 13.1% 2.2%

power circuits inoperable 3.8.1.D One offsite AC power 30 30 7.4% 0.2%

circuit AND one DG inoperable

Enclosure 1 to PLA-7984 Page 13 of 105 Question 6.b.iii Based on the results of the sensitivity studies described above, the FLEX equipment reliability values are not identified as a key source of uncertainty for the RICT Program.

Audit Question Q-007

a. Identify the FLEX operator actions credited in the PRA and discuss whether any of these operator actions contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06.

b. For credited operator actions related to FLEX equipment that contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06:

i. Describe the sensitivity study performed to assess the impact of uncertainty associated with FLEX HEPs (both the FLEX independent and dependent HEPs) on calculated RICTs and present the results of that study. Justify how the increase in the FLEX HEPs used in the sensitivity case constitutes bounding realistic estimates. Also, discuss the bases for the chosen TS LCO conditions in the sensitivity study. Because the 30-day RICT back-stop condition could mask the impact of this uncertainty in the sensitivity study, discuss whether the RICTs for plant configurations involving more than one LCO entry (e.g., where the calculated RICTs are less than the 30-day backstop) are significantly impacted by this uncertainty.

ii. Discuss whether the uncertainty associated with FLEX HEPs is a key source of uncertainty for the RMTS program. If this uncertainty is key, then describe and provide a basis for how this uncertainty will be addressed in the RMTS program (e.g., programmatic changes such as identification of additional RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty).

If the programmatic changes include identification of additional RMAs, then (1) describe how these RMAs will be identified prior to the implementation of the RMTS program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A; and (2) for those TS LCOs in LAR Enclosure 12, Risk Management Action Examples, that are significantly impacted by this uncertainty, provide updated RMAs that may be considered during a RICT program entry to minimize any potential adverse impact from this uncertainty, and explain how these RMAs are expected to reduce the risk associated with this uncertainty.

Enclosure 1 to PLA-7984 Page 14 of 105 Susquehanna Response Question 7.a The credited FLEX operator actions are listed below in Table Q7-1. Three of the actions (013-PUMPER-TRUCK-O, 024-ELAP-O, and 150-LUBE_COOLER-O) do include some of the types of steps described in Sections 7.5.4 and 7.5.5 of NEI 16-06 (Reference 14). The operator actions related to use of the HCVS (173-HCVS-CR-O and 173-HCVS-ROS-O) do not include any of the types of steps described in Sections 7.5.4 and 7.5.5 of NEI 16-06. The values listed in Table Q7-1 are for the FPIE PRA model and for the FPRA model.

Table Q7-1 FLEX Operator Actions Basic Event Description FPIE Value FPRA Value 013-PUMPER-TRUCK-O Operators Fail to Implement DC- 1.68E-02 1.68E-02 B5B-102/202 for Pumper Truck Injection 024-ELAP-O [Note 1] Operator Fails to Align the 8.85E-02 8.39E-02 Turbine Marine Generators 150-LUBE_COOLER-O Operators Fail to Implement DC- 4.19E-02 4.83E-02 FLEX-101 (RCIC Lube Oil Cooling and Ventilation) 173-HCVS-CR-O Operator Fails to Vent w/ HCVS 6.92E-03 7.92E-03 from the Control Room 173-HCVS-ROS-O Operator Fails to Manually Vent 7.02E-03 9.05E-03 w/ HCVS from the Remote Operating Station

1. There was an execution recovery dependence factor (DF) for a subtask within the fire version of the operator action to align the Turbine Marine Generators for FLEX conditions (024-ELAP-OF) that was different than the FPIE version (024-ELAP-O). When that DF is set to the same value in both versions, the FPIE and FPRA values agree exactly. The DF from the FPIE version will be maintained in both versions moving forward (this action is being tracked via Susquehanna Risk Model Impact Evaluation 20211110-002, and Susquehanna action DPA-73-DI-2019-11506). However, there is minimal impact on the HEP values used and this discrepancy would not materially impact the results of the base FPRA or the results of the sensitivity studies provided below.

Enclosure 1 to PLA-7984 Page 15 of 105 Question 7.b.i Additional sensitivity studies were performed to assess the impact of uncertainty associated with the FLEX portable equipment HEPs on calculated RICTs. A factor of 3x was chosen as a reasonably conservative bounding value for the dependent and independent HEPs. Consistent with the guidance in NEI 04-10 (Reference 15), a factor of three is appropriate as a sensitivity value because it is representative of the change in reliability between a mean value and an upper bound (95th percentile) for typical reliability distributions. For example, for a lognormal distribution the ratio of the 95th percentile to the mean value would be approximately 2.4 for an error factor of 3 and 3.5 for an error factor of 10. TS LCO Conditions were selected to explore a range of cases that might be susceptible to the FLEX portable equipment HEP values. This included HPCI, RHR suppression pool cooling, one offsite AC power circuit, one DG, and the combination of one offsite circuit and a DG. Sensitivity studies were also included for additional select LCO combinations that have RICTs less than 30 days. This included one ADS valve and one CS Loop, one ESW pump in each subsystem, and two offsite AC power circuits. The results are summarized in Table Q7-2.

Table Q7-2 FLEX Human Error Probability Sensitivity RICT Estimate Results Base Model Sensitivity Percent Percent RICT RICT Change Change TS TS/LCO Condition Estimate Estimate for Total for Total (days) (days) CDF LERF 3.5.1.D HPCI system inoperable 30 30 2.2% 0.4%

3.5.1.G One ADS valve and 10.2 10.2 0.4% 0.1%

Condition A (i.e., one CS Loop) 3.6.2.3.A One RHR suppression pool 30 30 2.8% 0.3%

cooling subsystem inoperable 3.7.2.A One ESW Pump in Each 3.7 3.7 2.1% 1.1%

Subsystem 3.8.1.A One offsite AC power 30 30 4.2% 0.6%

circuit inoperable 3.8.1.B One DG inoperable 30 30 6.4% 0.4%

3.8.1.C Two or more offsite AC 6.8 6.1 11.2% 2.1%

power circuits inoperable 3.8.1.D One offsite AC power 30 30 6.6% 0.4%

circuit AND one DG inoperable

Enclosure 1 to PLA-7984 Page 16 of 105 As can be seen in Table Q7-2, the RICT Completion Times are not very sensitive to the assumed FLEX HEP values. Most of the cases resulted in less than a five percent change in the total CDF and LERF values and either no or very small change to the calculated RICT values. TS 3.8.1, Conditions B and D had calculated RICTs much greater than the backstop of 30 days and were limited by the LERF value such that it also had negligible impact. TS 3.8.1, Condition C did result in about a ten percent reduction in the RICT value, but this is not judged to be significant given the conservative nature of this sensitivity study.

Question 7.b.ii Based on the results of the sensitivity studies described above, the FLEX portable equipment HEP values are not identified as a key source of uncertainty for the RICT Program.

Additionally, as noted in Enclosure 12 of Reference 1, RMAs will also be informed by the RTR tool, station procedures, and other information to help identify configuration-specific RMA candidates to manage the risk associated with internal events, internal flooding, and fire events.

These RMAs can include the identification of important operator actions for incorporation into briefings when they are significant to the configuration.

Audit Question Q-008 Given the challenges of modeling FLEX mitigation strategies, explain whether the review of the FLEX modeling was included in the last peer review of the PRA models. If it was not, then justify how the model changes associated with incorporating FLEX mitigating strategies does not constitute a PRA upgrade as defined in Section 1-2 of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2.

Susquehanna Response The last full peer review of the Susquehanna PRA models was performed for the FPRA model in early 2018 (Reference 16). It is noted in Section 1 of that report:

Additionally, to account for procedural and hardware changes associated with EPG/SAG

[Emergency Procedure Guideline / Severe Accident Guideline], Revision 3, and mitigating strategies involving FLEX equipment and installation of a Hardened Containment Vent System (HCVS) at SSES, an OCT17 model was created, which is the starting point for the Fire PRA model.

Therefore, the FLEX modeling was included in the last peer review of the PRA models.

In any event, additional information is also provided to support that incorporating the FLEX mitigation strategies does not constitute an upgrade for SSES.

Enclosure 1 to PLA-7984 Page 17 of 105 Incorporation of FLEX into the SSES PRA model is a reflection of plant modifications and procedure changes. Updating the model to reflect such a change is necessary to maintain the model as representative of the as-built, as-operated plant. Accident sequences progress in the same manner as before, except there is the possibility of extended time for power to be available and alternate injection sources. Risk estimation capability is not changed, all FLEX system implementations were made utilizing the existing PRA methodology.

The model changes associated with incorporating FLEX mitigating strategies and their disposition regarding (1) new methodology, (2) change in scope and (3) change in capability are noted in Table Q8-1.

The term new method used in this disposition is consistent with Table A-1 of RG 1.200, Revision 2 (Reference 17).

The Scope attribute is defined consistent with Section C of RG 1.200, i.e., The scope of the PRA ...is defined in terms of (1) the metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

Consistent with concepts in RG 1.200, as well as the basis for Capability Category (CC) distinctions in the PRA Standard, the term capability used in this disposition is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the CC (from Not Met or CC-I to CC-II) for one or more Supporting Requirements (SRs).

Enclosure 1 to PLA-7984 Page 18 of 105 Table Q8-1 Summary of FLEX Model Changes in the SSES PRA Change Significant New Change in PRA Model in Impact on Method Capability Comment Change (1) Scope (3) Sequences (2) (4)

Alignment No No No --- The SSES modeling of the 4160 VAC buses was of Turbine modified to include the required equipment and operator Marine actions necessary to align the FLEX turbine marine Generators generators to supply 4160 VAC power to the eight ESS buses (1A201, 1A202, 1A203, 1A204, 2A201, 2A202, 2A203, and 2A204) within six hours. Failure rate values for new equipment is described in response to Q-006. All the HEPs for FLEX components were evaluated with the same methodology used for all HEPs in the SSES PRA models as documented in the SSES Human Reliability Analysis (HRA) notebook (Reference 18).

No new methods were employed. The scope of the model remains identical and no change in the CCs for any SR apply.

Venting No No No --- This is an edit to the existing fault tree logic for Containment containment venting and corresponding top logic in the via the event trees.

HCVS No new methods were employed. The scope of the model remains identical and no change in the CCs for any SR apply.

Extended No No No --- The fault tree and event tree logic were adjusted to allow RPV extended RCIC operation. This requires successful Injection alignment of the turbine marine generators to provide power to the Class 1E battery chargers as described above such that DC power remains available to RCIC.

Extended RCIC operation with suction from the suppression pool also requires alignment of the portable pumper truck to provide lube oil cooling. Long term success requires eventual transition of RPV injection to a low pressure system (i.e., portable pumper truck, but this function can also be provided by the installed diesel driven fire pump). Transition to the low pressure injection system also requires that RPV pressure be reduced to between 150-300 psig while RCIC is operating and prior to depressurizing further to allow low pressure injection to provide inventory makeup.

No new methods were employed. The scope of the model remains identical and no change in the CCs for any SR apply.

Table Notes

1. New Method: Consistent with Table A-1 of RG 1.200, Revision 2, the term new method refers to an analysis method (i.e., not documentation method) that is new to the subject PRA even if the method itself is not new and has been applied in other PRAs. This term also

Enclosure 1 to PLA-7984 Page 19 of 105 encompasses newly developed methods in the industry that have been implemented in the base PRA in question.

2. Change in Scope: Consistent with Section C of RG 1.200, Revision 2, the term PRA scope is defined in terms of the following three attributes:

The metrics used to characterize risk, (2) the plant operating states for which the risk is to be evaluated, and (3) the causes of initiating events (hazard groups) that can potentially challenge and disrupt the normal operation of the plant and, if not prevented or mitigated, would eventually result in core damage and/or a large release.

3. Change in Capability: Consistent with concepts in RG 1.200, Revision 2 as well as the basis for CC distinctions in the PRA Standard, this term is defined in terms of degree of analysis detail and plant-specific realism. Implementation of this criterion in the context of determining whether a specific PRA change represents an upgrade is whether the change would increase the CC (from Not Met or CC-I to CC-II) for one or more SRs.

4. Impact on Significant Accident Sequences or Significant Accident Progression Sequences:

This term encompasses both Level 1 (core damage) and Level 2 (post-core damage) accident sequences. This criterion is interpreted in this context of PRA Upgrade as the top 95 percent of sequences and whether the makeup of those sequences have been significantly impacted. Whether the makeup of the top 95 percent of the sequences is determined to be significantly impacted is based on a qualitative consideration as to whether the change in the sequences would likely change decision making when applying the PRA in risk applications.

For example, top sequences in the top 95 percent that for the model change drop out of the top 95 percent would be a case where justification should be provided as to why the change in question is not considered an upgrade or it should be identified as an upgrade. NOTE: Per the ASME PRA Standard Addenda A and RG 1.200, Revision 2 definition of PRA upgrade, this criterion is logically ANDed with the other criteria of first having to be a change in scope or a change in capability.

Audit Question Q-009

a. Provide a summary of how the SOKC [State of Knowledge Correlation] was performed for the base Susquehanna PRA models used to support the RMTS application. Provide and discuss the results of this SOKC investigation and whether the SOKC uncertainty has a significant impact on the RICT calculations.

b. Provide and discuss the results of a comparison study between the RICT values calculated using point estimate risk versus mean risk for various LCO conditions in scope of RMTS.

The LCO conditions selected for this comparison study should have a point estimate RICT

Enclosure 1 to PLA-7984 Page 20 of 105 less than 30 days (i.e., the 30-day backstop does not mask the comparison results), and are considered most likely to be impacted by the SOKC uncertainty (i.e., point estimate RICT versus mean RICT). Provide the bases for the chosen LCO conditions in this comparison study. Also, provide the intermediate risk results from these RICT calculations (e.g., the CDFs and LERFs for the baseline case using point estimates and sensitivity case using mean values from the FPIE, Internal Flooding PRA (IFPRA), and FPRA).

c. Based on the results above, provide a summary of how the SOKC will be addressed for RICT calculations during RMTS implementation (i.e., based upon the risk metrics to be considered), and explain how this process/approach is consistent with NUREG-1855, Revision 1.

Susquehanna Response Question 9.a:

The base Susquehanna PRA models evaluate SOKC uncertainties via Monte Carlo sampling using the UNCERT software. Although the mean CDF and LERF values derived via Monte Carlo sampling are indeed higher than the corresponding base case point estimate CDF and LERF values, the RICT Program is minimally impacted due to the fact that it is a delta type application (i.e., acceptability is based on the difference between a base model and a model with equipment unavailable). That is to say that both the base results and the configuration-specific results would increase by using the mean values (rather than the point estimates), but the delta calculations would be minimally impacted. The sensitivity analysis on the RICT program is discussed in part (b) of this response.

Question 9.b:

As a sensitivity, the delta risk was evaluated for point estimate and mean values for representative TS conditions. The cases were chosen to cover a variety of TS conditions which would be less than 30 days. Monte Carlo simulation was then used with 50,000 samples to calculate the corresponding mean values. Table Q9-1 provides the overview results of these calculations which show that the delta-risk results using mean and point estimate values are very similar and are not significant to the RICT Program (i.e., less than 0.5-day change for each sampled case). Table Q9-2 provides the intermediate results of the calculations that support Table Q9-1 (i.e., the CDFs and LERFs for the baseline case using point estimates and sensitivity case using mean values from the FPIE, IFPRA, and FPRA).

Enclosure 1 to PLA-7984 Page 21 of 105 Table Q9-1 Summary of Mean vs Point Estimate Results CDF LERF CDF LERF Point Point Propagated Propagated Estimate Estimate Mean (/yr) Mean (/yr)

(/yr) (/yr)

Base Result 4.32E-05 4.52E-05 5.15E-06 5.25E-06 TS 3.3.5.1.B Instrumentation ECCS - As required by Required Action A.1 TS Result 7.99E-05 7.93E-05 3.75E-05 3.64E-05 Delta 3.67E-05 3.41E-05 3.23E-05 3.12E-05

% Increase in Delta n/a -7.1% n/a -3.5%

RICT (days) 30.0 30.0 11.3 11.7 TS 3.5.1.A One Low Pressure ECCS Subsystem Inoperable TS Result 5.43E-04 5.45E-04 2.12E-05 2.10E-05 Delta 5.00E-04 5.00E-04 1.60E-05 1.58E-05

% Increase in Delta n/a 0.0% n/a -1.6%

RICT (days) 7.3 7.3 22.8 23.2 TS 3.5.1.G One ADS Valve and Condition A (e.g., One CS Loop)

TS Result 4.03E-04 3.99E-04 3.54E-05 3.54E-05 Delta 3.59E-04 3.54E-04 3.03E-05 3.01E-05

% Increase in Delta n/a -1.6% n/a -0.5%

RICT (days) 10.2 10.3 12.1 12.1 TS 3.7.2.A One ESW Pump in Each Subsystem TS Result 1.02E-03 1.02E-03 2.18E-05 2.21E-05 Delta 9.77E-04 9.76E-04 1.66E-05 1.68E-05

% Increase in Delta n/a -0.1% n/a 1.3%

RICT (days) 3.7 3.7 22.0 21.7 TS 3.8.1.C Two Offsite Circuits Inoperable TS Result 5.80E-04 5.99E-04 2.75E-05 2.81E-05 Delta 5.37E-04 5.54E-04 2.24E-05 2.29E-05

% Increase in Delta n/a 3.2% n/a 2.0%

RICT (days) 6.8 6.6 16.3 16.0

Enclosure 1 to PLA-7984 Page 22 of 105 Table Q9-2 Details of Mean vs Point Estimate Results CDF LERF CDF LERF Point Point Propagated Propagated Estimate Estimate Mean (/yr) Mean (/yr)

(/yr) (/yr)

FPIE Base 1.23E-06 1.54E-06 2.46E-07 3.29E-07 FPRA Base 4.11E-05 4.28E-05 4.70E-06 4.71E-06 IFPRA Base 8.90E-07 8.91E-07 2.06E-07 2.06E-07 Total Base 4.32E-05 4.52E-05 5.15E-06 5.25E-06 TS 3.3.5.1.B Instrumentation ECCS - As required by Required Action A.1 FPIE Result 1.29E-06 1.60E-06 2.46E-07 3.05E-07 FPRA Result 7.60E-05 7.51E-05 3.65E-05 3.54E-05 IFPRA Result 8.94E-07 8.95E-07 2.06E-07 2.07E-07 Seismic Penalty 1.70E-06 5.10E-07 Total for Configuration 7.99E-05 7.93E-05 3.75E-05 3.64E-05 Delta for Configuration 3.67E-05 3.41E-05 3.23E-05 3.12E-05 TS 3.5.1.A One Low Pressure ECCS Subsystem Inoperable FPIE Result 1.45E-06 2.26E-06 2.46E-07 2.92E-07 FPRA Result 5.39E-04 5.40E-04 2.02E-05 2.00E-05 IFPRA Result 9.08E-07 9.08E-07 2.06E-07 2.05E-07 Seismic Penalty 1.70E-06 5.10E-07 Total for Configuration 5.43E-04 5.45E-04 2.12E-05 2.10E-05 Delta for Configuration 5.00E-04 5.00E-04 1.60E-05 1.58E-05 TS 3.5.1.G One ADS Valve and Condition A (e.g., One CS Loop)

FPIE Result 1.46E-06 1.83E-06 2.46E-07 2.88E-07 FPRA Result 3.96E-04 3.92E-04 3.40E-05 3.39E-05 IFPRA Result 3.52E-06 3.52E-06 6.55E-07 6.56E-07 Seismic Penalty 1.70E-06 5.10E-07 Total for Configuration 4.03E-04 3.99E-04 3.54E-05 3.54E-05 Delta for Configuration 3.59E-04 3.54E-04 3.03E-05 3.01E-05 TS 3.7.2.A One ESW Pump in Each Subsystem FPIE Result 2.97E-06 3.48E-06 2.54E-07 3.73E-07 FPRA Result 9.98E-04 9.99E-04 2.06E-05 2.08E-05 IFPRA Result 1.72E-05 1.72E-05 3.98E-07 3.99E-07 Seismic Penalty 1.70E-06 5.10E-07 Total for Configuration 1.02E-03 1.02E-03 2.18E-05 2.21E-05 Delta for Configuration 9.77E-04 9.76E-04 1.66E-05 1.68E-05 TS 3.8.1.C Two Offsite Circuits Inoperable FPIE Result 3.85E-05 4.64E-05 1.06E-06 1.31E-06 FPRA Result 5.08E-04 5.18E-04 2.48E-05 2.51E-05

Enclosure 1 to PLA-7984 Page 23 of 105 Table Q9-2 Details of Mean vs Point Estimate Results CDF LERF CDF LERF Point Point Propagated Propagated Estimate Estimate Mean (/yr) Mean (/yr)

(/yr) (/yr)

IFPRA Result 3.18E-05 3.31E-05 1.17E-06 1.18E-06 Seismic Penalty 1.70E-06 5.10E-07 Total for Configuration 5.80E-04 5.99E-04 2.75E-05 2.81E-05 Delta for Configuration 5.37E-04 5.54E-04 2.24E-05 2.29E-05 Question 9.c:

As demonstrated in Table Q9-1, the sampled cases demonstrate a small change in RICT estimates (i.e., less than 0.5-day) between the mean values and the point estimate values.

Therefore, it is concluded that the SOKC uncertainties are considered negligible to the RICT Program and that the point estimates are adequate for informing the difference between plant configurations (i.e., the delta risk between different plant configurations). This approach is consistent with NUREG-1855 (Reference 19).

Audit Question Q-010 EITHER:

Demonstrate that the total risk for Susquehanna Units 1 and 2 is in conformance with RG 1.174 risk acceptance guidelines (i.e., CDF < 1E-04 and LERF < 1E-05 per year) after the total mean internal events (including internal flooding) and fire CDF and LERF values are calculated to account for the SOKC and for potential changes in risk due to any updates to PRA models performed in response to NRC staff requests. Identify the fire PRA parameters that are assumed to be correlated in the parametric uncertainty analysis of fire events (e.g., fire ignition frequencies, non-suppression probabilities, severity factors, spurious probabilities, fire human error probabilities), as well as the sources used for the associated uncertainty distributions (e.g., NUREG-2169, NUREG/CR-1278, NUREG/CR-7150, and EPRI [Electric Power Research Institute] HRA Calculator uncertainty distributions).

OR:

Explain how the licensee will ensure (e.g., via a license condition or implementation requirement) that, prior to implementation of the RMTS program: (1) the total mean internal events (including internal flooding) and fire CDF and LERF will be calculated to account for the SOKC and updates to PRA models performed in response to NRC staff requests; and (2) the

Enclosure 1 to PLA-7984 Page 24 of 105 updated total risk (including seismic risk) values are still in conformance with the RG 1.174 risk acceptance guidelines (i.e., CDF < 1E-04 and LERF < 1E-05 per year).

Susquehanna Response The parametric uncertainty evaluations for the PRA models are documented in the following notebooks / reports:

FPIE PRA Summary and Quantification Report EC-RISK-0040 (Reference 7)

IFPRA Summary and Quantification Report EC-RISK-0539 (Reference 20)

FPRA Summary and Quantification Report EC-RISK-1187 (Reference 21) o Fire Ignition Frequencies -NUREG-2169 uncertainty distributions (Reference 22) o Non-Suppression Probabilities -NUREG/CR-1278 uncertainty distributions (Reference 23) o Severity Factors - Generic FPIE lognormal uncertainty distributions o Spurious Probabilities -NUREG/CR-7150 uncertainty distributions (Reference 24) o Fire HEPs -EPRI HRA Calculator uncertainty distributions Using the UNCERT software, a Monte Carlo simulation was performed for both CDF and LERF using 50,000 samples to calculate the mean risk metrics that reflect the SOKC considerations.

Table Q10-1 summarizes the total CDF and total LERF for all hazards using the point-estimate and parametric mean values. As shown in the table, total CDF and total LERF conform with the RG 1.174 (Reference 25) risk acceptance guidance (i.e., CDF < 1E-04 and LERF < 1E-05 per year) using both the point-estimate values and the parametric mean values. Therefore, it is concluded that the point-estimate values are good representations of the mean CDF and LERF values.

Enclosure 1 to PLA-7984 Page 25 of 105 Table Q10-1 Comparison of Point-Estimate and Parametric Mean Values Point-Estimate Parametric Percent Hazard Delta (/Yr)

(/Yr) Mean (/Yr) Difference UNIT 1 CDF FPIE 1.21E-06 1.48E-06 2.70E-07 22.31%

IFPRA 9.61E-07 9.12E-07 -4.90E-08 -5.10%

FPRA 1 5.03E-05 5.27E-05 2.40E-06 4.77%

Total 5.25E-05 5.51E-05 2.62E-06 5.00%

UNIT 1 LERF FPIE 2.23E-07 3.24E-07 1.01E-07 45.29%

IFPRA 2.10E-07 2.09E-07 -1.00E-09 -0.48%

FPRA 1 6.02E-06 6.93E-06 9.10E-07 15.12%

Total 6.45E-06 7.46E-06 1.01E-06 15.65%

UNIT 2 CDF FPIE 1.24E-06 1.52E-06 2.80E-07 22.58%

IFPRA 4.54E-07 4.52E-07 -2.00E-09 -0.44%

FPRA 1 5.97E-05 6.33E-05 3.60E-06 6.03%

Total 6.14E-05 6.53E-05 3.88E-06 6.32%

UNIT 2 LERF FPIE 2.24E-07 2.70E-07 4.60E-08 20.54%

IFPRA 1.54E-07 1.54E-07 0.00E+00 0.00%

FPRA1 5.96E-06 7.01E-06 1.05E-06 17.62%

Total 6.34E-06 7.43E-06 1.10E-06 17.29%

1. The fire results are based on the OCT17R2F0 model. Parametric uncertainty evaluations have not been performed on the F1 model (i.e., most current model, and documented in EC-RISK-0048 (Reference 26)). However, the differences between the two models (F0 and F1) are minimal (less than a five percent change in CDF or LERF) and the results shown in the table should be minimally impacted if the F1 model was evaluated.

Audit Question Q-011 Explain whether shared systems are credited in the internal events (including internal flooding) and fire PRA models for both units that support the RICT calculations and, if so, then (1) identify those systems, and (2) either explain how the shared systems are modeled for each unit in a dual unit event demonstrating that shared systems are not over-credited in the PRA models, or if the PRA models do not address the impact of events that can create a concurrent demand for the system shared by both units, then justify that this exclusion has an inconsequential impact the RICT calculations.

Enclosure 1 to PLA-7984 Page 26 of 105 Susquehanna Response SSES is a two-unit site that has systems and components which are shared between the two units. The SSES PRA logic model, including FPIE, FPRA, and IFPRA hazards, models some of these shared systems and components. Information related to the modeling of shared systems and components credited in the SSES PRA is provided in the SSES PRA System Notebooks; see the section on Shared Components.

Table Q11-1 summarizes the shared systems and components across both units and how dual unit events impact those systems and components.

Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components ESW System The ESW pumps are shared by both units. All ESW is designed to provide ESW pumps are powered from the simultaneous support to Unit 1 corresponding Unit 1 4160 VAC electrical and Unit 2. As a result, the buses. Additionally, the initiation logic is SSES PRA model logic does normally powered from Unit 1 125 VDC not require unit alignment electrical buses and can be aligned to Unit 2 if or preference during the required. quantification of a dual unit event.

Enclosure 1 to PLA-7984 Page 27 of 105 Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components RHRSW The RHRSW System provides a cross RHRSW is designed to System connection between the two units. The return provide simultaneous support lines to the Spray Pond are also cross to Unit 1 and Unit 2. As a connected at the discharges of the RHR heat result, the SSES PRA model exchangers. Therefore, much of the SSES logic does not require unit PRA system logic for RHRSW is common to alignment or preference both units. during the quantification of a dual unit event.

Although RHRSW is a shared system, the RHRSW pumps are designated as 1A, 1B, 2A and 2B because of their power supplies. The initiation logic for RHRSW pump 1A can be powered from either the Unit 1 or Unit 2 125 VDC electrical bus, and the initiation logic for RHRSW pump 1B can be powered from either the Unit 1 or Unit 2 125 VDC electrical bus; the initiation logic for the Unit 2 RHRSW pumps can only be powered from the Unit 2 125 VDC electrical buses.

Enclosure 1 to PLA-7984 Page 28 of 105 Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components Refueling The RWST is common to both units and Since the RWST is shared Water provides additional inventory to the between the two units, the Storage Tank Condensate Storage Tanks (CSTs). The water SSES PRA model assumes (RWST) volume in the RWST is shared between the that only half of the water two units. The RWST volume can be from the RWST is available manually aligned to one or both CSTs if for each CST. This required. The volume depletion of the RWST assumption informed the is dependent upon the CST alignment, the development of the overall unit, and its system requirement. As a result, CST and RWST success the water available is one half the volume of criteria. As a result, the SSES water at a height greater than the CST nozzle PRA model logic does not connection to the pump. require unit alignment or preference during the quantification of a dual unit event.

125 VDC Although each unit has a separate 125 VDC Each unit has an independent Electrical electrical distribution system, each unit can 125 VDC electrical Distribution supply the common loads shared by the two distribution system. Common units. The normal alignment is to have these loads are normally powered common loads supplied via Unit 1 125 VDC. from Unit 1 but can be powered from Unit 2 if The DGs utilize manual transfer switches to needed. In short, each unit can provide alternate power sources for the DGs. provide 125 VDC power to Unit 1 125 VDC distribution panels provide unit specific loads, and the normal source of DC power; Unit 2 common loads. As a result, provides alternate supply. the SSES PRA model logic does not require unit alignment or preference during the quantification of a dual unit event.

Enclosure 1 to PLA-7984 Page 29 of 105 Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components Blue Max The Blue Max Diesel Generator is a Blue Max is designed to Diesel 480 VAC portable diesel generator. It is a provide simultaneous support Generator self-contained power source, which can to Unit 1 and Unit 2. As a provide 480 VAC power to station battery result, the SSES PRA model chargers (Unit 1, Unit 2, or both units logic does not require unit simultaneously) when the normal 480 VAC alignment or preference power supplies are unavailable. In the SSES during the quantification of a PRA, Blue Max is credited for extended dual unit event.

operation following design battery depletion at four hours. The SSES PRA considers extended operation to be required for the success of long-term high-pressure injection, and late depressurization.

13.8 kVAC The SSES Startup Transformers and electrical The 13.8 kVAC Electrical Electrical buses are shared by both units and provide Distribution System is Distribution independent sources of offsite electrical designed to provide power. Startup Transformer T-10 and simultaneous support to Unit 1 Electrical Distribution Bus 10 supply one and Unit 2. As a result, the division of ESS electrical power in each unit, SSES PRA model logic does while Startup Transformer T-20 and not require unit alignment Electrical Distribution Bus 20 supply the or preference during the other division. quantification of a dual unit event.

Electrical Distribution Bus 10 provides power to the Unit 1 13.8 kVAC auxiliary electrical bus, while Electrical Distribution Bus 20 provides power to the Unit 2 13.8 kVAC auxiliary electrical bus. These Unit auxiliary buses can be cross tied should one source of offsite power fail.

Enclosure 1 to PLA-7984 Page 30 of 105 Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components 4160 VAC The SSES ESS transformers are shared by Each ESS Transformer is Engineered each units 4160 VAC electrical distribution designed to provide Safeguards systems. During normal operation, each ESS simultaneous support to Unit 1 Transformers transformer supplies one 4160 VAC ESS and Unit 2. As a result, the electrical bus per unit. If the preferred power SSES PRA model logic does supply is not available, the alternate power not require unit alignment supply is automatically aligned. Each ESS or preference during transformer is capable of supplying power to quantification of a dual unit four 4160 VAC ESS electrical buses event.

simultaneously (i.e., can simultaneously power two 4160 VAC ESS electrical buses per unit).

DGs The DG System is common to both units. The Each DG is designed to four DGs (A, B, C, D and E as an provide simultaneous support independent spare for any of the other DGs) to Unit 1 and Unit 2. As a are shared between Unit 1 and Unit 2. The result, the SSES PRA model motor control centers (MCCs) that support logic does not require unit the DGs can be powered from either units alignment or preference 480 VAC electrical distribution system. Any during quantification of a dual aligned DG can supply its respective ESS bus unit event.

in both units (i.e., the DGs are designed to provide sufficient power for the electrical loads required for a simultaneous shutdown of both reactors).

Enclosure 1 to PLA-7984 Page 31 of 105 Table Q11-1 Summary of Shared Systems / Components in SSES PRA Shared Description of Shared Systems / PRA Modeling of Shared Systems /

Components Systems / Components Components Turbine Three Turbine Marine Generators are stored Two Turbine Marine Marine in the SSES FLEX Building and are available Generators can provide power Generators to provide limited 4160 VAC power given a to all eight ESS electrical SBO and an ELAP. Only two of the three buses (i.e., simultaneous Turbine Marine Generators are required for support to Unit 1 and Unit 2).

success. All eight 4160 VAC electrical busses As a result, the SSES PRA are powered by two Turbine Marine model logic does not require Generators operating in parallel. unit alignment or preference during quantification of a dual unit event.

Audit Question Q-012 Explain how the impact of seasonal variations on the PRA modeling will be evaluated (as needed) during a RICT evolution and justify that this approach is consistent with the guidance in NEI 06-09 and its associated NRC safety evaluation.

Susquehanna Response Related to seasonal variations, NEI 06-09, Revision 0-A (Reference 8), states:

If the PRA model is constructed using data points or basic events that change as a result of time of year or time of cycle (examples include moderator temperature coefficient, summer versus winter alignments for HVAC, seasonal alignments for service water),

then the RICT calculation shall either 1) use the more conservative assumption at all time, or 2) be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration for the feature as modeled in the PRA.

The SSES PRA model is not constructed using data points or basic events that change as a result of time of year or time of cycle. The applied data is either bounding (e.g., initial RWST temperature of 120°F), or averaged across the year (e.g., frequency of a Loss of Offsite Power (LOOP) due to weather). For HVAC systems, maximum operating temperatures are typically

Enclosure 1 to PLA-7984 Page 32 of 105 well above the expected sustained air temperature. For example, the E DG Buildings HVAC system is designed to maintain a temperature below 120°F. The maximum air temperatures for Berwick, Pennsylvania does not typically exceed 90°F. The PRA also considers operational requirements, such as TS 3.7.1, which specifies the Spray Pond average temperature limit (less than or equal to 85°F).

Therefore, an evaluation of the impact of seasonal variations on the PRA modeling is not required.

Specific to LOOP, no standard industry practice exists for seasonal adjustments to such frequencies. Existing industry and site data do not support determination of a LOOP frequency multiplier. A 2015 informal benchmarking study of eight utilities found no consensus on assessing severe weather. Because there is no definitive industry guidance on how to calculate an increase in LOOP frequency due to severe weather conditions, no adjustment is deemed to be necessary.

Audit Question Q-013

a. LAR Table E1-1 states for TS LCO 3.5.1 (ECCS - Operating), Condition D (HPCI System Inoperable) that both the design basis and PRA success criterion is one of one train (i.e., one HPCI pump). It appears that LCO 3.5.1, Condition D defeats the design basis success criterion and, therefore, represents a TS loss of function. TSTF 505, Revision 2 (ADAMS Accession No. ML18183A493) does not authorize determination of a RICT when the condition represents a loss of TS function. Therefore, explain why LCO 3.5.1, Condition D does or does not represent a TS loss of function. Include clarification of the design basis success criteria for the High-Pressure Coolant Injection (HPCI) system.

b. The equipment in the Design Success Criteria column of Table E1 cannot be equipment in the staff requests a correction to Table E1.

c. If the design basis and PRA success criteria are not consistent, then the staff requests the licensee to explain the basis for the differences and justification for the PRA success criteria.

Susquehanna Response Question 13.a The Design Success Criteria for HPCI in Reference 1, Table E1-1 did not provide additional ways in which the design function of HPCI (i.e., to provide makeup and core cooling in the event of an accident) can be performed.

Enclosure 1 to PLA-7984 Page 33 of 105 The ECCS network has built-in redundancy so that adequate cooling can be provided, even in the event of specified failures. The following equipment makes up the ECCS:

HPCI

CS System (two loops)

Low Pressure Coolant Injection (LPCI) Mode of RHR System (two loops)

ADS In the event that the one train of HPCI is inoperable, the ADS will decrease pressure in the reactor vessel to a point at which the low pressure ECCS (CS and LPCI) are capable of injecting into the core. The combination of ADS and CS or LPCI results in performance of the design function of HPCI. Therefore, entry into LCO 3.5.1, Condition D, does not constitute a loss of TS function and LCO 3.5.1, Condition D can be included in the scope of the RICT Program.

It should be noted that the same combination of ADS and CS or LPCI provides a redundant means of performing the design function of RCIC as well. Therefore, entry into LCO 3.5.3, Condition A also does not constitute a loss of TS function and LCO 3.5.3, Condition A, can be included in the scope of the RICT Program.

Table E1-1 from Reference 1 has been revised to include these alternative means of performing the design function of HPCI and RCIC in the Design Success Criteria column. While updating the design success criteria for these two Conditions, it was identified that the PRA success criteria also did not list all the applicable ways the PRA model can credit the performance of the functions of HPCI and RCIC. As such, the PRA Success Criteria column in Table E1-1 have also been updated to include appropriate alternative means for performing the PRA functions of HPCI and RCIC. Revised Table E1-1 is included in Enclosure 2 to this letter.

Question 13.b As stated in the response to Question 13.a, Table E1-1 from Reference 1 has been revised to reflect the additional ways in which the function of the HPCI and RCIC systems can be performed. The deletions requested by the staff have been incorporated into the updates of Table E1-1.

Question 13.c The design success criteria for ADS are five out of six valves. This is based on the fact that the design of ADS complies with the single failure criterion; i.e., with any one of the six ADS valves inoperable for any reason, the reactor can still be de-pressurized in the event of a Design

Enclosure 1 to PLA-7984 Page 34 of 105 Basis Accident (DBA). The design success criteria do not identify the minimum number required to perform the safety function; they provide a level at which the plant is required to be analyzed to demonstrate the ability to withstand postulated DBAs.

The PRA success criteria for ADS is only three out of six valves; i.e., one division of ADS. Note that for Anticipated Transient Without a Scram (ATWS) scenarios, the ADS PRA Success Criteria are all six valves. In support of the PRA development, a thermal hydraulic analysis was performed and demonstrated only three of six ADS valves are required to de-pressurize the reactor assuming control rods are inserted. This is documented in the Event Tree and Success Criteria Notebook (Reference 27).

In summary, the design success criteria are based on the single failure criterion and represent the complement of equipment with which the DBA analyses are performed. The PRA success criteria are based on a realistic model that was evaluated in support of PRA model development.

Audit Question Q-014 LAR Table E1-1 states for TS LCO 3.5.1 (ECCS - Operating), Condition B (One LPCI pump in one or both LPCI subsystems inoperable), that the PRA success criteria are generally consistent with the design basis. However, the table also shows that for a LOCA [Loss of Coolant Accident] in the bottom head, the PRA success criterion is one RHR pump in each division. This appears to be more stringent than the design basis success criterion (i.e., one of four LPCI pumps) and associated with a specific accident sequence. Therefore, explain this apparent inconsistency and confirm whether the more stringent PRA success criterion is for one possible low likelihood event.

Susquehanna Response The SSES LPCI System is a mode of the RHR System; i.e., LPCI utilizes the RHR pumps. Each unit has two RHR subsystems. Each RHR subsystem has two 100 percent capacity pumps. As a result, one RHR pump is required for success of the LPCI subsystem.

For the SSES PRA, the success of LPCI (see logic under gate 149-N-N-1LPCIWRKS) requires one of four RHR pumps to be operational; one subsystem is required. This is true for sequences that do not involve a medium LOCA (MLOCA) in the bottom head.

For sequences that involve a MLOCA in the bottom head (a low likelihood and non-risk significant sequence), the PRA requires one RHR pump from each subsystem; i.e., two subsystems of LPCI are required (see logic under gate 149-N-N-2LPCI_WRKS).

Enclosure 1 to PLA-7984 Page 35 of 105 Audit Question Q-015 LAR Table E1-1 states for TS LCO 3.7.2 (Emergency Service Water (ESW) System),

Conditions A, B, and C, that the success criteria are consistent with the design basis.

However, the table indicates that the design basis success criterion is one ESW pump in each loop, and the PRA success criterion is one of two subsystems. The design basis and PRA success criteria do not appear to be equivalent. Therefore, explain how the design basis and PRA success criteria are consistent based on the wording in Table E1-1. If the licensee cannot confirm that the design basis and PRA success criteria are consistent, then explain the basis for the difference and the justification for the PRA success criteria. Provide updated Table E1 to clarify terms (division, loop, subsystem, etc.).

Susquehanna Response The SSES ESW System is a shared system across both units. The ESW system has two independent divisions. Each ESW division has two pumps. The A and C pumps are division 1, and the B and D pumps are division 2. Each division is designed to supply 100 percent of the ESW requirements to both units and the common DGs simultaneously. For the SSES PRA, success of an ESW division (i.e., loop) requires success of one corresponding ESW pump (A or C for division 1; B or D for division 2). Therefore, the PRA success criterion is consistent with the design success criterion (i.e., one ESW pump per division).

For the DG cooling, one of four ESW pumps is required for success (i.e., one division of ESW).

This success criterion is based on a single ESW pump flowrate of 6,000 gpm and the most limiting required ESW flow for a DBA with one loop of ESW failed; reported to be 4,262 gpm.

For Turbine Building Component Cooling Water (TBCCW) and Reactor Building Component Cooling Water (RBCCW) cooling, one of two ESW pumps from division 1, and one of two ESW pumps from division 2 are required for success (i.e., two divisions, one pump per division). The PRA success criteria is documented in the TBCCW system notebook and the RBCCW system notebook (References 28 and 29, respectively).

For all other systems, one of two ESW pumps is required for success of an ESW division.

Discussion of TBCCW PRA Success:

For the PRA, TBCCW success is defined as the system providing an adequate supply of cooling water for Condensate Pump Motor cooling, Instrument Air Compressor cooling, Service Air Compressor cooling, and CRD Pump cooling. To achieve success, one TBCCW pump and one TBCCW heat exchanger must be in operation, associated valves must remain open, and cooling water (from Service Water or ESW) must be available. Note that the ESW flow balance requires

Enclosure 1 to PLA-7984 Page 36 of 105 both ESW loops to be in operation if used to cool TBCCW heat exchangers. Therefore, the PRA requires both ESW trains for success when cooling TBCCW.

Discussion of RBCCW PRA Success:

For the PRA, RBCCW success is defined as the system providing an adequate supply of cooling water for Containment Instrument Gas compressor cooling. To achieve success, one RBCCW pump and one RBCCW heat exchanger must be in operation, associated valves must remain open, and cooling water (from Service Water or ESW) must be available. Note that the ESW flow balance requires both ESW loops to be in operation if used to cool RBCCW. Therefore, the PRA requires both ESW trains for success when cooling RBCCW.

Audit Question Q-016 Explain how I&C [Instrumentation and Control] equipment that is applicable or impacts the RICT calculations is modeled or considered in the PRA. Include in this discussion: (1) the scope of the I&C equipment that is explicitly modeled (e.g., bistables, relays, sensors, integrated circuit cards), (2) description of the level of detail that the PRA model supports (e.g., whether all channels of an actuation circuit are modeled), (3) discussion of the generic data and plant-specific data used, and (4) discussion of the associated TS functions for which a RICT can be applied.

Susquehanna Response The response to each of the four sub-questions is provided herein:

1. See Table Q16-1.

2. See Table Q16-1.

3. In some cases, the SSES PRA does model instrumentation as required to support the modeled system(s). The failure data is handled in the same fashion as other modeled equipment/components modeled in the SSES PRA using available generic data sources for the modeled instruments.

4. See Table Q16-1, below. Each of the instrumentation TS in the scope of the RICT Program is listed in Table Q16-1, with a description of the I&C modeling. Enclosure 4, Section 2 of Reference 1 provides an evaluation of I&C Systems. The following table provides PRA details related to the LCOs identified in Enclosure 4, Section 2 of Reference 1.

Enclosure 1 to PLA-7984 Page 37 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling 3.3.1.1 - Reactor Protection System (RPS) Instrumentation Intermediate Range Monitors Individual RPS instrumentation inputs to the RPS logic system are not modeled explicitly in the PRA. The SSES PRA utilizes a simple fault tree to represent the mechanical and electrical failures to scram. The mechanical failures are under gate GT-CCFMEATWS-PE Average Power Range Monitors and the electrical logic is under gate 1ELEC_ATWS. The mechanical failure to scram is represented by a single basic event Reactor Vessel Steam Dome Pressure-High (CCFMEATWS-PE). The electrical portion includes a single event for RPS electrical scram failure (CCFELATWS-PE), backup from Alternate Rod Insertion (ARI) and a conditional manual scram failure probability (1ELATWS-MAN-O). ARI has two divisions Reactor Vessel Water Level-Low, Level 3 (Division 1 and Division 2), with ARI logic modeled for each division. All four pressure switches, PSB211(2)N045A(B, C, D),

Reactor Steam Dome High Pressure EOC/RPT Breakers, are required for ARI success.

Main Steam Isolation Valve-Closure Drywell Pressure-High In the context of the RICT Program, surrogate events are chosen to represent failure of the reactor protection system. This modeling is identified in Table E1-1 of Reference 1.

Scram Discharge Volume Water Level-High Turbine Stop Valve-Closure Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Reactor Mode Switch-Shutdown Position Manual Scram The SSES PRA credits operator actions to manually scram the reactor as a backup to electrical scram failures under gate 1ELATWS-MAN-O).

Manual Rod Insertion (MRI) modeling was not developed as it was determined to be ineffective in response to the PRA modeled ATWS scenarios of interest which require rapid operator response prior to the time when MRI could be effective.

3.3.2.1 - Control Rod Block Instrumentation Rod Block Monitor The SSES PRA does not explicitly model this instrumentation. In the context of the RICT Program, surrogate events are chosen to represent failure of the RPS. This modeling is identified in Table E1-1 of Reference 1.

Rod Worth Minimizer The SSES PRA does not explicitly model this instrumentation.

Reactor Mode Switch - Shutdown Position Note: This instrumentation is not within the scope of the RICT Program.

3.3.2.2 - Feedwater - Main Turbine High Water Level Trip Instrumentation Reactor Vessel Water Level - High, Level 8 The SSES PRA models the failure of Feedwater to trip given a Level 8 trip signal. This logic is found under gate 1(2)45-N-N-LVL8-1 and is used to model the potential for reactor vessel overfill, and flooding of the steam lines. The SSES PRA models three channels of the level trip logic (A, B, C). Each channel has a power supply, and level switch; PDTC321N004(A, B, C), Reactor Water Level to Feedwater Turbine Trip Permissive. Two of three channels must fail for the Level 8 trip to fail. The PRA also models the operator action to control Feedwater flow following a Level 8 trip failure. If both the trip logic, and the operator action fail, a Feedwater overfill will occur, which could result in a loss of the High-Pressure Injection steam driven systems; HPCI, RCIC, and FW are all steam driven systems.

Enclosure 1 to PLA-7984 Page 38 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling 3.3.4.1 - End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation Turbine Stop Valve - Closure The SSES PRA models the turbine stop valve closure limit switches (two per division), ZSC721(2)N006A(B, C, D), Turbine Stop Valve < 95% Open / RPS Trip. This logic is under gate 1(2)64-I(II)-N-TURTRIP in the fault tree logic. For each division (Division 1 or Division 2), the EOC trip logic requires both the turbine stop valve limit switches (ZOC721N006A(B, C, D), or both the fast trip pressure switches (PSLC721N005A(B, C, D) (i.e., a failure of one limit switch and one pressure switch will fail the automatic EOC trip). For fire related scenarios in specific fire zones, the PRA models the implementation of fire specific procedures that allow for a manual EOC trip. The manual credit is located under gate 164-EOC-NF in the fault tree logic.

Turbine Control Valve Fast Closure, Trip Oil Pressure The SSES PRA models the turbine control valve fast closure signals from the pressure switches (two per division),

- Low PSLC721(2)N005A(B, C, D), Turbine CV Fast Close / SCRAM Trip Logic. This logic is under gate 1(2)64-I(II)-N-TURTRIP in the fault tree logic. For each division (Division 1 or Division 2), the EOC trip logic requires both the turbine stop valve limit switches, or both the fast trip pressure switches (i.e., a failure of one limit switch and one pressure switch will fail the automatic EOC trip). For fire related scenarios in specific fire zones, the PRA models the implementation of fire specific procedures that allow for a manual EOC trip. The manual credit is location under gate 164-EOC-NF in the fault tree logic.

3.3.4.2 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation Reactor Vessel Water Level - Low Low, Level 2 The ATWS-RPT consists of two independent trip systems. Each trip system has two channels of Reactor Steam Dome Pressure -

High and two channels of Reactor Vessel Water Level-Low Low. Each ATWS-RPT trip system is a two of two logic. Therefore, either low reactor level or high reactor pressure will cause a trip. The SSES PRA does not model the Level 2 signal; only the pressure signals are modeled.

Reactor Steam Dome Pressure -High The SSES PRA models pressure switches to provide actuation logic. Logic actuation of Division 1 requires successful operation of pressure switches PSB211(2)N045A(C), Reactor Steam Dome High Pressure EOC/RPT Breakers. Division 2 logic requires operation of pressure switches PSB211(2)N045B(D). A failure of any one pressure switch will fail the ARI function (four of four logic). This logic is found under gate 1(2)58-N-N-RODINSERT and is part of the failure to scram fault tree logic.

3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation: Core Spray System Reactor Vessel Water Level - Low Low Low, Level 1 The SSES PRA models the reactor vessel low level ECCS initiation via LISB211(2)N031A(B, C, D), Reactor Vessel Water Level ECCS Actuation. This logic is found under gate 1(2)51-I-A(C)-LOGIC or the 1(2)51-II-B(D)-LOGIC in the SSES PRA fault tree logic. This logic also includes modeling of the actuation relays.

Drywell Pressure - High The SSES PRA models high drywell pressure ECCS initiation via PSE111(2)N011A(B, C, D), Drywell Hi Pressure ECCS Actuation. This logic is found under gate 1(2)51-I-A(C)-LOGIC or the 1(2)51-II-B(D)-LOGIC in the SSES PRA fault tree logic.

This logic also includes modeling of the actuation relays.

Reactor Steam Dome Pressure - Low (Initiation) The SSES PRA models the K10 relays which are the Reactor Low Level or High Drywell Pressure Plus Low Reactor Pressure Logic relays. In general, this relay looks for LOCA conditions to initiate ECCS. The PRA does not differentiate between the ECCS Initiation and ECCS Injection Permissive.

Reactor Steam Dome Pressure - Low (Injection The SSES PRA models the reactor Low Pressure Core Spray and LPCI permissive via PISB211(2)N021A(B, C, and D), Reactor Permissive) Pressure Core Spray / LPCI Permissive. This logic is found under gate 1(2)51-I-A(C)-LOGIC or the 1(2)51-II-B(D)-LOGIC in the SSES PRA fault tree logic. This logic also includes modeling of the actuation relays K32A(B) and K19A(B), Reactor Low Pressure Sensor Relay.

Enclosure 1 to PLA-7984 Page 39 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling Manual Initiation In specific scenarios, the SSES PRA credits operator actions to manually start low pressure pumps. The fault tree logic, including credited Human Failure Events, is found under gate 1(2)OPRHRCS.

3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation: Low Pressure Coolant Injection (LPCI) System Reactor Vessel Water Level - Low Low Low, Level 1 The SSES PRA models the reactor vessel low level ECCS initiation via LISB211(2)N031A(B, C, D), Reactor Vessel Water Level ECCS Actuation. This logic is found under gate 1(2)49-I-A(C)-PPINI or the 1(2)49-II-B(D)-PPINI in the SSES PRA fault tree logic. This logic also includes modeling of the actuation relays. For each train of LPCI (A, B, C, D) the SSES PRA models initiation signals from Division 1 and Division 2. A failure of both divisions will fail initiation of the train.

Drywell Pressure - High The SSES PRA models high drywell pressure ECCS initiation via PSE111(2)N011A(B, C, D), Drywell Hi Pressure ECCS Actuation. This logic is found under gate 1(2)49-I-A(C)-PPINI or the 1(2)49-II-B(D)-PPINI in the SSES PRA fault tree logic.

This logic also includes modeling of the actuation relays. For each train of LPCI (A, B, C, D) the SSES PRA models initiation signals from Division 1 and Division 2. A failure of both divisions will fail initiation of the train.

Reactor Steam Dome Pressure - Low (Initiation) The SSES PRA models the K10 relays which are the Reactor Low Level or High Drywell Pressure Plus Low Reactor Pressure Logic relays. In general, this relay looks for LOCA conditions to initiate ECCS. The PRA does not differentiate between the ECCS Initiation and ECCS Injection Permissive.

Reactor Steam Dome Pressure - Low (Injection The SSES PRA models the reactor Low Pressure Core Spray and LPCI permissive via PISB211(2)N021A(B, C, and D), Reactor Permissive) Pressure Core Spray / LPCI Permissive. This logic is found under gate 1(2)49-I-A(C)-PPINI or the 1(2)49-II-B(D)-PPINI in the SSES PRA fault tree logic. This logic also includes modeling of the actuation relays K32A(B) and K19A(B), Reactor Low Pressure Sensor Relay. For each train of LPCI (A, B, C, D) the SSES PRA models initiation signals from Division 1 and Division 2. A failure of both divisions will fail initiation of the train.

Reactor Steam Dome Pressure - Low (Recirculation Low reactor steam dome pressure signals are used as permissives for RHR LPCI mode recirculation discharge and bypass valve Discharge Valve Permissive) closures. The SSES PRA assumes that the RHR System is in normal alignment. The SSES PRA models the instrumentation and relays required to align the F015 valves for LPCI injection. All other PRA credited modes of RHR (i.e., Suppression Pool Cooling, and Drywell Containment Spray Cooling) require operator actions to properly align the system (i.e., automatic actuation and alignment of these RHR modes is not credited in the PRA). The PRA models the instrumentation PISB211(2)N021A(B, C, D), Reactor Pressure Core Spray / LPCI Permissive, and the required relays.

Manual Initiation In specific scenarios, the SSES PRA credits operator actions to manually start low pressure pumps. The fault tree logic, including credited Human Failure Events, is found under gate 1(2)OPRHRCS.

3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation: High Pressure Coolant Injection (HPCI) System Reactor Vessel Water Level - Low Low, Level 2 The SSES PRA models the Level 2 HPCI initiation logic inputs via the wide range RPV water level switches LISB211(2)N031A(B, C, D). This logic is found under gate 1(2)52-II-N-LLHPCISIG1(2) in the SSES PRA fault tree logic. This logic also includes modeling of the actuation relays. The initiation logic for each parameter is arranged in a one-out-of-two taken twice configuration.

Drywell Pressure - High The SSES PRA does not model the initiation of HPCI due to high drywell pressure. All transient and LOCA accident scenarios that require HPCI will initiate HPCI due to a low reactor water level condition.

Reactor Vessel Water Level - High, Level 8 The SSES PRA models the failure of HPCI to trip given a Level 8 trip signal. This logic is found under gate 1(2)52-II-N-LVL8-1 and is used to model the potential for reactor vessel overfill, and flooding of the steam lines.

Enclosure 1 to PLA-7984 Page 40 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling Condensate Storage Tank Level - Low The SSES PRA models the spurious closure of CST level switches LSLLE411N002 and LSLLE411N003. Failure of either switch will result in a loss of the CST as a suction source to HPCI. Transfer of the HPCI pump suction source from the CST to the SP is assumed to occur on low CST level (the transfer logic is assumed to be successful). This assumption is noted in the SSES HPCI System Notebook (Reference 30).

Manual Initiation The SSES PRA credits the manual initiation of HPCI for specific scenarios (i.e., when the required time to manually initiate is available). This logic is under gate 1(2)52-MANUAL_INI in the fault tree logic. Although not explicitly modeled in the PRA logic, the HRA evaluation considers the necessary cues and controls to perform this action.

3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation: Automatic Depressurization System (ADS) Trip System A and B Reactor Vessel Water Level - Low Low Low, Level 1 The SSES PRA models ADS initiation due to low reactor water level. Level instrumentation LISB211N031A(B, C, D) is modeled under gate 1(2)83-I(II)-N-AUTO in the fault tree logic.

Drywell Pressure - High The SSES PRA models ADS initiation due to high drywell pressure. Pressure instrumentation PSE111N010A(B, C, D) is modeled under gate 1(2)83-I(II)-N-AUTO in the fault tree logic.

Automatic Depressurization System Initiation Timer The SSES PRA models the ADS timer via the basic events 1(2)83RTE1C628B21CK5A and 1(2)83RTE1C631B21CK5B in the fault tree logic.

Reactor Vessel Water Level - Low, Level 3 The SSES PRA models ADS initiation due to low reactor water level. Level instrumentation LISB211N031A(B, C, D) is modeled (Confirmatory) under gate 1(2)83-I(II)-N-AUTO in the fault tree logic.

Core Spray Pump Discharge Pressure - High The SSES PRA models the Core Spray pump permissive under gates 1(2)83-I-N-PUMP_K9A and 1(2)83-II-N-PUMP_K9B in the fault tree logic. The modeled switches are PSE211N009A(B).

Low Pressure Coolant Injection Pump Discharge The SSES PRA models the Core Spray pump permissive under gates 1(2)83-I-N-PUMP_K9A and 1(2)83-II-N-PUMP_K9B in the Pressure - High fault tree logic. PSE211(2)N016A(B) and PSE111(2)N020C(D).

Automatic Depressurization System Drywell Pressure The SSES PRA models the ADS bypass timer via the basic events 1(2)83RTE1C628B21CK4A and 1(2)83RTE1C631B21CK4B Bypass Actuation Timer in the fault tree logic.

Manual Initiation The SSES PRA credits operator actions to manually initiate ADS. The fault tree logic, including credited Human Failure Events, is found under gate 1(2)83-MANUAL.

3.3.5.3 - Reactor Core Isolation Cooling (RCIC) System Instrumentation Reactor Vessel Water Level - Low Low, Level 2 The SSES PRA models RCIC automatic actuation. Reactor vessel low water level is monitored by four indicating type level switches.

Division 1 is monitored by level switches LISB211(2)N031A and LISB211(2)N031C. Division 2 is monitored by LISB211(2)N031B and LISB211(2)N031D. The Division 2 signal is relayed to the RCIC logic by the RHR logic and RHR relays E11A-79B and E11A-K80B. A one out of two twice logic arrangement is utilized to initiate RCIC on a reactor vessel water Level 2 condition. Either of the following failure combinations would fail the initiation signal; LISB211(2)N031A and LISB211(2)N031B or LISB211(2)N031C and LISB211(2)N031D.

The RCIC initiation relays are K2, K3, and K5. These relays are responsible for actuation of different RCIC components when the initiation signal occurs (there are some differences between the units), but the individual relays are not modeled in the PRA.

Enclosure 1 to PLA-7984 Page 41 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling Reactor Vessel Water Level - High, Level 8 The SSES PRA models the failure of RCIC to trip given a Level 8 trip signal. This logic is found under gate 1(2)50-I-N-LVL8-1 and is used to model the potential for reactor vessel overfill, and flooding of the steam lines.

Note: This instrumentation is not within the scope of RICT Program.

Condensate Storage Tank Level - Low The SSES PRA models the spurious closure of CST level switches LSLE511N035A and LSLE511N035E. Failure of either switch will result in a loss of the CST as a suction source to RCIC. Transfer of the RCIC pump suction source to the suppression pool is assumed to occur on low CST level. Transfer of the RCIC pump suction source from the CST to the SP is assumed to occur on low CST level (the transfer logic is assumed to be successful). This assumption is noted in the SSES RCIC System Notebook (Reference 31).

Manual Initiation The SSES PRA credits the manual initiation of RCIC for specific scenarios (i.e., when the required time to manually initiate is available). This logic is under gate 1(2)50-MANUAL_INI in the fault tree logic. Although not explicitly modeled in the PRA logic, the HRA evaluation considers the necessary cues and controls to perform this action.

Note: This instrumentation is not within the scope of RICT Program.

3.3.6.1 - Primary Containment Isolation Instrumentation: Main Steam Line Isolation Reactor Vessel Water Level - Low Low Low, Level 1 Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the Main Steam Line Pressure - Low associated system. This modeling is identified in Table E1-1 of Reference 1.

Main Steam Line Flow - High Specific to the closure of Main Steam Isolation Valves (MSIVs), the SSES PRA uses reactor level as a surrogate for all the isolation Condenser Vacuum - Low signals that can cause the MSIVs to close.

Reactor Building Main Steam Tunnel Temperature -

Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook High (Reference 32).

Manual Initiation 3.3.6.1 - Primary Containment Isolation Instrumentation: Main Steam Line Isolation (Drain Valves)

Reactor Vessel Water Level - Low Low Low, Level 1 Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the Main Steam Line Pressure - Low associated system. This modeling is identified in Table E1-1 of Reference 1.

Main Steam Line Flow - High Specific to drain valves, the SSES PRA considers the loss of flow via open drain valves to be a low probability event, and is therefore Condenser Vacuum - Low not modeled.

Reactor Building Main Steam Tunnel Temperature -

Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook High (Reference 32).

Manual Initiation

Enclosure 1 to PLA-7984 Page 42 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling 3.3.6.1 - Primary Containment Isolation Instrumentation: Primary Containment Isolation Reactor Vessel Water Level - Low, Level Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the Reactor Vessel Water Level - Low Low, Level 2 associated system. This modeling is identified in Table E1-1 of Reference 1.

Reactor Vessel Water Level - Low Low Low, Level 1 Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

Drywell Pressure - High Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook Standby Gas Treatment System (SGTS) Exhaust (Reference 32).

Radiation - High Manual Initiation 3.3.6.1 - Primary Containment Isolation Instrumentation: High Pressure Coolant Injection (HPCI) System Isolation HPCI Steam Line Pressure - High Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the HPCI Steam Supply Line Pressure - Low associated system. This modeling is identified in Table E1-1 of Reference 1.

HPCI Turbine Exhaust Diaphragm Pressure - High Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

Drywell Pressure - High Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook HPCI Pipe Routing Area Temperature - High (Reference 32).

HPCI Equipment Room Temperature - High HPCI Emergency Area Cooler Temperature - High Manual Initiation 3.3.6.1 - Primary Containment Isolation Instrumentation: Reactor Core Isolation Cooling (RCIC) System Isolation RCIC Steam Line Pressure - High Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the RCIC Steam Supply Line Pressure - Low associated system. This modeling is identified in Table E1-1 of Reference 1.

RCIC Turbine Exhaust Diaphragm Pressure - High Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

Drywell Pressure - High Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook RCIC Pipe Routing Area Temperature - High (Reference 32).

RCIC Equipment Room Temperature - High RCIC Emergency Area Cooler Temperature - High Manual Initiation

Enclosure 1 to PLA-7984 Page 43 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling 3.3.6.1 - Primary Containment Isolation Instrumentation: Reactor Water Cleanup (RWCU) System Isolation RWCU Differential Flow - High Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the RWCU Penetration Area Temperature - High associated system. This modeling is identified in Table E1-1 of Reference 1.

RWCU Pump Area Temperature - High Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

RWCU Heat Exchanger Area Temperature - High Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook SLC System Initiation (Reference 32).

Reactor Vessel Water Level - Low Low, Level 2 RWCU Flow - High Manual Initiation 3.3.6.1 - Primary Containment Isolation Instrumentation: Shutdown Cooling System Isolation Reactor Steam Dome Pressure - High Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the Reactor Vessel Water Level - Low, Level 3 associated system. This modeling is identified in Table E1-1 of Reference 1.

Manual Initiation Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook (Reference 32).

3.3.6.1 - Primary Containment Isolation Instrumentation: Traversing Incore Probe Isolation Reactor Vessel Water Level - Low, Level 3 Regarding Primary Containment Isolation, the SSES PRA model does not comprehensively model individual isolation signals. In the context of the RICT Program, surrogate events are chosen to either represent failure of containment and/or the failure to isolate the Drywell Pressure - High associated system. This modeling is identified in Table E1-1 of Reference 1.

Specific to containment isolation, the MSIVs are the only modeled containment isolation system that needs to close.

Additional information related to containment isolation can be found in the SSES PRA Containment Isolation System Notebook (Reference 32).

3.3.8.1 - Loss of Power (LOP) Instrumentation 4.16 kV Emergency Bus Undervoltage (Loss of The SSES PRA models the relays related to the 20 percent undervoltage. The SSES PRA model includes the 27A relays, the timer Voltage < 20%) relay 62A2, and the trip relay 27AX. Failure of this logic will result in a loss of the corresponding 4160 VAC bus. This logic is under gate 1(2)04-I-A(C)-1(2)A201(3)UV (Division 1), and 1(2)04-II-B(D)-1(2)A202(4)UV for (Division 2) in the fault tree. The SSES PRA does not assume credit for SSCs affected by a degraded voltage condition. The PRA models nominal power, LOOP, and SBO conditions.

Enclosure 1 to PLA-7984 Page 44 of 105 Table Q16-1 Instrumentation Review Instrumentation Description of Modeling 4.16 kV Emergency Bus Undervoltage Low Setting The SSES PRA models the relays related to the 65 percent undervoltage condition. The SSES PRA model includes the 27B (3 and 4)

(Degraded Voltage 65%) relays, the timer relay 62B2, and the trip relay 27AX. Failure of this logic will result in a loss of the corresponding 4160 VAC bus.

This logic is under gate 1(2)04-I-A(C)-1(2)A201(3)UV (Division 1), and 1(2)04-II-B(D)-1(2)A202(4)UV for (Division 2) in the fault tree. The SSES PRA does not assume credit for SSCs affected by a degraded voltage condition. The PRA models nominal power, LOOP, and SBO conditions.

4.16 kV Emergency Bus Undervoltage LOCA The SSES PRA does not explicitly model the relays related to the 93 percent undervoltage condition; the 27B (1 and 2) relays.

(Degraded Voltage 93%)

In the context of the RICT application, surrogate events are chosen to represent the failure of the 93 percent degraded voltage relays.

This modeling is identified in Table E1-1 of Reference 1. Additional information related to the modeling of LOP instrumentation can be found in the SSES PRA Offsite and 13 kV System Notebook (Reference 60)

Enclosure 1 to PLA-7984 Page 45 of 105 Audit Question Q-017 EITHER:

Describe and provide the results of a sensitivity study performed for each digital system modeled in the PRA demonstrating that the uncertainty associated with PRA modeling the digital I&C systems has inconsequential impact on the RICT calculations.

OR:

Identify the LCOs impacted by digital I&C system modeling and for which RMAs will be applied during a RICT. Explain and justify the criteria used to determine what level of impact to the RICT calculation requires additional RMAs.

Susquehanna Response SSES utilizes digital control systems for Feedwater and Recirculation control; there are no other digital control systems. The SSES PRA does not model these digital control systems. For this reason, no sensitivity was performed, and no LCOs are impacted by digital control system modeling.

Audit Question Q-019 EITHER:

Confirm that the Susquehanna Maintenance Rule program incorporates the use of performance criteria to evaluate SSC performance as described in the NRC-endorsed guidance in NUMARC 93-01.

OR:

Describe the approach or method used by Susquehanna for SSC performance monitoring, as described in Regulatory Position C.3.2 of RG 1.177, for meeting the fifth key safety principle.

In the description, include criteria (e.g., qualitative or quantitative), along with the appropriate risk metrics, and explain how the approach and criteria demonstrate the intent to monitor the potential degradation of SSCs in accordance with the NRC SE for NEI 06-09.

Susquehanna Response The SSES Maintenance Rule program is developed in accordance with the guidance of NUMARC 93-01 (Reference 33). Per Susquehanna procedure NDAP-QA-0413 (Reference 34),

performance criteria are developed for SSCs within the scope of the Maintenance Rule, and are

Enclosure 1 to PLA-7984 Page 46 of 105 established to monitor performance at the system, train, component, and/or plant level. Specific performance criteria are developed in accordance with Susquehanna procedure NSEP-AD-0413C (Reference 35) which follows the guidance of NUMARC 93-01.

Audit Question Q-020 EITHER:

Justify that the incomplete fire PRA modeling associated with MSO [Multiple Spurious Operation] scenario 2aj has an inconsequential impact on the calculated RICTs.

OR:

If the licensee cannot justify that the incorporation of MSO scenario 2aj has an inconsequential impact on the calculated RICTs, then describe how the licensee will ensure that MSO scenario 2aj is incorporated into the fire PRA model prior to implementation of the RICT program.

Susquehanna Response MSO scenario 2aj has been incorporated into the FPRA prior to implementation of the RICT Program. CAFTA model logic for MSO 2aj has been added to the Susquehanna FPRA in order to resolve F&O 1-9.

Piping and Instrumentation Diagrams (P&IDs) were reviewed to determine the flow path of the CST to the hotwell. This flow path is provided by a standpipe in the CST which limits the water to a level of 135,000 gallons and is isolated by three valves in parallel (HV10514, LV10514D, and LV10514C). Water volume below the 135,000 gallon level is preserved for HPCI and RCIC such that if a drain down to the hotwell occurs, CRD injection will not be available. Therefore, failure of the CRD injection can occur if one of the three valves spuriously opens and allows water to flow to the hotwell.

Of the three valves that can cause this undesired drain down, one is a motor operated valve, HV10514, and the other two are Air Operated Valves (AOVs), LV10514C and LV10514D. The AOVs are operated by current to pressure converters which are fed inputs from the same level transmitters. Circuit analysis was performed for HV10514 and LV10514D (LV10514C impacts were captured by the D cables) and basic events and model logic were created to represent the failure of these valves to remain closed, leading to the drain down pathway described in MSO 2aj. Since the two AOVs share the same cables that can cause spurious opening of the valves, only one equipment function state was used to represent both components.

Enclosure 1 to PLA-7984 Page 47 of 105 Audit Question Q-021 EITHER:

Discuss the PRA components that are supported by the unlocated cable, and justify (preferably using the sensitivity recommended by the peer-reviewers) that the treatment of the unlocated cable has an inconsequential impact on the calculated RICTs.

OR:

If the licensee cannot justify that the treatment of the unlocated cable has an inconsequential impact on the calculated RICTs, then explain how the licensee will either ensure that the cable is located and properly modeled in the fire PRA prior to implementation of the RICT program or identify appropriate RMAs for this key assumption, consistent with the treatment of key assumptions in NEI 06-09-A.

Susquehanna Response As a result of ongoing FPRA refinements, cable FK2Q3014J has been located, and the fire impacts are now incorporated in the FPRA cable and raceway data. This cable is now part of the FPRA model that will be used to calculate RICTs. To locate this cable, a report from the Susquehanna Cable and Raceway Information Management Program (CRIMP) was used to identify the necessary cable to raceway information. Because the CRIMP database reflects the as-built, as-operated plant configuration for raceway routing, no assumed routing for this cable is required.

Audit Question Q-022 EITHER:

Identify the active partitions that have been credited in the FPRA and provide justification that they will perform reliably in the accident scenarios for which they are credited. Include discussion of systems that rely on supporting systems, such as alternating current power or a water supply, to perform their functions. If barriers such as dampers and doors are considered to be active partitions, then identify the mechanism that changes the position of the door or damper (e.g., fusible link plus gravity, operator action) to confirm that the mechanism does not rely on an active support system.

OR:

Explain how removal of the credit taken for active partitions has an inconsequential impact on the RICT calculations.

Enclosure 1 to PLA-7984 Page 48 of 105 Susquehanna Response Table Q22-1 provides a listing of the credited active partitioning elements between physical analysis units (PAUs) and provides a basis for the credit. These partitioning elements consist of normally open doors and dampers. The basis for credit of fire dampers is the fire rating, which is contained within the naming convention of the active partitioning elements. The naming scheme for the dampers provided in Table Q22-1 is as follows:

FPD-(RATING)-AA-B-C Where:

Rating: The following ratings are specified:

o 1.5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months o 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months o 3M (3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months motor operated smoke damper) o 3P (3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months pneumatic operated smoke damper)

AA = Area number corresponding to the drawing key-plan

B = Elevation number

C = Sequence closure The fire rating of every damper is based on a passive system in the form of a fusible link. From Design Basis Document DBD019 (Reference 37):

All fire dampers are equipped with fusible link(s). Fire dampers with a P designation are also equipped with a CO2 actuated pneumatic release. Fire dampers with an M designation are fusible link actuated dampers associated with smoke removal dampers.

Motor operated dampers are activated in the event of a fire via fusible link. The motor operator is for control of smoke. Similarly, pneumatic (CO2) operated dampers are activated in the event of a fire via fusible link. The pneumatic operation is to maintain CO2 concentration in the room where a CO2 system protects the room. In sum, the fusible link is a passive system and serves as the basis for the fire rating, and thus the FPRA credit, for dampers as partitioning elements.

Enclosure 1 to PLA-7984 Page 49 of 105 Active fire partitions (normally open fire doors and fire dampers) that are not a fire area barrier may be credited when the partitioning element is identified on the Fire Zone boundary drawings and in Susquehanna calculations EC-013-1006 (Reference 38) or EC-013-1009 (Reference 39),

and confirmed - when applicable - by walkdowns. According to the specification for doors at Susquehanna, normally open fire doors are to be equipped with hold-open devices with fusible links. These mechanisms for doors do not rely on an active support system. The reliabilities of both doors and dampers are evaluated as part of the multi-compartment analysis using barrier failure probabilities.

Table Q22-1 FPRA Credited Active Partitioning Elements PAU A PAU B Room A Room B Damper Door Drawing 0-31H_A 2-31C C-015 II-030 3 HR-3-17-1-2 N/A C-1786 0-31H_A 0-31H_B C-015 II-055 3 HR-3-17-1-1SC N/A C-1786 3 HR-3-8-2-1SC, 0-32A_A 1-32B C-100 I-111 N/A C-1781 3-8-2-2 3 HR-3-8-2-3, 3-8-2-4, 0-32A_A 1-32I C-100 I-128 1.5 HR Fire Door 37 C-1781 3-8-2-5SC, 3-8-2-6 3 HR-3-17-2-1, 0-32A_A 2-32B C-100 II-111 N/A C-1781 3-17-2-2SC 3 HR 3-17-2-3, 3-17-2-4, 0-32A_A 2-32I C-100 II-128 1.5 HR Fire Door 38 C-1787 3-22-2-1SC, 3-22-2-2 0-22C 0-22A C-116 C-120 3 HR-3-21-2-1 N/A C-1747 3 HR-3P-21-4-22SC, 0-24E 0-24F C-202 C-206 3P-21-4-23SC, N/A C-1749 3P-21-4-24SC Duct Enclosure 3 HR-3P-12-4-14SC, 0-24E 0-24F C-202 N/A C-1749 North 698 3P-12-4-15SC Duct Enclosure 3 HR-3P-21-4-20, 0-24E 0-24F C-202 N/A C-1749 South 698 3P-21-4-21 3 HR-3P-12-4-4, 3M-12-4-5, 0-24B 0-24C C-204 C-208 3P-12-4-6, N/A C-1749 3-12-4-17, 3-12-4-18 3 HR-3-8-3-2SC, 3-8-3-3, 0-33H 1-33B C-212 I-219 3 HR Fire Door 221 C-1782 3-8-3-4SC, 3-8-3-5SC

Enclosure 1 to PLA-7984 Page 50 of 105 Table Q22-1 FPRA Credited Active Partitioning Elements PAU A PAU B Room A Room B Damper Door Drawing 3 HR 3-17-3-2SC, 3-17-3-3, 0-33H 2-33B C-212 II-219 3 HR Fire Door 244 C-1788 3-17-3-4SC, 3-17-3-5SC 0-33H 2-33A C-212 II-220 3 HR-3-17-3-1 N/A C-1788 3 HR-3-13-11-3SC, 0-33H 2-34A C-212 II-301 N/A C-1782 3-13-11-4SC 3 HR-3-7-4-1SC, 0-35A Jan-35 C-400 I-422 N/A C-1784 3-7-4-2SC 3 HR-3-22-4-1SC, 0-35A Feb-35 C-400 II-422 3-18-4-1SC, N/A C-1790 3-18-4-2SC 0-26G 0-26F C-401 C-404 3 HR-3-12-6-7 N/A C-1751 0-26G 0-26H C-401 C-409 3 HR-3-12-6-8 N/A C-1751 0-26I 0-26J C-402 C-403 3-21-6-5 N/A C-1751 0-26I 0-26H C-402 C-409 3 HR-3-21-6-6 N/A C-1751 0-26E 0-26H C-406 C-409 3 HR-3-12-6-6 N/A C-1751 0-26A 0-26H C-408 C-409 3 HR-3-21-6-4 N/A C-1751 3 HR-3-12-14-7SC, 3-12-14-8SC, 3-12-14-9, 3M-21-14-13, 3-21-14-15SC, 0-26H 0-26K C-409 C-410 N/A C-1752 3-21-14-16SC, 3-21-14-17SC, 3-21-14-18SC, 3-21-14-19SC, 3-21-14-20SC 0-26H 0-26L C-409 C-411 3 HR-3P-12-14-16 N/A C-1752 3 HR-3-21-14-21, 0-26H 0-26K C-409 C-412 N/A C-1752 3P-21-14-22 3 HR-3P-12-14-14, 0-26H 0-26L C-409 C-413 N/A C-1752 3-12-14-15 3 HR-3P-21-14-23, 0-26H 0-26K C-409 C-414 N/A C-1752 3-21-14-24 0-26H 0-26L C-409 C-416 3 HR-3P-12-14-17 N/A C-1752 0-26K 0-26L C-410 C-411 3 HR-3P-12-14-10 N/A C-1752 3 HR-3-1-1-1, 1-31F_A 1-31E I-052 I-053 N/A C-1780 3-1-1-2 1.5 HR-1.5P-25-2-1, 1.5P-25-2-2, 1-2B 1-2D I-102 I-109 N/A C-1721 1.5P-25-2-3SC, 3-25-2-4

Enclosure 1 to PLA-7984 Page 51 of 105 Table Q22-1 FPRA Credited Active Partitioning Elements PAU A PAU B Room A Room B Damper Door Drawing 1-32B 1-32C I-111 I-112 3 HR-3-4-2-2 N/A C-1781 1-32C 0-32A_B I-112 I-130 3 HR-3-4-2-1 N/A C-1781 3 HR-3-1-2-1, 1-32E 1-32F I-126 I-127 N/A C-1781 3-1-2-2 3 HR-3-9-2-1, 3-9-2-2, 1-32F 1-32I I-127 I-128 1.5 HR Fire Door 35 C-1781 3-9-2-3, 3-9-2-4 1-33B 1-33A I-210 I-220 3 HR-3-4-3-1SC N/A C-1782 3 HR-3-1-3-1, 1-33D 1-33B I-216 I-217 N/A C-1782 3-1-3-2SC 3 HR-3-16-1-1, 2-31F_A 2-31E II-052 II-053 N/A C-1786 3-16-1-2 3 HR-3-16-1-3, 2-31F_B 2-31K II-054 II-058 N/A C-1786 3 HR-3-16-1-4 2-2A_A 2-2A_B II-105 II-109 1.5 HR-1.5-32-2-2 N/A C-1729 2-32B 2-32C II-111 II-112 3 HR-3-13-2-2 N/A C-1787 2-32C 0-32A_D II-112 II-130 3 HR-3-13-2-1 N/A C-1787 3 HR-3-16-2-1, 2-32E 2-32F II-126 II-127 N/A C-1787 3-16-2-2 3 HR-3-22-2-1SC, 2-32F 2-32I II-127 II-128 3-22-2-2, 1.5 HR Fire Door 36 C-1787 3-22-2-3 3 HR-3-16-3-2, 2-33D 2-33B II-216 II-217 N/A C-1788 3-16-3-3 Audit Question Q-023 EITHER:

Confirm that all internal events modeling updates performed to resolve internal event F&Os that could impact fire risk were incorporated into the FPRA.

OR:

If the licensee cannot confirm that all internal events modeling updates performed to resolve F&Os that could impact fire risk were incorporated into the FPRA, then explain how the licensee will ensure that all internal events modeling updates performed to resolve F&Os that could impact fire risk are incorporated into the FPRA prior to implementation of the RICT program.

Enclosure 1 to PLA-7984 Page 52 of 105 OR:

Explain how all the internal events modeling updates performed to resolve internal event F&Os have an inconsequential impact on the RICT calculations contribution from FPRA.

Susquehanna Response The Susquehanna PRA utilizes a common backbone model (CBM) that is shared across multiple hazards; FPIE, FPRA, and IFPRA. The CBM consists of fault tree logic (with hazard-specific flags, hazard specific HRA, mitigating system logic, accident sequence logic, etc.), flag logic, mutually exclusive logic, and recovery logic. Along with the CBM, hazard specific FRANX files are used to insert hazard specific data, initiating events, etc. into the CBM. In short, one logic model is used across all hazards.

Based on the CBM approach, FPIE modeling updates are also reflected in that hazard-specific models. The same is true for logic changes made during FPRA or IFPRA model updates.

Audit Question Q-024 Confirm whether the licensee used any reduced transient HRRs [Heat Release Rates] below the bounding 98 percent HRR of 317 kilowatts (kW) from NUREG/CR-6850. If yes, then EITHER:

Demonstrate that using reduced transient HRRs has an insignificant impact on this application.

OR:

Justify the use of the reduced HRRs, including:

Identification of the fire areas where a reduced transient fire HRR is credited and what reduced HRR value was applied.

A description for each location where a reduced HRR is credited, and a description of the administrative controls that justify the reduced HRR, including how location-specific attributes and considerations are addressed. Include a discussion of the required controls for ignition sources in these locations and the types and quantities of combustible materials needed to perform maintenance. Also, include discussion of the personnel traffic that would be expected through each location.

Enclosure 1 to PLA-7984 Page 53 of 105

The results of a review of records related to compliance with the transient combustible and hot work controls.

Susquehanna Response Based on the criteria established in Section 3.4 of the Fire Modeling Treatments Notebook (Reference 40), a 145 kW HRR is applied to transient fire scenarios in the following PAUs:

0-28A-I: U2 DIV II EQUIPMENT ROOM

0-28A-II: U2 DIV I EQUIPMENT ROOM

0-28B-I: U1 DIV II EQUIPMENT ROOM

0-28B-II: U1 DIV I EQUIPMENT ROOM The bounding heat release rate for transient fires provided in NUREG/CR-6850 Volume 2, and Supplement 1 (Reference 36) was used in locations where a large number of combustibles could be stored. These include most general locations in the plant such as large equipment areas, general floor areas, and storage areas. Many locations in the plant are small rooms where walking/storage room is very limited. For example, narrow corridors, switchgear rooms, and DC equipment rooms. A smaller transient would be expected in these types of areas and is justified in this section. The use of a lower HRR is considered applicable based on a detailed review of the NUREG/CR-6850 transient fire test. The transient fire test used as the basis of the NUREG/CR-6850 HRR includes:

The Nowlen Test with and without acetone

The Van Volkinburg Test which were performed in conditions that are not consistent with the spatial characteristics of areas of concern in the Fire PRA

The Chavez test which are similar to the Nowlen test with acetone

The Lee test which are similar to the Nowlen test with acetone

The Cline test which were not considered in NUREG/CR-6850 Based on the test characterizations, the Van Volkinburg and Cline test are not considered applicable. The remaining tests are grouped as follows,

Transient fires without wood or acetone: HRR 12 - 60 kW

Enclosure 1 to PLA-7984 Page 54 of 105

Transient fires with acetone: HRR 32 - 145 kW

Transient fires with wood: HRR 186 - 327 kW The 145 kW heat release rate represents the possibility that acetone would be present in any combustible fuel packages in these PAUs. Wood is not a material that would be brought to that elevation for use in maintenance activities. More likely combustible materials would include rags and any fluids needed to complete the electrical maintenance for the DC switchgear, battery chargers, and other electrical equipment in these PAUs.

These PAUs are the Unit 1 and Unit 2 DC Equipment Rooms (Division 1 and Division 2). They contain equipment limited to DC power distribution, and equipment required to support station batteries. These PAUs are small rooms with limited floor space available for storage and maintenance activities. Per Susquehanna drawing C-1754 (Reference 41) these PAUs are combustible restricted areas. Combustibles are restricted based on Susquehanna procedure NDAP-QA-0440 (Reference 42), which establishes the permitting process for combustible materials in the plant. Attachment B of this procedure explicitly states the following: No transient combustibles are to be stored at any location on Elevation 771 of the Control Structure. Attachment A of NDAP-QA-0440 provides the permit form for combustible or hazardous materials.

Susquehanna Calculation EC-013-1860 (Reference 43) provides recommendations and compensatory measures for the handling of transient combustibles in the Restricted Areas (Red Zones), which the 771 elevation of the Control Structure is considered.

On the entire floor for Elevation 771 of the Control Structure, the Fire Hazards Analysis contained in calculation EC-013-1846 limits the introduction of transient combustibles.

Therefore, if any transient combustibles need to be stored in the Restricted Area (Red Zone) for these fire zones, a continuous fire watch should be deployed.

The fire load limits for the safety related areas of the plant are shown on drawing C-1929 (Reference 44) and the CRIMP. All permits for transient combustibles must be approved by the site fire protection engineer and entered into CRIMP. To exceed any allowable combustible limit requires specific technical justification and/or specific compensatory actions and approval by the Site Fire Protection Engineer in accordance with Reference 42.

In addition, it is reasonable to assume a limited need for maintenance activities based on the equipment located within the room. Occupancy for these PAUs is generally low based on the function, size of these PAUs, and considering that these PAUs do not represent typical access/egress paths through the Control Structure. Personnel traffic would be limited to routine inspections by operations and security personnel. For these reasons, the 145 kW HRR was

Enclosure 1 to PLA-7984 Page 55 of 105 selected. This lower HRR is reflected in the input parameters used in the Fire Modeling Workbook (Reference 40).

A review of past violations of the transient combustible and hot work controls in these PAUs was performed by querying the plant ActionWay database. The ActionWay search included the following keywords and was performed for records created on or after January 1, 2018:

housekeeping returned 1472 records, of which only 2 were related to the 771 elevation of the control structure. Neither of these violations were related to combustible material.

combustible returned 1070 records, of which only 3 were related to the 771 elevation of the control structure. None of these violations were related to combustible material.

violation returned 1059 records, of which none were applicable to the 771 elevation of the control structure.

The use of three years of historical records to reflect the current operating practices is consistent with what has previously been considered representative operating experience for other licensee applications. Furthermore, because the fire protection program at Susquehanna has demonstrated consistently improved performance since the initial rollout of the FPRA results in 2018, it would not be representative of current operating practice to include more than three years. Based on the results of this review, the application of the 145 kW HRR in these select PAUs is appropriate.

Audit Question Q-025

a. Describe the treatment of sensitive electronics for the FPRA and explain whether it is consistent with the guidance in FAQ [Frequently Asked Question] 13-0004, including the caveats about configurations that can invalidate the approach (i.e., sensitive electronics mounted on the surface of cabinets and the presence of louver or vents).

b. If the treatment of sensitive electronics for the FPRA includes deviations from FAQ 13-0004, then:

EITHER:

Identify the deviations, and justify (e.g., through a sensitivity calculation) that the treatment of sensitive electronics has no consequential impact on the RICT calculations.

OR:

Identify appropriate RMAs for this key assumption, consistent with the treatment of key assumptions in NEI 06-09-A, prior to implementation of the RICT program.

Enclosure 1 to PLA-7984 Page 56 of 105 Susquehanna Response Question 25.a:

The treatment of sensitive electronics in the SSES FPRA is consistent with the guidance provided in FAQ 13-0004 (Reference 45). FAQ 13-0004 supports use of the damage threshold for thermoset cables for assessing the potential for thermal damage to solid-state and sensitive electronics within an electrical cabinet. The presence of sensitive electronics mounted on the surface of cabinets and the presence of louvers or vents were considered during the ignition and scenario development walkdowns. In general, no sensitive electronics were observed to be located outside of the cabinets or robust enclosures (i.e., caveats in FAQ 13-0004 were not observed). Based on this observation, the application of the lower damage criteria (per NUREG/CR-6850, Section H.2 (Reference 36)) was not warranted.

Question 25.b Not applicable. See response to Question 25.a.

Audit Question Q-026

a. Confirm and provide the minimum joint HEP [JHEP] value assumed in the FPRA.

b. EITHER:

If the FPRA used a minimum joint HEP value of less than 1E-05, then demonstrate (e.g.,

through a sensitivity study) that the minimum joint HEP value(s) used have an inconsequential impact on the RICT application. If a sensitivity study is performed, then provide a description of and the quantitative results from the sensitivity study. Describe the process that will ensure the impact of JHEP values below the thresholds used in future PRA model revisions remains minimal.

OR:

If the licensee cannot justify that the minimum joint HEP value has an inconsequential impact on the application, then:

Confirm that each FPRA joint HEP value below 1E-5 includes its own justification that demonstrates the inapplicability of the NUREG-1792 lower value guideline (i.e.,

using such criteria as the dependency factors identified in NUREG-1921 to assess level of dependence). Provide an estimate of the number of these joint HEP values below 1.0E-5, discuss the range of values, and provide at least two different examples

Enclosure 1 to PLA-7984 Page 57 of 105 where this justification is applied. Describe how JHEPs below the thresholds will be tracked as the PRA models evolve.

If the licensee cannot justify joint HEP values used in the fire PRA below 1E-5, then identify appropriate RMAs for this key assumption, consistent with the treatment of key assumptions in NEI 06-09-A, prior to the implementation of the RICT program.

Susquehanna Response Question 26.a Section 4.1.3 of the SSES Fire HRA Notebook (Reference 46) describes the Dependency Analysis assessment process and quotes Section 6.2 of NUREG-1921 (Reference 47) which states the following:

For fire HRA, it is recommended that the application of a lower bound follow the same guidance as was applied to the internal events PRA.

The SSES FPRA applies the same lower bounds applied in the SSES FPIE: a general joint HEP (JHEP) floor value of 1.00E-06 and if one or more of the independent constituent actions within the combination has more than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months available, the applied floor value is 5.00E-07. This second JHEP floor value captures the multiple recovery opportunities inherent to long-term actions, including a change of shift personnel which will involve a complete reevaluation of plant status.

Question 26.b A sensitivity analysis was performed where all JHEPs nominally less than 1.00E-05 were escalated to 1.00E-05. Table Q26-1 summarizes the results of this sensitivity on a sample of RICT calculations. The sample TS cases were selected because they represent the cases that would most likely be impacted by the assumption and produce RICT estimates less than 30 days.

As shown in Table Q26-1, the delta Fire CDF values are essentially unchanged from the base FPRA model (which uses the 1.00E-06 / 5.00E-07 JHEP floor values). Since the delta values are essentially unchanged, the RICT estimates (in days) are also essentially unchanged.

Therefore, the JHEP floor values used in the FPRA do not impact the results of the RICT calculations and use of the lower JHEP floor values (i.e., 1.00E-06 / 5.00E-07) are appropriate for implementation of the RICT Program.

Enclosure 1 to PLA-7984 Page 58 of 105 Future updates to the FPRA dependency analysis will review the sensitivity of the JHEP floor value.

Table Q26-1 JHEP Floor Value RICT Calculation Sensitivity Results for FPRA (FPIE, IFPRA & Seismic Results Remain Unchanged for Sensitivity Analysis)

Unit 1 Base Results Q26 Unit 1 Sensitivity Results (Minimum JHEP = 1.00E-05)

RICT RICT CDF Estimate Estimate RICT Delta Delta Delta Delta Delta Case Description Vs. (Days) (Days) %

FPIE IFPRA Fire Seismic Fire LERF (30 Day (30 Day Change Maximum) Maximum)

TS 3.3.5.1.B Instrumentation LERF 3.00E-10 0.00E+00 3.18E-05 5.10E-07 11.3 3.18E-05 11.3 ~0.00%

ECCS - As required by Required Action A.1 TS 3.5.1.A One Low CDF 2.25E-07 1.84E-08 4.98E-04 1.70E-06 7.3 4.98E-04 7.3 ~0.00%

Pressure ECCS Subsystem Inoperable TS 3.5.1.G One ADS Valve CDF 2.33E-07 1.45E-06 4.98E-04 1.70E-06 7.3 4.98E-04 7.3 ~0.00%

and Condition A (i.e., One CS Loop)

TS 3.7.2.A One ESW Pump CDF 1.74E-06 1.63E-05 9.56E-04 1.70E-06 3.7 9.56E-04 3.7 ~0.00%

in Each Subsystem TS 3.8.1.C Two Offsite CDF 3.72E-05 3.09E-05 4.66E-04 1.70E-06 6.8 4.67E-04 6.8 -0.17%

Circuits Inoperable Audit Question Q-027 Describe how fire propagation outside of well-sealed MCC cabinets greater than 440 V is evaluated. If well-sealed cabinets less than 440 V are included in the Bin 15 count of ignition sources, then provide justification for using this approach.

Susquehanna Response In accordance with FAQ 14-0009 (Reference 48), certain MCCs were considered sealed such that a split fraction for non-arcing fires could be applied. A factor of 0.23 was used to represent the fraction of fires assumed to breach a well-sealed MCC cabinet (these are considered to be arching fires). Non-arcing fires were considered to not propagate beyond the MCC itself.

For MCCs with vertical sections that were not well-sealed, the numerator and denominator of the ignition frequency was modified to reflect the portion of the MCC that was not well-sealed

Enclosure 1 to PLA-7984 Page 59 of 105 (e.g., one not well-sealed section out of seven total vertical sections). For these not well-sealed sections of the MCC, no factor was applied to credit the lack of propagation. This treatment is consistent with the guidance presented in FAQ 14-0009.

Well-sealed cabinets less than 440 V are not included in the Bin 15 count of ignition sources.

Audit Question Q-028 Provide a sensitivity study or other justification demonstrating that assigning weighting factors of 50 per the guidance in FAQ 12-0064 has an inconsequential impact on the RICT calculations.

Susquehanna Response The Susquehanna FPRA currently does not apply a very high transient influence factor (TIF) of 50 (from FAQ 12-0064) to any PAU. FAQ 12-0064 (Reference 49) does not explicitly require the use of the full range of ratings, as shown below:

The full range of the numerical ranking values is available to the analyst and should, at least nominally, be exercised for each location set. If the full range of the ranking factor values is not exercised, then fire frequency will be distributed more evenly to the applicable fire compartments. If the analyst concludes that a relatively even distribution is the correct answer for the plant and location set, then it is recommended that an explanation should be provided in the PRA documentation.

In order to determine the relative TIF ratings, a panel was held including the plant fire protection engineer and a representative from mechanical maintenance. This panel concluded that no PAUs within the plant generic locations had a level of maintenance or hotwork significantly higher than other PAUs assessed as high. Therefore, the very high rating was not used. An even distribution is more appropriate given that no PAUs are outliers that would warrant an application of the very high factor of 50.

TIFs were assigned to each PAU relative to the other PAUs within the same plant area (Control-Aux-Reactor, Turbine Building, or Plant Wide). A summary of the results of the relative rankings of each PAU within the generic locations are shown in the figures below. In the bar graphs, the vertical axis shows the number of PAUs in each generic location assigned to each of the influence factors. In general, these graphs show that the distribution of TIFs meets the intent of the FAQ by following a bell curve shape with a majority of the PAUs assigned to the average factor. No PAUs are assigned to extremely low, very low, or very high ratings.

Enclosure 1 to PLA-7984 Page 60 of 105 Control-Aux-Reactor 100 90 80 70 60

of PAUs Maintenance 50 Hotwork 40 Occupancy 30 Storage 20 10 0

No Extremely Very Low Low Average High Very High Low Figure Q28-1 Transient Influence Factor Results for Control-Aux-Reactor Generic Location Turbine Building 50 45 40 35 30

of PAUs Maintenance 25 Hotwork 20 Occupancy 15 Storage 10 5

0 No Extremely Very Low Low Average High Very High Low Figure Q28-2 Transient Influence Factor Results for Turbine Building Generic Location

Enclosure 1 to PLA-7984 Page 61 of 105 Plant Wide 10 9

8 7

6

of PAUs Maintenance 5 Hotwork 4 Occupancy 3

Storage 2

1 0

No Extremely Very Low Low Average High Very High Low Figure Q28-3 Transient Influence Factor Results for Plant Wide Generic Location As a sensitivity, the PAUs were reviewed and four PAUs were identified as the most likely candidates for the very high TIF. These PAUs are as follows:

1-31F_A: Unit 1 Pump Area/Snubber Test Room

2-31F_A: Unit 2 Pump Area/Snubber Test Room

1-36A: Unit 1 H&V Equipment Room

2-36A: Unit 2 H&V Equipment Room For these PAUs, the maintenance and hotwork categories were elevated from high to very high as a bounding assessment. This change resulted in an increase in the full-room burnup TIF from 8.23E-04 per year to 3.11E-03 per year for each PAU. Table Q28-1 summarizes the results of this sensitivity on a sample of TSTF-505 RICT calculations. The sample TS cases were selected because they represent the cases that would most likely be impacted by the assumption and produce RICT estimates less than 30 days.

As shown in Table Q28-1, the delta Fire CDF values are essentially unchanged from the base FPRA model (which uses the high TIF for maintenance and hotwork). Since the delta values are essentially unchanged, the RICT estimates (in days) are also essentially unchanged.

Enclosure 1 to PLA-7984 Page 62 of 105 Therefore, the use of very high TIFs does not impact the results of the RICT calculations and use of the base FPRA TIFs is appropriate for implementation of the RICT Program.

Table Q28-1 Very High TIF Value RICT Calculation Sensitivity Results For FPRA (FPIE, IFPRA & Seismic Results Remain Unchanged for Sensitivity Analysis)

Unit 1 Base Results Q28 Unit 1 Sensitivity Results (Very High TIF for 4 PAUs)

RICT RICT CDF Estimate Estimate RICT Delta Delta Delta Delta Delta Case Description vs. (Days) (Days) %

FPIE IFPRA Fire Seismic Fire LERF (30 Day (30 Day Change Maximum) Maximum)

TS 3.3.5.1.B Instrumentation LERF 3.00E-10 0.00E+00 3.18E-05 5.10E-07 11.3 3.18E-05 11.3 ~0.00%

ECCS - As required by Required Action A.1 TS 3.5.1.A One Low CDF 2.25E-07 1.84E-08 4.98E-04 1.70E-06 7.3 4.98E-04 7.3 ~0.00%

Pressure ECCS Subsystem Inoperable TS 3.5.1.G One ADS CDF 2.33E-07 1.45E-06 4.98E-04 1.70E-06 7.3 4.98E-04 7.3 ~0.00%

Valve and Condition A (i.e., One CS Loop)

TS 3.7.2.A One ESW CDF 1.74E-06 1.63E-05 9.56E-04 1.70E-06 3.7 9.56E-04 3.7 ~0.00%

Pump in Each Subsystem TS 3.8.1.C Two Offsite CDF 3.72E-05 3.09E-05 4.66E-04 1.70E-06 6.8 4.67E-04 6.8 -0.04%

Circuits Inoperable Audit Question Q-029 Many plants have Unit 1 and 2 adjoined and, thus, have common areas. For these plants, the risk contribution from fires originating in one unit must be addressed for impacts to the other unit given the physical proximity of the other unit and common areas. Therefore, confirm whether Units 1 and 2 have common areas and shared systems, and if yes, then:

a. Explain how the risk contribution of fires originating in one unit is addressed for the other unit given the impacts from the physical proximity of equipment and cables in one unit to

Enclosure 1 to PLA-7984 Page 63 of 105 equipment and cables in the other unit. Include identification of locations where fire in one unit can affect components in the other unit.

b. Explain how the FPRA addresses contributions of fires in common areas that can impact components in both units, including the risk contribution of such scenarios. If any such scenarios are not addressed in the FPRA, then provide justification that their exclusion does not impact this application.

Susquehanna Response Susquehanna does have common areas and shared systems within those areas.

Question 29.a Fires originating in one unit can impact equipment and cables on the opposite unit. One example of this occurrence is a multi-compartment fire scenario between two PAUs that border one another but are supporting opposite units. In these scenarios, equipment and cables in both PAUs are subject to the damage vector of the fire. The risk contribution of fires on the opposite unit is accounted for by quantifying all fire initiators for all unit endstates. This means that Unit 2 fire initiators are quantified in the Unit 1 FPRA model and vice versa. Review of the FPRA shows the fire initiators that appear in cutsets when the opposite unit is quantified. The cross-unit impacts are captured in the quantification through the cable to raceway to equipment to basic event mapping. In addition, all fires are assumed to result in at least a turbine trip in the analyzed unit, regardless of the fire-induced failures (i.e., a fire in Unit 1 is assumed to result in a turbine trip in Unit 2 for the Unit 2 FPRA model, and vice versa).

The fire scenario development methodology used in the FPRA requires that all targets within the zone of influence (ZOI), regardless of location within the respected units, be selected and analyzed for fire-induced failure. For example, for fire scenarios postulated in common areas, where targets from both units are within the ZOI, all targets are failed due to fire-induced damage and the impact on the units fire risk was evaluated based on the component and cable selection associated with that unit.

Many fire zones include cable routing that can impact basic events associated with the opposite unit. The following is a sample of fire scenarios which include impacts on both units:

%F5_0-28A-II:0-28B-II_-_M (Multi-compartment fire scenario between 0-28A-II and 0-28B-II on the 771 elevation of the Control Structure)

%F1_233B_-_W (Iso-phase Bus Duct/Boiler/Alcove area on the 683 elevation of the Unit 2 Turbine Building)

Enclosure 1 to PLA-7984 Page 64 of 105

%F1_15AN_1B253_E_OR (Sever fire at MCC 1B253 in 1-5A-N on the 749 elevation of the Unit 1 Reactor Building (RB))

Question 29.b See response to part (a). In addition, common area fires include cable and equipment from both units within the damage vector. No common area fires were excluded from consideration in the FPRA. A sample of risk contributions from several common areas is provided in Table Q29-1.

This list is not comprehensive of all common area risk contributors.

Table Q29-1 Sample of Common Area CDF Contributions Unit 1 CDF Fussell- Unit 2 CDF Fussell-PAU Vessely Vessely 0-26H - CONTROL ROOM 36.38% 28.94%

D DIESEL GENERATOR BAY A 2.93% 0.37%

0-26R - TSC SOUTH OFFICE SOFFIT 0.02% 8.66%

0-26I - SHIFT SUPERVISOR'S 0.01% 7.18%

OFFICE Audit Question Q-030 LAR Enclosure 9, Table E9-2, states that the Human Reliability Analysis (HRA) for the fire PRA was performed using industry consensus modeling approaches but does not cite use of NRCs most current guidance on fire HRA, NUREG-1921, EPRI/NRC-RES Fire Human Reliability Analysis GuidelinesFinal Report (ADAMS Accession No. ML12216A104). It is not clear if the licensee considered this guidance in its HRA. Therefore:

a. Confirm whether the licensee considered the guidance in NUREG-1921 to perform the HRA for the fire PRA. If it did, then describe any deviations from the guidance that could be characterized as potential key assumptions or sources of modeling uncertainty.

b. If in response to part (a) deviations from the guidance in NUREG-1921 could be characterized as assumptions or sources of modeling uncertainty, then justify that this modeling uncertainty has an inconsequential impact on the application (e.g., by performing a sensitivity study). If it cannot be determined that this modeling uncertainty has an inconsequential impact on the estimated RICTs, then identify programmatic changes to compensate for this uncertainty and the basis for them (e.g., identification of additional

Enclosure 1 to PLA-7984 Page 65 of 105 RMAs, program restrictions, or the use of bounding analyses which address the impact of the uncertainty).

Susquehanna Response Question 30.a The SSES Fire HRA was heavily informed by NUREG-1921 (Reference 47) as documented in the Applied Guidance sections located throughout EC-RISK-1185 (Reference 46). The guidance presented in NUREG-1921 was largely followed, with some minor exceptions. Most notably, the treatment of fire impacts on accessibility for actions executed outside of the control room, and the scope of errors of commission (EOCs), deviated from the guidance.

Actions Taken Outside the Control Room Rather than evaluate the specific travel paths for all locally executed actions with respect to the locations of all potentially consequential fires (as described in NUREG-1921 section 4.3.4.5), a more general but bounding approach was taken. Table 3.1-2 of EC-RISK-1185 documents the availability of unique or multiple pathways to each execution location. Actions with unique pathways were failed for fire scenarios that prohibited access to the execution location. For actions where access would be available, a bounding access delay of ten minutes (estimate obtained during operator interviews) was applied to the execution time for all locally executed actions unless the cue occurred over four hours after the fire at time zero. After four hours, the fire was expected to be extinguished, and fire-fighting equipment removed (i.e., access delays were considered unlikely).

This deviation from NUREG-1921 guidance is addressed by the Operating Environment uncertainty source evaluated in Table 5.1-1 of EC-RISK-1185 which recognizes that, conservatism is introduced when the most limiting or challenging conditions are applied.

However, this deviation is characterized as having an inconsequential impact on the application as it does not result in a significant impact on the credited operator actions.

Errors of Commission (EOC)

Section 3.4.1 of NUREG-1921 involves identifying EOCs. While the alarm response procedures were individually reviewed to assess the potential for EOCs, Emergency Operating Procedures (EOPs) were not reviewed for EOCs based on observations documented in NUREG-1921.

Namely, EOP-based parameters have redundant channels such that a single spurious indication (as required to meet CC-II of SRs HRA-A3 and HRA-B4) would not mislead an operator and the symptom-based EOPs are designed to provide additional confirmation after significant decision points to allow the crew to correct any misdiagnoses. Further, the operators can identify protected or Safe Shutdown Equipment List (SSEL) indications for specific fire areas by using

Enclosure 1 to PLA-7984 Page 66 of 105 Attachment A, Protected Safe Shutdown Equipment found in procedure ON-013-001, Response to Fire.

EOCs during the performance of EOPs are considered to be low likelihood events. The EOPs are symptom based, requiring multiple verification steps. Considering how fires impact cables, multiple unrelated alarms would likely come in at the same time, which would be unusual, and prompt additional review and scrutiny. Furthermore, if such an error was committed, recovery would be likely; it is recognized that some errors (e.g., depressurization) cannot be recovered.

For such critical decisions, operators are highly sensitive to performing such actions and multiple verifications, in consultation with the rest of the crew, would be performed. In short, the likelihood of performing an unrecoverable error from the EOPs would be extremely low.

Based on this assessment, this deviation is characterized as having an inconsequential impact on the application.

Question 30.b See response to part (a). In summary, no deviations from NUREG-1921 guidance constitute significant sources of uncertainty.

Audit Question Q-032 Justify that using a plant-level HCLFP [sic] capacity of 0.3g is sufficient for estimating a bounding seismic CDF for this application given that there are plant SSCs with a HCLFP [sic]

capacity of 0.21g. Include discussion of the cited outliers that were identified in the SSES IPEEE [Individual Plant Examination of External Events] and the resolutions of those outliers for this application.

Susquehanna Response As discussed in Section 1.4, Summary of Major Findings, of the SSES IPEEE Submittal (Reference 50), the SSES IPEEE seismic margins assessment (SMA) identified four items (two valves and two electrical cabinets) which are acceptable in terms of the SSES seismic design basis but are considered "outliers when screened against the seismic margins earthquake (SME) of 0.3g Peak Ground Acceleration (PGA). These items are either not strictly required for the SSES SMA SSEL or may be manually operated after the SME.

The sufficiency of the 0.3g value IPEEE screening level as a plant-level High Confidence of Low Probability of Failure (HCLPF) was evaluated in Susquehanna calculation EC-RISK-0045 (Reference 51), and includes discussion of cited outliers with HCLPF values determined to be less than 0.3g in the SSES IPEEE report along with resolutions for those outliers. EC-RISK-0045 was provided to the NRC to support the Regulatory Audit. Section 2.3.2 of EC-RISK-0045 is presented in its entirety below.

Enclosure 1 to PLA-7984 Page 67 of 105 In addition to the discussion from EC-RISK-0045 presented below, it is noted that the lowest HCLPF values of 0.21g PGA are driven by seismic interaction of inline piping components.

These fragilities will be governed by displacement which is based on low frequency response.

The IPEEE SME exceeds the Ground Motion Response Spectra (GMRS) by significant margins at low frequencies, and therefore it is expected that higher fragility values would be determined if the GMRS were considered in place of the IPEEE SME.

Group 1 Outliers Section 2.3.1 of EC-RISK-0045 provides a review of group 1 outliers. This information is based on the following discussion in NE-94-001, Volume 1, page 1-3:

Four issues were identified during the course of plant walkdowns where actual field installation did not conform with seismic design qualification test configuration. These issues are: small trolley cranes attached to the top of switchgear cabinets to aid in the maintenance of breakers; control room and relay room cabinets which were originally qualified as individual units, but which are installed in long rows; instances of missing or broken fasteners on electrical equipment cabinets and non-seismic equipment in close proximity; and anchorage of control room CRTs [Cathode Ray Tubes].

For these items, walkdowns were performed and documented as follows:

Resolution of the small trolley cranes attached to the top of switchgear cabinets is documented in NE-94-001, Volume 1, page 3-40:

EDR 94-018 was written to address the breaker hoists on the switchgear. The breaker hoists were removed. A calculation was performed to evaluate the effect of the remaining steel associated with the breaker hoist assembly on the seismic qualification of the switchgear. The switchgear's SQRT [Seismic Qualification Review Team] binder was updated to reflect the breaker hoist issue.

Control room and relay room cabinets.

Control room CRT anchorages.

Regarding bullets two and three, the scope of the outliers is documented in NE-94-001, Volume 1, pages 3-77 to 3-88. Eight items are listed, and two outliers are identified:

Systems Interaction: Yes - Two Outliers

Enclosure 1 to PLA-7984 Page 68 of 105

1. At several locations inside the control and relay rooms, adjacent panels in close proximity to each other are not fastened together. This is considered as a deficient condition for the reasons stated above.

2. The existing supports for the color video CRTs in panels #C651 and C601 cannot positively restrain the lateral movement of the CRTs since there is no positive connection between the CRT and its support.

Outliers Resolution All outliers are being resolved through the SSES Deficiency Management Program.

Specific to item 1, Engineering Deficiency Report (EDR)94-030 was created to track this issue.

This EDR was later converted to Condition Report (CR) CR-51636. As part of closing this CR, Action 71646 was performed. The closure required the generation and completion of design changes 95-9047 and 95-9048. Based on the status of CR-51636, EDR 94-030 is closed.

Specific to item 2, EDR 94-039 was created to track this issue. Because a documented resolution to this EDR cannot be identified, a walkdown was performed to verify that the supports for color video CRTs in Main Control Room panels #C651 and #C601 can positively restrain lateral movement. The walkdown identified that the CRTs have been removed from panel #C651 and panel #C601. Panel #C651 now has LCD monitors. As a result, item 2 is no longer applicable.

Group 2 Outliers

excerpt taken from EC-RISK-0045, Revision 01:

As documented in Section 8 of the IPEEE report [1] these four outliers can be operated manually and the SMA team judged that both safe shutdown (SSD) paths pass the screening criteria of 0.3g. Table 2.3-2 presents the four outliers and their corresponding HCLPF values.

1 Note that reference numbers listed in the excerpt from calculation EC-RISK-0045 are the reference numbers within EC-RISK-0045. The references are not necessarily included in the reference list of this enclosure. Key references are listed at the end of the calculation excerpt.

Enclosure 1 to PLA-7984 Page 69 of 105 Table 2.3-2 List of the Outliers in Group 2 with their corresponding HCLPF (g) values Corresponding Item Component Component Limiting HCLPF Section in No. Description ID Condition (g)

Reference 1 1 HPCI Pump HV-155- Potential impact 0.21 3.10.6.8 Discharge F006 with non-Q valve Valve 2 RHR-SPCMb HV-251- Potential impact 0.21 3.10.6.8 Suppression F024B with adjacent Pool Inlet platform handrail Valve 3 Automatic 0ATS556 Potential impact 0.25 3.10.6.23 Transfer with Adjacent Switch HVAC support 4 480V Motor MCC- Potential impact 0.26 3.10.6.1 Control 2B237 with Adjacent Center HVAC support The itemized outliers in Group 2 are discussed briefly as follows:

HPCI Pump Discharge Valve (HV-155-F006) and RHR-SPCMb Suppression Pool Inlet Valve (HV-251-F024B)

As documented in the IPEEE report [1]: Valve HV-155-F006 is evaluated by EPRI 6041 methodology, the governing failure mode is the clearances between the SSEL valve HV-155-F006 and the adjacent valve 155018, valve PSV-15513, and pipe support SP-DBB-120-H2003 are noted to be about 1-1/4, 1/4", and 1", respectively.

As documented in the IPEEE report [1]: Valve HV-251-F024B is evaluated by EPRI 6041 methodology, the governing failure mode is the clearance between the valve and adjacent handrail. The clearance between the operator of the SSEL valve HV-251F024B and a handrail is noted to be about 1/2".

These outliers are judged to not impact the determination of a plant limiting HCLPF for use in risk-informed applications for the following reasons stated in Reference 1:

1. The dynamic interaction with the adjacent non-Q valve PSV-15513 is the controlling item in the calculated HCLPF value. If impact occurs for SME loading, the affected component on valve HV-155-F006 is the stem protector. Approximately 0.75-inch gap is provided between the stem and the stem protector and consequently should

Enclosure 1 to PLA-7984 Page 70 of 105 impact occur only slight bending of the protector will result and not interfere with valve operation.

2. Valve HV-251-F024B is a normally closed isolation valve for RHR return to the suppression pool. The interaction concern is unlikely to interfere with the isolation function of the valve, i.e., the function is unlikely to be required during the earthquake

[1]. The valve is required to open for suppression pool cooling (SPC). Per IPEEE notes [1] the interaction concern is only expected to affect the operator of the valve, post-earthquake/interaction. Therefore, plant operators can manually stroke the valve.

For the scenarios of concern, the operators would have enough time to manually operate the valve [15, 18]. Even in an unlikely scenario where suppression pool cooling was not initiated before the primary containment pressure limit (PCPL) was reached, there is substantial time (on the order of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or more until containment overpressure failure, assuming the failure of venting), to initiate the SPC by operators within the PRA mission time.

3. Even if valve HV-251-F024B cannot open, as documented in the IPEEE report [1]

alternate shutdown cooling can be established by reactor vessel depressurization, establishing RHR suction from the suppression pool through the RHR heat exchangers to the reactor vessel LPCI lines, and returning to the pool via SRVs.

Severe Accident Mitigation Alternatives (SAMA) [20] concludes, given the existence of an alternate means of using the B RHR loop for DHR [Decay Heat Removal] when valve HV-251-F024B has failed, the capability to open the valve locally for the expected failure mode, and the margin presents in the methodologies used to assess the HCLPF value of 0.21g, no SAMAs are considered to be required to address the seismically induced failure of HV-251-F024B.

The circumstances related to the potential failure of the HPCI injection valve (HV-155-F006) are similar to those for valve HV-251-F024B in that the assessment of 0.21g HCLPF value is considered to be conservative and that another means of providing the affected function is available. In this case, the alternate HPI [High Pressure Injection]

source is another system on the SSEL (RCIC) rather than an alternate use of the same train of the same system. Per SAMA [20], in both cases the affected function is still available. In the event that RCIC fails in conjunction with HV-155-F006, the ADS valves and low-pressure injection/DHR would still be available to provide core cooling. SAMA

[20] concludes that no SAMAs are considered to be required to address the seismically induced failure of HV-155-F006.

Enclosure 1 to PLA-7984 Page 71 of 105 Automatic Transfer Switch (0ATS556) 0ATS556 provides auto transfer of the power supply to E DG MCC under degraded voltage conditions. During normal operation, 0ATS556 ensures that either 13.8 kV Startup Bus 10 or 13.8 kV Startup Bus 20 supplies power via Transformers (13.8 kV/480 VAC) 0X555 or 0X556 to MCC 0B565 [16]. When DG E is in use, however, power to this MCC is supplied from the E DG Bus 0A510 through the Transformer 0X565 [16]

The 0ATS556 supplies power from offsite which is lost in a LOOP [16]. LOOP typically occurs at relatively low hazard levels; so even though the HCLPF of 0ATS556 is significantly higher than typical LOOP occurrence (0.25g vs. 0.1g LOOP), this component would not provide significant seismic mitigation credit.

SAMA (Reference 20) concludes that review of FPIE showed that 0ATS556 automatic switch transfer had no impact on DG availability and would likely serve no purpose in a seismic event. The function of the 0ATS556 automatic transfer switch is to transfer the power supply for Class 1E MCC 0B565 to transformer 0X556. Given loss of power to both of these transformers, the breakers between 0ATS556 and MCC 0B565 automatically open and the MCC is powered from 0X565, which is backed by emergency power. If the seismic event fails 0ATS556, the result is minimal because MCC 0B565 would receive power from transformer 0X565. Therefore SAMA [20] concludes that no SAMA is required to address this issue.

480V Motor Control Center (MCC-2B237)

This component was evaluated by EPRI 6041 methodology, the governing failure mode was the identified 1/16" gap between the vertical HVAC duct stiffener and MCC 2B237.

The gap was found to be sufficient for SSE [Safe Shutdown Earthquake] loads, but insufficient for SME loads. The function of MCC-2B237 is not risk significant in the SSES FPIE [13].

It was on the SSEL to provide depth for suppression pool cooling. MCC 2B237 controls valves for Div. I RHR and RHRSW associated with heat exchanger A and RHR flow to suppression pool. Even if MCC 2B237 fails, time is available for local manual valve operation [1]. Furthermore, as discussed in Section 2.II.i, manual operation of the SPC valves is credited in the HRA calculator via MAN-OP_SPC_E-O (OPERATOR FAILS TO MANUALLY OPEN/CLOSE VALVES FOR SPC EARLY). Based on the HRA calculator, this action represents the probability that plant operators will fail to perform a local, manual valve manipulation to establish decay heat removal. This action is taken when the powered valve operator has failed, and local action can change the state of the valve. This action is only credited for preventing the violation of PCPL in non-ATWS scenarios [17] and therefore has no impact on COPF [Containment Overpressure Failure].

Enclosure 1 to PLA-7984 Page 72 of 105 As documented in SAMA [20], the internal events model has analyzed these operator actions and includes credit for local valve manipulations given the failure of remote operation for loss of DHR scenarios. SAMA [20] concludes that the failure probability of the local valve manipulation has been estimated to be 6E-4 and similar credit is likely available after a seismic event. Given that the RHR and RHRSW valves are located in a seismically sound structure, the environmental performance shaping factors due to building failures should not be an issue. Per SAMA [20] if the Extreme Stress multiplier of 10 from NUREG/CR-1278 (NRC 1983b) is applied to this HEP to account for any psychological effects of the earthquake, the failure probability increases to only 6E-3, which is comparable to the mitigating equipment and alignment failures in previous SAMA submittals (NMC 2005a) (CPL 2004). Per Reference 20, SAMA concludes that no SAMAs are required to address this outlier.

end of excerpt In the excerpt above, the following key References are used:

1. NE-94-001, Susquehanna Steam Electric Station Individual Plant Examination for External Events, Pennsylvania Power & Light Company, June 1994.

20. Appendix E, Applicants Environmental Report - Operating License Renewal Stage Susquehanna Steam Electric Station, PPL Susquehanna, LLC, Unit 1 [Docket No. 50-387, License No. NPF-014], Unit 2 [Docket No. 50-388, License No. NPF-022], September 2006, (Agency wide Documents Access and Management System (ADAMS) Accession No. ML062630235).

Audit Question Q-037 Identify and justify the mechanism that will be used to ensure that the watertight doors will be closed during a flood event to prevent impact on risk significant equipment.

Susquehanna Response The station will enter Susquehanna procedures NDAP-00-0030 (Reference 52), and ON-NATPHENOM-001 (Reference 53), upon receiving a warning for severe weather.

In the event of severe weather or a natural disaster, Susquehanna procedure NDAP-00-0030 directs operators to prepare for severe weather by performing the actions in Attachment A, Severe Weather Preparations Checklist Step 10 of the Operations checklist in Attachment A directs operators to Ensure external flood doors are closed and latched (Doors: 101, 102, 113A, 114A, 119A, 120A, 1614-O, 1615-O, 1616-O, 1617-O, 1701-O, 1704-O, 1705-O, 1706-O, and

Enclosure 1 to PLA-7984 Page 73 of 105 1-3). This procedure is well laid out with clear procedural triggers to initiate the actions required to ensure the doors are closed during an external flooding event.

The procedure defines severe weather as follows:

The Shift Manager has determined that weather conditions have deteriorated to the point that personnel safety or property damage is a concern, even though an official WARNING has not yet been issued. This definition suggests that the Shift Manager has discretion, and that the actions taken in the procedure checklist are not confined to a narrow or specific definition of weather conditions.

It should be noted that during the review of NDAP-00-0030, it was discovered that the doors listed to be closed in the latest revision of the procedure differ slightly from the list provided in Susquehanna calculation EC-RISK-0047, Table 3-1 (Reference 54). The change in required doors is a result of the final calculated flood heights around the site. Specifically, the DG Building (A, B, C, and D) finished floor elevation (677.0 feet NGVD 29) is above the maximum flood level (676.30 feet NGVD 29). The E DG Building elevation (675.5 feet NGVD 29) is above the maximum flood level (675.27 feet NGVD 29) as well, however, the Door 1-3 is located inside a concrete hallway required for missile protection on the bottom of the slope from the main power block. Therefore, water could locally pond to depths higher than the expected max flood height of the surrounding areas. For this reason, E DG Building Door 1-3 is required to be closed for screening the flooding scenario to provide an additional 2.5 feet of protection, but other DG Building doors (1614-O through 1617-O) are not required and considered asset protection measures.

Table Q37-1 Updated List of Doors to be Closed Door Number Unit Building Elevation 119-A 1 RB 676' 101 1 RB 670' 113-A 1 RB 670' 120-A 2 RB 676' 102 2 RB 670' 114-A 2 RB 670 1701-O N/A ESSW 685'-6" 1704-O N/A ESSW 685'-6" 1705-O N/A ESSW 685'-6" 1706-O N/A ESSW 685'-6" 1614-O N/A DGABCD 677' 1615-O N/A DGABCD 677' 1616-O N/A DGABCD 677'

Enclosure 1 to PLA-7984 Page 74 of 105 Table Q37-1 Updated List of Doors to be Closed Door Number Unit Building Elevation 1617-O N/A DGABCD 677' 1-3 N/A DGE 675'-6" Removable Wall Panels N/A DGE 675'-6" Audit Question Q-038 In the LAR, Enclosure 12, Risk Management Action (RMA) Examples, the licensee stated that multiple example RMAs may be considered during a RICT program entry to reduce the risk impact and ensure adequate defense-in-depth. Provide a list of RMAs that will to be considered during the implementation of RICT program relating to the following TS Conditions.

(a) TS 3.8.1, Condition C (b) TS 3.8.4, Condition B (c) TS 3.8.4, Condition C (d) TS 3.8.7, Condition A (e) TS 3.8.7, Condition B (f) TS 3.8.7, Condition C (g) TS 3.8.7, Condition D Susquehanna Response RMAs both for regular and common cause considerations are developed for the specific configuration following the steps outlined in Enclosure 12 of Reference 1. NEI 06-09 (Reference 8) classifies RMAs into the three categories described below (the following items are representative examples, and do not constitute an exhaustive list of all possible actions)

a. Technical Specification 3.8.1, Condition C For TS 3.8.1, AC Sources - Operating, Condition C, Two offsite circuits inoperable, RMAs could include:

Enclosure 1 to PLA-7984 Page 75 of 105

1. Actions to increase risk awareness and control

Briefing of the on-shift operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate procedures for a LOOP and SBO including bus crossties.

Notification of the Transmission System Operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Proactive implementation of RMAs during times of high grid stress conditions prior to reaching the risk management action time, such as during high demand conditions.

2. Actions to reduce the duration of maintenance activities

For planned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a planned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.

Protection of all operable DGs.

Deferral of planned maintenance or testing that affects the reliability of DGs and their associated support equipment; treat these as protected equipment.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected offsite sources.

b. Technical Specification 3.8.4, Condition B For TS 3.8.4, DC Sources - Operating, Condition B, One battery 125 VDC or 250 VDC battery bank inoperable, RMAs could include:

Enclosure 1 to PLA-7984 Page 76 of 105

1. Actions to increase risk awareness and control

Briefing of the on-shift Operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate procedures for a Loss of DC division and SBO.

Briefing of the on-shift operations crew concerning the impact the DC division has on the potential response to plant events such as reduced control systems.

For a planned RICT, prior to removal from service, the actions in the associated loss of bus procedure would be reviewed and implemented.

Minimize activities that could trip the unit.

2. Actions to reduce the duration of maintenance activities

For planned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a planned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase

Evaluation of weather conditions for threats to the reliability of offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.

Protection of the operable DC electrical buses in the unit.

Remove nonessential loads from battery to extend time voltage will remain above minimum required level.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected battery bank.

Enclosure 1 to PLA-7984 Page 77 of 105

c. Technical Specification 3.8.4, Condition C For TS 3.8.4, Condition C, One electrical power subsystem inoperable for reasons other than Conditions A or B, RMAs could include:

1. Actions to increase risk awareness and control

Briefing of the on-shift Operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate procedures for a Loss of DC division and SBO.

Briefing of the on-shift operations crew concerning the impact the DC division has on the potential response to plant events such as reduced control systems.

For a planned RICT, prior to removal from service, the actions in the associated loss of bus procedure would be reviewed and implemented.

Minimize activities that could trip the unit.

2. Actions to reduce the duration of maintenance activities

For planned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a planned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase

Evaluation of weather conditions for threats to the reliability of offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.

Protection of the operable DC electrical buses in the unit.

Remove nonessential loads from battery to extend time voltage will remain above minimum required level.

Enclosure 1 to PLA-7984 Page 78 of 105

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DC subsystem.

d. Technical Specification 3.8.7, Condition A For TS 3.8.7, Distribution Systems - Operating, Condition A, One or more AC electrical power distributions subsystems inoperable RMAs could include:

1. Actions to increase risk awareness and control

Brief shift operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate procedures for a loss of AC distribution

2. Actions to reduce the duration of maintenance activities

For planned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a planned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase

Deferral of elective maintenance on all safety related AC and DC distribution subsystems

Protection of all offsite sources, DGs, and remaining AC power distribution subsystems. Additional equipment may be protected based on the loads lost depending on the specific distribution subsystem that is inoperable.

Performing procedurally required actions for loss of AC distribution subsystem

Prohibition of trip sensitive activities and activities that could result in a plant transient

Minimization of activities on equipment powered by remaining AC distribution subsystems

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected AC distribution subsystem

Enclosure 1 to PLA-7984 Page 79 of 105

e. Technical Specification 3.8.7, Condition B For TS 3.8.7, Condition B, One or more DC electrical power distributions subsystems inoperable RMAs could include:

1. Actions to increase risk awareness and control

Brief shift operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate procedures for a loss of DC distribution

2. Actions to reduce the duration of maintenance activities

For planned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a planned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase

Deferral of elective maintenance on all safety related AC and DC distribution subsystems

Protection of all offsite sources, DGs, and remaining DC power distribution subsystems. Additional equipment may be protected based on the loads lost depending on the specific distribution subsystem that is inoperable.

Performing procedurally required actions for loss of DC distribution subsystem

Prohibition of trip sensitive activities and activities that could result in a plant transient

Minimization of activities on equipment powered by remaining DC distribution subsystems

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DC distribution subsystem

Enclosure 1 to PLA-7984 Page 80 of 105

f. Technical Specification 3.8.7, Condition C (Unit 2 Only)

For Unit 2 TS 3.8.7, Condition C, One Unit 1 AC electrical power distribution subsystem inoperable, [NOTE: There is no commensurate Unit 1 Condition] RMAs would include all the same RMAs as provided previously in item d. However, additional actions to address the Susquehanna electrical design which provides power to equipment common to both units via Unit 1 AC distribution systems could include:

1. Actions to increase risk awareness and control

Discuss common equipment and the specific interdependencies of the Unit 1 and Unit 2 AC distribution subsystems during shift briefings with the operations crew.

2. Actions to reduce the duration of maintenance activities

No additional actions beyond those for a typical loss of AC distribution system.

3. Actions to minimize the magnitude of the risk increase

Protection of the remaining operable Unit 2 equipment that is redundant to the equipment rendered inoperable due to inoperability of the Unit 1 AC distribution source (i.e., protection of the Unit 2 equipment in the opposite division to that rendered inoperable).

g. Technical Specification 3.8.7, Condition D (Unit 2 Only)

For Unit 2 TS 3.8.7, Condition D, Two Unit 1 AC electrical power distribution subsystems on one Division inoperable for performance of Unit 1 SR 3.8.1.19, [NOTE:

There is no commensurate Unit 1 Condition] RMAs would include all the same RMAs as provided previously in items d and f. Due to the increased risk associated with two Unit 1 AC distribution subsystems inoperable (as opposed to only one subsystem for item f), it may be determined prudent to perform more of the potential RMAs previously listed.

Audit Question Q-039 For TSTF-505, the design success criterion is a minimum set of the remaining required equipment that has the capacity and capability to provide the TS safety function. In Table E1-1 of Enclosure 1 of the LAR, the licensee stated that the design success criteria for TS 3.8.1, Condition C (two offsite circuits inoperable), are two offsite circuits. Explain, how, with both required offsite circuits inoperable, can an offsite circuit provide the capacity and capability to safely shut down the reactor and maintain it in safe condition during and after a design basis accident.

Enclosure 1 to PLA-7984 Page 81 of 105 Susquehanna Response The success criterion in Reference 1, Table E1-1, for TS 3.8.1 have been updated as shown in . If both offsite circuits are inoperable, the onsite DGs (any three) will provide power to adequate equipment to achieve and maintain safe shutdown.

Entry into Condition C means that the offsite electrical power system does not have the capability to affect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normal high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis.

Table E1-1 has been revised to correct the Design Success Criteria column for this Condition as shown in Enclosure 2 to this letter.

Audit Question Q-040 For TSTF-505, the design success criterion is a minimum set of the remaining required equipment that has the capacity and capability to provide the TS safety function. In Table E1-1 of Enclosure 1 of the LAR, the licensee describes the direct current (DC) power subsystems design for the design success criteria for TS 3.8.4, Conditions A, B, and C.

a. In the design success criteria for TS 3.8.4, Conditions A, B, and C, the licensee stated that the design success criterion is dependent upon the load supplied. Explain the potential load supplied, as it is not defined in the design success criteria.

Enclosure 1 to PLA-7984 Page 82 of 105

b. For TS 3.8.4, Conditions A, B, and C, the licensee states that one of two subsystems is the design success criterion and that four 125-volt DC (VDC) subsystems are available.

How many 125-VDC subsystems are required to provide the safety function?

c. For TS 3.8.4, Conditions A, B, and C, the licensee states that one of two subsystems is the design success criterion and that two 250-VDC subsystems are available. How many 250-VDC subsystems are required to provide the safety function?

Susquehanna Response Question 40.a The design success criterion is dependent upon the load supplied is explained in each of the TS Bases Actions. The DC load during normal operation can be low and the batteries and the chargers are sized for the DBA Conditions and battery recharge in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The success criteria discussion monitors the actual loading that is on the affected battery when a charger is inoperable and the charger when the battery is considered inoperable.

LCO 3.8.4, Condition A is related to the loss of one battery charger on one 125 VDC Division or the 250 VDC Division 2 or two battery chargers on 250 VDC Division 1. The statement in Table E1-1 concerning the design success criterion is dependent upon the load supplied is not applicable to the battery chargers and it has been removed from Table E1-1 (see Enclosure 2).

LCO 3.8.4, Condition B represents one subsystem with one battery bank inoperable. With one battery bank inoperable, the DC bus is being supplied by the operable battery charger. Any event that results in a loss of the AC bus supporting the battery charger will also result in loss of DC to that subsystem. Recovery of the AC bus, especially if it is due to a loss of offsite power, will be hampered by the fact that many of the components necessary for the recovery (e.g., DG control and field flash, AC load shed, and DG output circuit breakers) may rely upon the battery.

In addition, the energization transients of any DC loads that are beyond the capability of the battery charger and normally require the assistance of the battery will not be able to be brought online. The two hour limit allows sufficient time to effect restoration of an inoperable battery bank given that the majority of the conditions that lead to battery inoperability (e.g., loss of battery charger, battery cell voltage less than 2.07 V) are identified in TS 3.8.4, 3.8.5, and 3.8.6 together with additional specific Completion Times.

LCO 3.8.4, Condition C represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The two hour limit is consistent with the allowed time for an inoperable DC Distribution System division.

Enclosure 1 to PLA-7984 Page 83 of 105 If one of the required DC electrical power subsystems is inoperable, as a result of equipment other than the battery or battery charger being inoperable, the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition.

Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed two hours.

Question 40.b The 125 VDC electrical system at Susquehanna is designed in a manner that the safety function can be performed with a single failure of any component or the loss of an entire 125 VDC Channel. Safe shutdown and accident response is assured with the remaining three 125 VDC channels available. Table E1-1 was updated to reflect this design success criterion (see ).

Question 40.c The 250 VDC electrical system at Susquehanna is designed in a manner that the safety function can be performed with a single failure of any component or the loss of an entire 250 VDC Division. Since a single failure can be accommodated, safe shutdown is assured with one 250 VDC division available. Table E1-1 was updated to reflect this design success criterion (see )

Audit Question Q-042 In Attachment 1 of the LAR, for Unit 2 TS 3.8.7, Condition C and D the licensee states that some components required by Unit 2 receive power through Unit 1 electrical power distribution subsystems. In Susquehanna FSAR [Updated Final Safety Analysis Report],

Section 8.3.1.11.1 the licensee states that there are no Unit 2 specific loads energized from the Unit 1 AC Distribution System.

a. Discuss which Unit 1 electrical power distribution subsystems provide power to Unit 2 components, and discuss which Unit 2 components receive power from Unit 1 electrical power distribution subsystems, especially, the configuration of the distribution system (ex. buses, cross ties) associated with the common load between the two units. In addition, the staff requests the licensee to confirm whether the cross ties (if any) are explicitly modeled in the PRA. NRC also requests a simplified diagram showing distribution from Unit 1 to common loads and from common loads to Unit 2 equipment (from the DG power supplies and to common equipment). Discuss whether there are any crossties between the two units to common loads. Include list of common loads from a system level.

Enclosure 1 to PLA-7984 Page 84 of 105

b. Additionally, in Table E1-1 of Enclosure 1 of the LAR, for Unit 2 TS 3.8.7, Conditions C and D, the licensee states, SSCs are modeled consistent with the TS scope and so can be directly included in the RTR tool for the RICT Program. The staff requests the licensee to identify all shared equipment between Units 1 and 2 and confirm that the shared equipment is explicitly modeled in the PRA.

c. For Unit 2 TS 3.8.7, Conditions C and D, regarding the shared equipment between Unit 1 and Unit 2 in the model, how are common loads set up in the model? Verify whether there are any manual actions required and, if yes, verify whether they are credited in the PRA.

d. Assuming a station LOOP concurrent with a LOCA in one unit, the staff requests the licensee to provide the distribution system configuration for safe shutdown of both units.

If any cross ties are being used, the staff requests the licensee to provide the discussion of the operator action.

Susquehanna Response Question 42.a The electrical system at SSES is designed in a manner that Unit 1 electrical loads do not power unique Unit 2 electrical loads and vice versa. The electrical and mechanical design of SSES contains multiple shared systems for both Units 1 and 2. The following are the shared systems between Unit 1 and 2:

a) ESW System - FSAR Section 9.2.5

Power supply for A ESW Pump (0P504A) - 1A201 (No Alternate)

Power supply for B ESW Pump (0P504B) - 1A202 (No Alternate)

Power supply for C ESW Pump (0P504C) - 1A203 (No Alternate)

Power supply for D ESW Pump (0P504D) - 1A204 (No Alternate) b) RHRSW System - FSAR Section 9.2.6

Power supply for Unit 1 A RHRSW Pump (1P506A) - 1A203 (No Alternate)

Power supply for Unit 1 B RHRSW Pump (1P506B) - 1A204 (No Alternate)

Power supply for Unit 2 A RHRSW Pump (2P506A) - 2A201 (No Alternate)

Enclosure 1 to PLA-7984 Page 85 of 105

Power supply for Unit 2 B RHRSW Pump (2P506B) - 2A202 (No Alternate) c) Ultimate Heat Sink (Spray Pond) - FSAR Sections 3.8.4 & 9.2.7 For spray array valves:

Division 1: MCC 0B517 powered by Load Center 1B210 powered by 1A201 (No Alternate Power)

Division 2: MCC 0B527 powered by Load Center 1B220 powered by 1A202 (No Alternate Power) d) DGs - FSAR Section 8.3.1.4

See FSAR Figures 8.3-1-1, 8.3-7, and 8.3-8 e) Offsite Power Supplies - FSAR Section 8.2

See FSAR Figures 8.3-1-1 and 8.3-1-2A f) Unit 1 AC Distribution System - FSAR Section 8.3.1

See FSAR Figures 8.3-1-1, 8.3-1-2A, 8.3-7, and 8.3-8.

g) RHR (Fuel Pool Cooling Mode) - FSAR Section 5.4.7.1.1.6

Power supply for Unit 1 A RHR Pump (1P202A) - 1A201 (No Alternate)

Power supply for Unit 1 B RHR Pump (1P202B) - 1A202 (No Alternate)

Power supply for Unit 1 C RHR Pump (1P202C) - 1A203 (No Alternate)

Power supply for Unit 1 D RHR Pump (1P202D) - 1A204 (No Alternate)

Power supply for Unit 2 A RHR Pump (2P202A) - 2A201 (No Alternate)

Power supply for Unit 2 B RHR Pump (2P202B) - 2A202 (No Alternate)

Power supply for Unit 2 C RHR Pump (2P202C) - 2A203 (No Alternate)

Power supply for Unit 2 D RHR Pump (2P202D) - 2A204 (No Alternate)

Enclosure 1 to PLA-7984 Page 86 of 105 h) Control Structure HVAC System - FSAR Section 9.4.1 Control Structure HVAC Fans:

Division 1: MCC 0B136 powered by Load Center 1B230 powered by 1A203 (No Alternate Power)

Division 2: MCC 0B146 powered by Load Center 1B240 powered by 1A204 (No Alternate Power)

Control Structure Chiller (0K112A/B)

Division 1: powered by 1A203 (No Alternate Power)

Division 2: powered by 1A204 (No Alternate Power) i) DG HVAC - FSAR Section 9.4.7

HVAC for A DG: MCC 0B516 powered by Load Center 1B210 (alternate 2B210) powered by 1A201 (alternate 2A201 if aligned to 2B210)

HVAC for B DG: MCC 0B526 powered by Load Center 1B220 (alternate 2B220) powered by 1A202 (alternate 2A202 if aligned to 2B220)

HVAC for C DG: MCC 0B536 powered by Load Center 1B230 (alternate 2B230) powered by 1A203 (alternate 2A203 if aligned to 2B230)

HVAC for D DG: MCC 0B546 powered by Load Center 1B240 (alternate 2B240) powered by 1A204 (alternate 2A204 if aligned to 2B240)

HVAC for E DG: MCC 0B565 and 0B566 powered by 0A510 connects to substituted diesel power supply.

j) ESSW Pumphouse HVAC - FSAR Section 9.4.8

Division 1: MCC 0B517 powered by Load Center 1B210 powered by 1A201 (No Alternate Power)

Division 2: MCC 0B527 powered by Load Center 1B220 powered by 1A202 (No Alternate Power)

Enclosure 1 to PLA-7984 Page 87 of 105 k) Reactor Building Recirculation Fan - FSAR Section 6.5.3.2

Division 1: MCC 1B217 powered by Load Center 1B210 powered by 1A201 (No Alternate Power)

Division 2: MCC 1B227 powered by Load Center 1B220 powered by 1A202 (No Alternate Power) l) Standby Gas Treatment System - FSAR Section 6.5.1

Division 1: MCC 0B136 powered by Load Center 1B230 powered by 1A203 (No Alternate Power)

Division 2: MCC 0B146 powered by Load Center 1B240 powered by 1A204 (No Alternate Power) m) RWST - FSAR Section 9.2.10 (water tank no power supply) n) 125 VDC - FSAR Section 8.3.2 (various charger supplies)

Question 42.b SSES is a two-unit site that has SSCs which are shared between the two units. The SSES PRA logic model, including FPIE, FPRA, and IFPRA hazards, models some of these shared systems and components. Information related to the modeling of shared systems and components credited in the SSES PRA is provided in the SSES PRA System Notebooks; see the section on Shared Components.

Response to NRC audit question Q-011 provides a table (Table Q11-1) that describes the shared systems, and how the SSES PRA models these systems.

Question 42.c The following discussion focuses on the following Unit 2 TS Conditions:

LCO 3.8.7, Condition C: One Unit 1 AC electrical power distribution subsystem inoperable.

LCO 3.8.7, Condition D: Two Unit 1 AC electrical power distribution subsystems on one division inoperable for performance of Unit 1 Surveillance Requirement 3.8.1.19.

Enclosure 1 to PLA-7984 Page 88 of 105 These LCOs are only applicable to Unit 2 and are necessitated by the fact that some common equipment required to support operation of Unit 2 receives power from Unit 1 sources.

Specifically, the ESW Pumps and the Control Structure Chillers. It should be noted that in the context of these LCOs, the term subsystem is referring to the subsystems identified in TS Table 3.8.7-1, and not an entire electrical division (1 or 2).

Emergency Service Water As described in Table Q11-1, The Susquehanna ESW System is a shared system, consisting of four pumps. Each pump is powered by a separate Unit 1 4160 VAC ESS electrical bus, as follows:

ESW pump 0P504A is powered from 4160 VAC ESS electrical bus 1A201, breaker 8.

ESW pump 0P504B is powered from 4160 VAC ESS electrical bus 1A202, breaker 8.

ESW pump 0P504C is powered from 4160 VAC ESS electrical bus 1A203, breaker 3.

ESW pump 0P504D is powered from 4160 VAC ESS electrical bus 1A204, breaker 3.

Consistent with the SSES design, Channel A and Channel C are classified as Division 1, and Channel B and Channel D are classified as Division 2. For LCO 3.8.7, Condition C, the loss of one subsystem will result in the loss of one ESW pump. The remaining three ESW pumps can meet the required load for both units simultaneously. For LCO 3.8.7, Condition D, the loss of two subsystems within the same division (i.e., the loss of A and C or B and D) will result in the loss of two ESW pumps. The remaining ESW pumps can meet the required load for both units simultaneously. The SSES PRA has been developed to model this configuration.

AC Power Distribution The SSES PRA models select 480 VAC and 208/120 VAC electrical distribution buses.

Specifically, the DG MCCs are powered via Unit 1 (preferred) but can be powered via Unit 2 (alternate). The power swap is performed by Automatic Transfer Switches (ATS).

480 VAC MCC 0B516 powered from 480 VAC electrical load center 1B210 (preferred) or 480 VAC electrical load center 2B210 (alternate), 0ATS516.

480 VAC MCC 0B526 powered from 480 VAC electrical load center 1B220 (preferred) or 480 VAC electrical load center 2B220 (alternate), 0ATS526.

480 VAC MCC 0B536 powered from 480 VAC electrical load center 1B230 (preferred) or 480 VAC electrical load center 2B230 (alternate); 0ATS536.

Enclosure 1 to PLA-7984 Page 89 of 105

480 VAC MCC 0B546 powered from 480 VAC electrical load center 1B240 (preferred) or 480 VAC electrical load center 2B240 (alternate); 0ATS546.

The SSES PRA models the primary and alternate power sources, and the automatic transfer switches.

The following MCCs provide power to the ESSW Pumphouse (location of the ESW and RHRSW pumps) HVAC Systems. The SSES PRA models the need for ESSW Pumphouse HVAC. Each of these MCCs is powered by a separate electrical channel, and division, as follows:

480 VAC MCC 0B517 powered from 480 VAC electrical load center 1B210.

480 VAC MCC 0B527 powered from 480 VAC electrical load center 1B220.

The 480 VAC MCC 0B565, which provides power to the E DG Building HVAC System, can be powered from 13.8 kV/480 VAC transformers 0X555 or 0X556. During E DG operation, this MCC is powered via transformer 0X565. The SSES PRA only models power to MCC 0B565 from transformer 0X565.

Regarding the equipment listed above, the SSES PRA does not credit manual actions.

The SSES PRA accounts for the dependencies between the modeled electrical loads, and the required electrical distribution equipment. Loss of an electrical distribution bus will result in the loss of the dependent loads unless an alternate power supply is credited.

Control Structure Chillers Regarding Control Structure Chillers, the SSES PRA does credit this system. These chillers (0K112A and 0K112B) are modeled specifically for MSO concerns.

Question 42.d During a LOCA/LOOP, the on-site DGs will power all necessary safety related equipment via their normal power supplies with the exception that instead of off-site power feeding these buses, the on-site DGs will be supplying power. The only cross ties are associated with the DGs.

These cross ties are controlled by ATS, if required, and there are no operator actions associated with cross ties.

Enclosure 1 to PLA-7984 Page 90 of 105 Audit Question Q-045 Regarding TS 3.8.7, Condition C, One Unit 1 AC electrical power distribution subsystem inoperable, and TS 3.8.7, Condition D, Two Unit 1 AC electrical power distribution subsystems on one division inoperable for performance of Unit 1 SR 3.8.1.19, the design success criteria for TS 3.8.7, Conditions C and D, are one of two divisions. The NRC staff requests the licensee to explain why the design success criteria are divisions and not subsystems. If the licensee changes the design success criteria based on the response to this question, then the staff requests a revision to Table E1-1 that reflects the change.

Susquehanna Response Susquehanna LCO 3.8.7 states, The electrical power distribution subsystems in Table 3.8.7-1 shall be OPERABLE. Table 3.8.7-1 lists the 4160 VAC Load Groups, 480 VAC Load Centers, 480 VAC MCCs, 208/120 VAC Distribution Panels, 250 VDC Buses, and 125 VDC Buses required to be operable to meet LCO 3.8.7. The individual Load Groups, Load Centers, MCCs, Distribution Panels, and buses are annotated to indicate with which channel the named subsystems are associated. Also, the subsystems are organized into Division 1 and Division 2 within Table 3.8.7-1.

The design success criteria for all electrical distribution systems listed in Table 3.8.7-1 are one of two divisions. When the E DG is substituted in for DG A, B, C, or D, the DG E 125 VDC Bus 0D597 is considered to be part of the same division into which the E DG is substituted (Division 1 if substituted for DG A or C; Division 2 if substituted for DG B or D) with respect to the design success criteria of one of two divisions.

Therefore, the design success criteria in Table E1-1 for TS 3.8.7 Conditions A and B were mischaracterized, and have been updated to be one of two divisions as shown in Enclosure 2.

Audit Question Q-047 Regarding Table E-1-4, Conditions 2.d and 2.e, and Table E1-5, Function 1.d, the staff requests the licensee to clarify the Tables regarding the accident and transient information.

Susquehanna Response Reference 1, Table E1-4, Function 2.d is the Inop function of the Average Power Range Monitors (APRMs). When used, this function places a vote into the 2-out-of-4 voter logic. As stated in TS Bases 3.3.1.1 Applicable Safety Analyses, LCO and Applicability Section, this function is not specifically credited in the accident analyses. Therefore, Table E1-4 is correct with regards to Function 2.d.

Enclosure 1 to PLA-7984 Page 91 of 105 Table E1-4 Function 2.e is the 2-out-of-4 voter function of the APRMs. This function is the APRM interface with the RPS and causes actuation of RPS when the appropriate signals are present. This function is credited in any transient or accident analysis that credits an APRM trip.

Table E1-4 Function 2.e is credited for FSAR 15.4.9 Control Rod Drop Accident, FSAR 15.2 Increase in Reactor Pressure, FSAR 15.4 Reactivity and Power Distribution Anomalies and Table E1-4 was updated to reflect these DBAs (see Enclosure 2).

A point of clarification will also be placed in Table E1-4 Function 2.c. The Neutron Flux - High trip is credited for the ASME Overpressure Analysis contained in FSAR Section 5.2 Integrity of Reactor Coolant Pressure Boundary which will be included in the design analyses for Functions 2.c and 2.e.

Table E1-5 Function 1.d is the Inop function of the Rod Block Monitor (RBM). This function will initiate a control rod block when certain internal checks are not met. The RBM system was designed to prevent inadvertent control rod withdrawal given a single failure within the RBM.

Either one of the two channels, with the two highest LPRM inputs bypassed, is sufficient to provide an appropriate control rod withdrawal block. The system will initiate a rod block even with a single failure so the Inop function is not explicitly credited in any accident analysis.

Audit Question Q-048 The staff requests the licensee to elaborate on diversity (defense-in-depth) of Function 3.d in TS Table 3.3.5.1-1, including discussion of manual actions.

Susquehanna Response TS Table 3.3.5.1-1, Function 3.d is the automatic HPCI suction swap from the CST to the Suppression Pool on low CST level. The only diverse method to perform this function is for the operators to manually re-align the HPCI system from the CST to the Suppression Pool. It should be noted that the ADS with a low pressure ECCS available (Core Spray or LPCI) is functionally redundant to HPCI. To remain consistent with other tables throughout the report, Table E1-9 function 3.d will not be revised to reflect the functional diversity of ADS and one low pressure ECCS subsystem.

This manual action is contained in approved plant procedures. The steps are simple operator actions that can be performed in the control room. An evaluation was performed to determine if this manual action represents a Time Critical Operator Action. The evaluation determined that the SSES Fire Protection Review Report (FPRR), Appendix R safe shutdown analysis report, states that after approximately eight hours the CST may have low water level and the operator can manually transfer the HPCI suction to the suppression pool. The FPRR further states that there is adequate water in the CST for HPCI to perform its credited Appendix R function without transfer to the suppression pool. Therefore, the manual action is not a Time Critical

Enclosure 1 to PLA-7984 Page 92 of 105 Operator Action and no validation of the timing of the manual action is performed. Further, the PRA model does not credit performance of the manual transfer.

Audit Question Q-049 Regarding Table E1-9, for Function 3.e, Table E1-9 states automatic initiation. The staff requests the licensee to confirm that if the only diversity identified "Diverse Instrumentation" column in tables E1-4 to E-12 and TS 3.3.8.1 is "Manual", such manual actions are credited in the PRA model and/or prescribed in operation manuals and procedures.

Susquehanna Response For those instruments in Reference 1, Tables E1-4 through E1-12 (excluding Table E1-11 which does not have a Diverse Instrumentation column) and the LOP Instrumentation in TS 3.3.8.1 where the only listed Diverse Instrumentation is Manual, such manual actions are prescribed in operations manuals or procedures. The manual actions are not time critical operator actions.

The manual actions are not credited in the PRA model except for initiation of ADS from the relay rooms and manual local alignment of low pressure ECCS following failure of HPCI.

Audit Question Q-050 The staff requests the licensee to elaborate on diversities (defense in depth) of all functions in TS Table 3.3.8.1-1.

Susquehanna Response The functions listed in TS Table 3.3.8.1-1 are the undervoltage transfer functions that occur at different degraded grid voltage values. The functions listed in TS Table 3.3.8.1-1 have redundant instrumentation. The voltage detection is tiered which provides defense in depth for the instrumentation including the time delay relays. Additionally, the operator would have multiple indications/alarms of degraded grid voltage and approved plant procedures would direct correct operator action if the automatic actions of the undervoltage relays did not occur.

Audit Question Q-051 includes markups of the Technical Specifications (TSs) to support the proposed implementation of a RICT program at SSES Unit 1 and Unit 2, respectively. Address the following inquiries and observations relative to these markups:

a. The Unit 1 TS Table 3.3.5.1-1 pages are marked to reduce the table from 6 pages to 5 pages. Provide justification for this change.

Enclosure 1 to PLA-7984 Page 93 of 105

b. The proposed administrative controls in TS 5.5.16, paragraph e, include the phase, this license amendment. In lieu of the phrase this license amendment, discuss whether the phrases Amendment # xxx or, as discussed in the TSTF-505 model SE [Safety Evaluation], this program would provide more clarity for the paragraph.

c. TS Required Actions 3.7.1.B.1, 3.7.2.B.1, and 3.7.2.C.1 have existing temporarily extended Completion Times for specific events. The licensee has proposed to also include these Required Actions in the RICT program. Discuss how the temporary extensions and the RICT would be implemented.

Susquehanna Response Question 51.a In Reference 1, Susquehanna proposed to allow for the calculation of a RICT for LCO 3.3.5.1, Required Actions B.3, C.2, D.2.1, E.2, and F.2. Due to the changes to the five Required Actions, the ACTIONS Table for TS 3.3.5.1 was extended by one page. Rather than inserting a page 3.3-40a for the final page of the ACTIONS Table, Susquehanna determined it was appropriate to roll content across existing pages. This resulted in the need to reduce the number of remaining pages in TS Section 3.3.5.1 by one to fit within the current numbering limitations of the SSES Unit 1 TS (i.e., TS 3.3.5.2 starts on page 3.3-47a). That was performed by condensing Table 3.3.5.1-1 from six pages to five pages. This presentation was chosen because it ensures all instrumentation functions associated with each of the five systems in the table (i.e., CS, LPCI, HPCI, ADS Trip System A, and ADS Trip System B) appear on single pages of the table. This administrative change to condense Table 3.3.5.1-1 did not result in any changes to the requirements delineated therein. Although not a part of TSTF-505, these changes are administrative in nature and do not affect the applicability of TSTF-505 (Reference 3), to the SSES TS.

Question 51.b Susquehanna reviewed the revised model SE for TSTF-505 (Reference 4), and concurs that the phrase approved for use with this program provides more clarity to the wording of the RICT Program in TS 5.5.16. Susquehanna has revised TS 5.5.16.e to reflect this wording change. The revised markup pages are provided in Enclosure 3 to this letter. The revised clean pages are provided in Enclosure 4.

Question 51.c LCO 3.7.1, Required Action B.1, and LCO 3.7.2, Required Actions B.1 and C.1, each contain temporary Completion Times to support replacement of ESW System Piping at the penetrations into the Unit 1 and 2 RBs. These temporary 14-day Completion Times were approved in License

Enclosure 1 to PLA-7984 Page 94 of 105 Amendment 275/257 (Reference 55). Further, Unit 2 LCO 3.8.7, Required Action C.1, has a temporary Completion Time to support replacement of Unit 1 ESS Transformers 1X230 and 1X240. This temporary 7-day Completion Time was approved in Unit 2 License Amendment 263 (Reference 56). These license amendments were approved based on the fact that the remaining operable equipment in the opposite division would be capable of performing the required safety functions.

The TS Bases markups provided in Attachment 4 to Reference 1 explicitly state that the RICT Program cannot be applied to the temporary Completion Times. When planning the work associated with the ESW Pipe or ESS Transformer replacements, Susquehanna will follow existing work planning processes to ensure the work is completed within the timeframe previously allowed by the TS (i.e., the temporary Completion Times of 7 days or 14 days, as appropriate) and that any required compensatory measures are performed. When a temporary Completion Time is used, a RICT is not intended to be calculated, and the incremental changes in risk beyond the front stop Completion Time will not be included in the cumulative risk tracking of the RICT Program.

In order to ensure the RICT Program is not applied when a temporary Completion Time has been entered, Susquehanna proposes to revise the structure of LCO 3.7.1, Condition B, LCO 3.7.2, Conditions B and C, and Unit 2 LCO 3.8.7, Condition C. In each of these Conditions, a new Required Action is created. The ability to apply the RICT Program is identified in the existing Required Actions, and the temporary Completion Times are relocated to the newly created Required Actions without changing the footnote that further clarifies the applicability of the temporary Completion Time. The newly created Required Actions are modified by a Note which states that the RICT Program cannot be applied if the temporary Completion Time is in effect. This presentation visibly separates the temporary Completion Times and the RICT Program allowance within the TS, thereby reinforcing the fact that they cannot be applied together while retaining Susquehannas ability to use either the temporary Completion Times or the RICT Program, as appropriate. Susquehanna will not transition from one Required Action to the other. Upon entry into the LCO Condition, the appropriate Required Action and corresponding Completion Time will be identified and used throughout the period that the SSC requiring Condition entry is inoperable.

Marked up and clean TS pages are provided in Enclosures 3 and 4 to this letter, respectively.

Note that Unit 2 Amendment 263 was issued after the initial application in Reference 1. As such, the revised TS pages in Enclosures 3 and 4 reflect incorporation of Amendment 263 without identifying them with revision bars. Updated TS Bases markups are provided in to this letter.

Audit Question Q-052 The staff requests the licensee to upload an updated version of Table E-1 under this question.

Enclosure 1 to PLA-7984 Page 95 of 105 Susquehanna Response The updated version of Table E1-1 is provided in Enclosure 2 to this letter.

Audit Question Q-054 Section C.1.4 of RG 1.200 states that the base PRA (i.e., the model of record) is to represent the as-built, as-operated plant to the extent needed to support the application. The licensee is to have a process that identifies updated plant information that necessitates changes to the base PRA model.

In response to an event involving an open-phase condition (OPC) at the Byron Generating Station on January 30, 2012, the NRC issued Bulletin 2012-01.[1] As part of the initial voluntary industry initiative for mitigation of the potential for the occurrence of an OPC in electrical switchyards,[2] licensees have made the addition of an open-phase isolation system (OPIS). In SRM-SECY-16-0068,[3] the NRC staff was directed to ensure that licensees have appropriately implemented OPIS and that licensing bases have been updated accordingly. NRC staff closed out BL 2012-01 for Susquehanna via letter dated December 6, 2021 (ML21335A422). From the revised voluntary initiative [4] and resulting industry guidance on estimating OPC and OPIS risk in NEI 19-02,[5] it is understood that the risk impact of an OPC can vary widely dependent on electrical switchyard configuration and design. Therefore, OPC could impact the RICTs for some TS LCO conditions within the scope of the RICT program (e.g., conditions associated with TS LCOs 3.8.1, 3.8.7, and 3.8.4). Considering these observations, provide the following information:

a) For Susquehanna, discuss the evaluation of the risk impact associated with OPC events including the likelihood of OPC-initiated plant trips and the impact of those trips on PRA-modeled SSCs. Also, discuss the functionality of the open phase detection system installed at Susquehanna and operator actions needed to operate or respond to the system.

b) Clarify whether any installed equipment and associated operator actions are credited in the PRAs that support this application. If equipment and associated operator actions are credited, then provide the following information:

[1] U.S. NRC Bulletin 2012-01, Design Vulnerability in Electric Power System (ADAMS Accession No. ML12074A115).

[2] Anthony R. Pietrangelo to Mark A. Satorius, ltr re: Industry Initiative on Open Phase Condition - Functioning of Important-to-Safety Structures, Systems and Components (SSCs), dated October 9, 2013 (ADAMS Accession No. ML13333A147).

[3]

U.S. NRC SRM-SECY-16-0068, Interim Enforcement Policy for Open Phase Conditions in Electric Power Systems for Operating Reactors, dated March 9, 2017 (ADAMS Accession No. ML17068A297).

[4]

Doug True to Ho Nieh, ltr re: Industry Initiative on Open Phase Condition, Revision 3, dated June 6, 2019 (ADAMS Accession No. ML19163A176).

[5]

Nuclear Energy Institute (NEI) 19-02, Guidance for Assessing Open Phase Condition Implementation Using Risk Insights, Revision 0, April 2019 (ADAMS Accession No. ML19122A321).

Enclosure 1 to PLA-7984 Page 96 of 105

i. Describe the equipment and associated actions that are credited in the PRA models.

ii. Describe the impact that this treatment, if any, has on key assumptions and sources of uncertainty for the RICT program.

iii. Discuss HRA methods and assumptions used for crediting alarm manual response.

iv. Discuss how OPC-related scenarios are modeled for non-internal event scenarios such as internal floods, fire, and seismic.

v. Regarding inadvertent actuation of the open phase detection system:

Explain whether scenarios regarding inadvertent actuation of the system, if applicable, are included in the PRA models that support the RICT calculations.

If inadvertent actuation scenarios are not included in the PRA models, then provide justification that the exclusion of this inadvertent actuation does not impact the RICT calculations.

c) If OPC and the open phase detection system are not included in the application PRA models, then provide justification that the exclusion of this failure mode and mitigating system does not impact the RICT calculations.

d) As an alternative to Part (c), propose a mechanism to ensure that OPC-related scenarios are incorporated into the application PRA models prior to implementing the RICT program.

Susquehanna Response Question 54.a The SSES OPC Evaluation is described in Susquehanna calculation EC-RISK-0029 (Reference 57). The purpose of this evaluation is to perform a risk assessment that informs the decision to implement the Open Phase Detection (OPD) automatic mode or operate the OPD system in the manual mode. As described in the evaluation, the OPC frequency of 5.43E-03 is utilized and is based on the guidance presented in NEI 19-02 (Reference 58).

The SSES OPD system detects open phase conditions on the 230 kV and 500 kV startup transformers (T-10 and T-20) by monitoring incoming power. Two detectors are installed on each transformer. The system can detect single or double open phase conditions with or without a concurrent ground fault, under all transformer loading conditions. The OPD system can

Enclosure 1 to PLA-7984 Page 97 of 105 function in automatic mode (i.e., alarm and automatic trip), manual mode (alarm only), or test mode (used when performing maintenance on the system). Based on the current station configuration and operations, the OPD system is operated in the manual mode. In this configuration, if an OPC is detected, the system will only provide control room annunciation.

EC-RISK-0029 considers the impact that an OPC event could have on plant SSCs. The PRA modeling for an OPC event is discussed in the evaluation. This evaluation considers the impacts on 4160 VAC electrical distribution, RBCCW, TBCCW, 250 and 125 VDC electrical distribution, River Water Makeup, and RPS. EC-RISK-0029 provides a general description of the OPC/OPD sequence progression and details of the PRA modeling changes made to support the risk assessment.

As stated in the evaluation, the spurious actuation of the OPD system when operated in the automatic mode is not quantitatively modeled. This assumption allows for a conservative estimate of delta risk between the automatic and manual OPD alternatives. The spurious actuation of the OPD system is qualitatively evaluated and found to result in little change between the automatic and manual OPD alternatives. The evaluation also qualitatively evaluates the potential for spurious actuation across multiple hazards (e.g., fire events, seismic events, and high winds events).

The applied HRA assumes that the OPD is in the manual (i.e., alarm only) mode of operation.

As such, the evaluation assumes that operator actions are required to mitigate the effects of the OPC. The required actions are as follows:

Operators must open the necessary offsite power feed breakers.

Operators must reset lockout relays, thermal overloads, restart pumps and other non-ESS equipment as time permits.

A detailed evaluation of HEPs is not performed in the evaluation. Instead, the evaluation assumes an industry accepted screening HEP of 1.00E-02, with additional sensitivities utilizing a value of 1.00E-01.

Question 54.b The installed OPD equipment is not modeled in the SSES PRA model. Required operator actions associated with the OPD equipment are not modeled in the SSES TSTF-505/RICT application PRA model. In short, the modeling changes described in EC-RISK-0029 are not incorporated into the SSES PRA model.

Enclosure 1 to PLA-7984 Page 98 of 105 Question 54.b.i Not applicable. See response to Section b of this question.

Question 54.b.ii Not applicable. See response to Section b of this question.

Question 54.b.iii Not applicable. See response to Section b of this question.

Question 54.b.iv Not applicable. See response to Section b of this question.

Question 54.b.v Not applicable. See response to Sections a and b of this question.

Question 54.c EC-RISK-0029 provides the results of the evaluation. The OPC results (for the automatic, and manual modes of operation) are compared to the no OPC results as presented by Susquehanna Calculation EC-RISK-0016 (Reference 59). Based on the results provided in Table 4 of EC-RISK-0029, the increase in risk due to an open phase condition is very small (within the Region III delta risk limits specified in RG 1.174 (Reference 25)) for both CDF and LERF, considering both the automatic, and manual modes of operation.

Table 4 of EC-RISK-0029 provides a comparison of risk results between the SSES PRA model without consideration for OPC (i.e., baseline risk), and the SSES PRA model with consideration for OPC, with the OPD system in manual mode. Table Q54-1 summarizes these results.

When considering an OPC, the SSES PRA results increase only slightly. As a result, the OPD system, and associated operator actions, are not incorporated into the SSES PRA model.

Enclosure 1 to PLA-7984 Page 99 of 105 Table Q54-1 Comparison of Full Power Internal Events Risk Results Risk Metric Baseline Risk Manual OPD Risk Delta Risk Unit 1 CDF 1.5987E-06 1.5998E-06 1.1000E-09 Unit 1 LERF 6.8265E-07 6.8292E-07 2.7000E-10 Unit 2 CDF 1.5848E-06 1.6022E-06 1.7400E-08 Unit 2 LERF 6.8372E-07 6.8820E-07 4.4700E-09 Question 54.d Not applicable. See response to Section c of this question.

Audit Question Q-055 Describe the methodology used to re-perform the SLERF [Seismic Large Early Release Frequency] calculations.

Susquehanna Response The estimate of the SLERF is performed by convolving the plant seismic core damage with an assumed independent (i.e., seismically uncorrelated) seismic fragility to represent the primary containment function. As such, the SLERF calculation is a double convolution of the plant seismic hazard curve with the plant level seismic HCLPF used to calculated Seismic Core Damage Frequency (SCDF) and a separate seismic HCLPF representing the primary containment function. For this estimation, the value (0.3g PGA) of the SLERF fragility HCLPF is the same as that used for the SCDF convolution calculation. This convolution estimation approach has been used in previous RICT seismic penalty calculations and has been accepted by the NRC when a full-scope SPRA is not available. This approach for estimating SLERF for a BWR Mark II plant (i.e., the SSES primary containment design) is judged to be conservative as it produces a Seismic Conditional Large Early Release Probability (SCLERP) greater than 0.5.

A HCLPF of 0.3g PGA with the composite beta factor, c = 0.4, is used in the convolution calculations. A HCLPF of 0.3g PGA with c = 0.4 produces a median (50 percent) failure probability point of Am = 0.76g PGA.

The SLERF for each hazard interval is the product of:

The hazard interval initiating event frequency (/yr);

Enclosure 1 to PLA-7984 Page 100 of 105

The plant level fragility (PLF) failure probability for that same hazard interval; and

The primary containment function fragility failure probability for that same hazard interval.

The primary containment function fragility HCLPF assumes the same fragility values as used for the plant level fragility. The SLERF results per hazard interval are then straight summed to produce the overall total SLERF across the hazard curve. The total estimated SLERF is 8.72E-07/yr.

If a RICT is being entered during a period when the containment is de-inerted, an SCLERP of 1.0 will be assumed to address the increased potential for hydrogen deflagration events. This SCLERP results in a SLERF equal to SCDF (i.e., an SLERF of 1.70E-06 will be applied for this configuration).

Enclosure 1 to PLA-7984 Page 101 of 105 References

1. Susquehanna letter to NRC, Proposed Amendment to Licenses NPF-14 and NPF-22:

License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (PLA-7897), dated April 8, 2021 (ADAMS Accession No. ML21098A206).

2. NRC letter to Susquehanna, Regulatory Audit Plan in Support of License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times (EPID L-2021-LLA-0062), dated June 15, 2021 (ADAMS Accession No. ML21153A137).

3. TSTF Traveler TSTF-505, Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4b, Revision 2, dated July 2, 2018 (ADAMS Accession No. ML18183A493).

4. NRC letter to TSTF, Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated November 21, 2018 (ADAMS Accession No. ML18267A259).

5. Susquehanna Document NQPA-B-NA-012, SSES Full Power Internal Events Probabilistic Risk Assessment 2021 F&O Resolution Roadmap

6. Susquehanna Calculation EC-RISK-0056, Assessment of Key Assumptions and Sources of Uncertainty for Risk-Informed Applications

7. Susquehanna Calculation EC-RISK-0040, Summary and Quantification of Model SSES 19ROI1 - Full Power Internal Events Probabilistic Analysis (FPIE)

8. NEI Topical Report NEI 06-09, Risk-Informed Technical Specifications Initiative 4b Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0-A, dated November 2006 (ADAMS Accession No. ML12286A322).

9. Susquehanna Procedure DC-FLEX-010, 4160 VAC Connection to E DG and ESS Buses

10. Susquehanna Procedure ES-173-007, Venting Suppression Chamber through the HCVS

11. Susquehanna Procedure ES-273-007, Venting Suppression Chamber through the HCVS

Enclosure 1 to PLA-7984 Page 102 of 105

12. Susquehanna Procedure DC-FLEX-101, Cooling Water to Unit 1 RCIC Oil Cooler Using RHRSW System and Establishing RCIC Room Ventilation

13. Susquehanna Procedure DC-FLEX-201, Cooling Water to Unit 2 RCIC Oil Cooler Using RHRSW System and Establishing RCIC Room Ventilation

14. NEI Topical Report NEI 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Revision 0, dated August 2016 (ADAMS Accession No. ML16286A297).

15. NEI Topical Report NEI 04-10, Risk-Informed Technical Specifications Initiative 5b Risk-Informed Method for Control for Surveillance Frequencies Industry Guidance Document, Revision 1, dated April 2007 (ADAMS Accession No. ML071360456).

16. Susquehanna Calculation EC-RISK-0043, Technical Adequacy of the SSES PRA Models - Probabilistic Risk Analysis

17. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014).

18. Susquehanna Calculation EC-RISK-0039, Human Reliability Analysis (HRA) - Full Power Internal Events Probabilistic Risk Analysis (FPIE)

19. NRC NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1, dated March 2017 (ADAMS Accession No. ML17062A466).

20. Susquehanna Calculation EC-RISK-0539, Internal Flooding Analysis for PRA

21. Susquehanna Calculation EC-RISK-1187, Fire Risk Quantification (FQ) and Uncertainty and Sensitivity Analysis (UNC) - Fire Probabilistic Risk Analysis (FPRA)

22. NRC NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, United States Fire Event Experience through 2009, Revision 0, dated January 2015 (ADAMS Accession No. ML15016A069).

23. NRC NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, Revision 0, dated August 1983 (ADAMS Accession No. ML071210299).

Enclosure 1 to PLA-7984 Page 103 of 105

24. NRC NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Revision 0, Volumes 1, 2, and 3 (ADAMS Accession Nos. ML12313A105, ML14141A129, and ML17331B098).

25. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3, dated January 2018 (ADAMS Accession No. ML17317A256).

26. Susquehanna Calculation EC-RISK-0048, Fire PRA Interim Model OCT17R2F1 Quantification and Sensitivity - Fire Probabilistic Risk Analysis (FPRA)

27. Susquehanna Calculation EC-RISK-1139, Susquehanna PRA Model Event Tree Notebook and Success Criteria Post-EPU Level 2

28. Susquehanna Calculation EC-RISK-1105, PSA-004.20 - Turbine Building Closed Cooling Water Notebook

29. Susquehanna Calculation EC-RISK-1119, PSA-004.21 - Reactor Building Closed Cooling Water Notebook

30. Susquehanna Calculation EC-RISK-1111, PSA-004.5 - HPCI System Notebook

31. Susquehanna Calculation EC-RISK-1106, PSA-004.06 - RCIC PRA System Notebook

32. Susquehanna Calculation EC-RISK-0041, Containment Isolation and Containment Vent - PRA System Notebook

33. NUMARC Topical Report NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A, dated April 2011 (ADAMS Accession No. ML11116A198).

34. Susquehanna Procedure NDAP-QA-0413, Implementation of the Maintenance Rule 35 Susquehanna Procedure NSEP-AD-0413C, Maintenance Rule Performance Criteria Selection

36. NRC NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volumes 1 and 2 dated September 2005 (ADAMS Accession Nos.

ML052580075, and ML052580118), and Supplement 1, dated September 2010 (ADAMS Accession No. ML15167A550).

Enclosure 1 to PLA-7984 Page 104 of 105

37. Susquehanna Design Basis Document DBD019, Fire Protection

38. Susquehanna Calculation EC-013-1006, Fire Doors Subject to Technical Requirements

39. Susquehanna Calculation EC-013-1009, Fire Dampers Subject to Technical Requirements

40. Susquehanna Calculation EC-RISK-1181, Fire Modeling Treatment (FMT) - Fire Probabilistic Risk Analysis (FPRA)

41. Susquehanna Drawing C-1754, Sheet 1, Units 1 & 2 Control Structure Fire Zone Plan Elevation 771-0

42. Susquehanna Procedure NDAP-QA-0440, Control of Transient Combustible/Hazardous Materials

43. Susquehanna Calculation EC-013-1860, Handling of Transient Combustibles in the Wraparound Zones and Restricted Areas (Red Zones)

44. Susquehanna Drawing C-1929, Summary of Fire Zones Combustible Limitations

45. NRC FAQ 13-004 Clarifications on Treatment of Sensitive Electronics, Revision 1, dated June 26, 2013 (ADAMS Accession No. ML13322A085).

46. Susquehanna Calculation EC-RISK-1185, Human Reliability Analysis (HRA) - Fire Probabilistic Risk Analysis (FPRA)

47. NRC NUREG-1921, EPRI/NRC-RES Fire Human Reliability Analysis Guidelines, Revision 0, dated July 2012 (ADAMS Accession No. ML12216A104) and Supplement 1, dated January 2020 (ADAMS Accession No. ML20035E043).

48. NRC FAQ 14-0009, Treatment of Well Sealed MC Electrical Panels Greater than 440V, Revision 1, dated October 20, 2014 (ADAMS Accession No. ML15118A810).

49. NRC FAQ 12-0064, Hot Work/Transient Fire Frequency: Influence Factors Revision 1, dated September 5, 2012 (ADAMS Accession No. ML122550050).

50. Susquehanna Report NE-94-001, Individual Plant Examination for External Events, Volumes 1 and 2, dated June 1994.

Enclosure 1 to PLA-7984 Page 105 of 105

51. Susquehanna Calculation EC-RISK-0045, High Confidence Low Probability Failure (HCLPF) Value for the Seismic Penalty Calculation - Seismic Margin Analysis for Risk Informed Applications

52. Susquehanna Procedure NDAP-00-0030, Severe Weather/Natural Disaster Preparation

53. Susquehanna Procedure ON-NATPHENOM-001, Severe Weather/Natural Phenomena

54. Susquehanna Calculation EC-RISK-0047, External Hazards Assessment - SSES External Hazards Assessment for Risk Informed Applications

55. NRC letter to Susquehanna, Issuance of Amendment Nos. 275 and 257 Re: Temporary Changes to Allow Replacement of the Emergency Service Water System Piping (EPID L-2019-LLA-0004), dated January 17, 2020 (ADAMS Accession No. ML19248A844).

56. NRC letter to Susquehanna, Issuance of Amendment No. 263 Re: Temporary Change to Unit 2 Technical Specification 3.8.7 to Allow Replacement of Unit 1 480-Volt Load Center Transformers (EPID L-2020-LLA-0245), dated November 4, 2021 (ADAMS Accession No. ML21229A157).

57. Susquehanna Calculation EC-RISK-0029, Open Phase Condition (OPC) Evaluation

58. NEI Topical Report NEI 19-02, Guidance for Assessing Open Phase Condition Implementation Using Risk Insights, Revision 0, dated May 2019 (ADAMS Accession No. ML19172A086).

59. Susquehanna Calculation EC-RISK-0016, PRA Internal Events Interim Model OCT17 Summary and Quantification

60. Susquehanna Calculation EC-RISK-1159, PSA-004.25 - Offsite & 13 kV System Notebook

61. NEI letter to NRC, Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os), dated February 21, 2017 (ADAMS Accession No. ML17086A431).

Enclosure 2 of PLA-7984 Revised Enclosure 1 Tables

Enclosure 2 to PLA-7984 Page 1 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.1.7.B One Standby SLC trains Yes SLC injection One of two SLC One of two SLC SSCs are modeled consistent with Liquid Control capability subsystems. subsystems the TS and can be directly included (SLC) subsystem Each contains a pump, in the RTR tool for the RICT inoperable for explosive valve, Program. The success criteria are reasons other than associated piping, valves, consistent with the design basis.

Condition A instruments to ensure an operable flowpath.

3.3.1.1.A One or more Instrumentation Not Scram capability Refer to Section 2.1 of Automatic or Individual Reactor Protection required channels outlined in TS explicitly this Enclosure for full manual actuation System (RPS) instrumentation inoperable. Table 3.3.1.1-1. discussion of of the trip inputs to the RPS logic system are instrumentation logic system. not modeled explicitly in the PRA.

A conservative surrogate is chosen that represents the failure to scram due to instrumentation. This surrogate is chosen to represent both Condition A and Condition B of TS 3.3.1.1 3.3.1.1.B One or more See 3.3.1.1.A Functions with one or more required channels inoperable in both trip systems

Enclosure 2 to PLA-7984 Page 2 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.2.1.A One rod block RBMs No Prevent Refer to Section 2.2 of N/A RBM is not modeled in the PRA.

monitor (RBM) uncontrolled this Enclosure for full However, should an uncontrolled channel inoperable power excursion discussion of power excursion occur, additional instrumentation logic systems would detect this anomaly and a scram should occur.

Therefore, a conservative surrogate is chosen that represents the failure to scram. A surrogate event is chosen which assumes the increased power level caused by an inoperable RBM during control rod manipulations should result in a scram signal, but the automatic scram signal fails and the operators fail to insert a manual scram.

3.3.2.2.A One feedwater - Feedwater Yes Trip of feedwater Refer to Section 2.3 of Same as Design SSCs are modeled consistent with main turbine high system and main pumps and main this Enclosure for full Success Criteria. the TS and can be directly included water level trip turbine trip turbine discussion of in the RTR tool for the RICT channel inoperable instrumentation instrumentation logic Program. The success criteria are consistent with the design basis.

3.3.4.1.A One or more Recirculation Yes EOC-RPT Refer to Section 2.4 of Two RPT SSCs are modeled consistent with channels pumps and trip capability on this Enclosure for full breaker trip the TS and can be directly included inoperable AND systems turbine trip discussion of systems and in the RTR tool for the RICT Minimum Critical instrumentation logic inputs. Program. The success criteria are Power Ratio consistent with the design basis.

(MCPR) limit for Additional discussion in Table E1-3.

inoperable End of Cycle Recirculation Pump Trip (EOC-RPT) not made applicable

Enclosure 2 to PLA-7984 Page 3 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.4.2.A One or more Recirculation Yes Anticipated Refer to Section 2.5 of Two RPT The PRA model includes the RPT channels pumps and trip Transient without this Enclosure for full breaker trip breaker trip upon turbine trip signal inoperable systems. a Scram discussion of systems and (TSV or TCV closure) from RPS, Recirculation instrumentation logic inputs. and high steam dome pressure Pump Trip inputs to the RPS and RPT logic, (ATWS-RPT) but the Reactor Vessel Water Level

- Low Low, Level 2 input is not modeled. The success criteria are consistent with the design basis.

3.3.5.1.B As required by Emergency Core Yes Initiate ECCS Refer to Section 2.6 of Same as Design SSCs are generally modeled Required Cooling Systems (CS, LPCI, HPCI) this Enclosure for full Success Criteria consistent with the TS and can be Action A.1 and (ECCS) - RPV water discussion of directly included in the RTR tool for referenced in actuation Level 1 instrumentation logic the RICT Program. The success Table 3.3.5.1-1 instrumentation - RPV water criteria are consistent with the for core spray Level 2 design basis. Where individual (CS), low - Drywell inputs are not explicitly modeled, a pressure coolant Pressure - High conservative surrogate is selected or injection (LPCI), - Reactor Steam the failure of the frontline system is high pressure Dome Pressure used. For example, a failure of relay coolant injection - Low logic to start HPCI can be (HPCI). (initiation) represented by a failure of HPCI to start.

Enclosure 2 to PLA-7984 Page 4 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.5.1.C As required by ECCS actuation Yes Initiate (injection Refer to Section 2.6 of Same as Design SSCs are generally modeled Required instrumentation modes) ECCS this Enclosure for full Success Criteria consistent with the TS and can be Action A.1 and for CS, LPCI (CS, LPCI, HPCI) discussion of directly included in the RTR tool for referenced in mode, HPCI. instrumentation logic the RICT Program. The success Table 3.3.5.1-1 - Reactor Steam criteria are consistent with the Dome Pressure design basis. Where individual

- Low (injection inputs are not explicitly modeled, a permissive) CS conservative surrogate is selected or and LPCI the failure of the frontline system is

- Manual used. For example, a failure of relay Initiation CS, logic to start HPCI can be LPCI, HPCI represented by a failure of HPCI to

- Reactor steam start.

dome pressure low (recirculation discharge valve permissive)

LPCI only Trip (HPCI Only)

- Reactor Vessel Water Level 8 3.3.5.1.D As required by ECCS actuation Not Initiate ECCS Refer to Section 2.6 of Same as Design Instrumentation is not explicitly Required instrumentation explicitly (HPCI automatic this Enclosure for full Success Criteria modeled. Conservative surrogate Action A.1 and for HPCI for low suction transfer) discussion of selected to represent loss of the referenced in Condensate instrumentation logic CST, CST level switch, and failure Table 3.3.5.1-1 Storage Tank CST Level - Low of HPCI pump suction.

(CST) level

Enclosure 2 to PLA-7984 Page 5 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.5.1.E As required by Automatic Not Initiate ADS Refer to Section 2.6 of Same as Design Individual inputs to trip system Required Depressurization explicitly Trip System A this Enclosure for full Success Criteria channels are not explicitly modeled, Action A.1 and System (ADS) Trip System B discussion of but trip system channels are referenced in initiation logic instrumentation logic modeled and can be used as a Table 3.3.5.1-1 and - RPV Level 1 surrogate for representing each ADS instrumentation. - Drywell trip system channel.

Pressure - High

- RPV Level 3 Confirmatory 3.3.5.1.F As required by ADS initiation Not Initiate ADS Refer to Section 2.6 of Same as Design Individual inputs to trip system Required logic and explicitly Trip System A this Enclosure for full Success Criteria channels are not explicitly modeled, Action A.1 and instrumentation. Trip System B discussion of but trip system channels are referenced in instrumentation logic modeled and can be used as a Table 3.3.5.1-1 - Initiation Timer surrogate for representing each ADS

- CS pump trip system channel.

discharge pressure

- LPCI pump discharge pressure

- High Drywell Pressure Bypass timer

- Manual initiation 3.3.5.3.B As required by Reactor Vessel Yes RCIC Initiation Refer to Section 2.7 of Same as Design SSCs are modeled consistent with Required Water Level - this Enclosure for full Success Criteria the TS and can be directly included Action A.1 and Low Low, discussion of in the RTR tool for the RICT referenced in Level 2 instrumentation logic Program. The success criteria are Table 3.3.5.3-1 consistent with the design basis.

Enclosure 2 to PLA-7984 Page 6 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.5.3.D As required by CST Level Not RCIC automatic Refer to Section 2.7 of Same as Design Instrumentation is not explicitly Required Sensors explicitly suction transfer this Enclosure for full Success Criteria modeled. Conservative surrogate Action A.1 and Initiation discussion of selected to represent loss of the referenced in instrumentation logic CST, CST level switch, and failure Table 3.3.5.3-1 of RCIC pump suction.

3.3.6.1.A One or more Sensors, relays, Not Automatic Refer to Section 2.8 of Same as Design Individual isolation signals are not required channels and switches explicitly isolation of this Enclosure for full Success Criteria comprehensively modeled in the inoperable required to cause Primary discussion of PRA; Therefore, surrogate events initiation Containment instrumentation logic are chosen to either represent failure Isolation Valves of containment and/or the failure to isolate the associated system.

3.3.8.1.B One or more Unit 1 4.16 kV Yes Undervoltage Refer to Section 2.9 of Same as Design SSCs are modeled consistent with (Unit 2 required channels ESS Buses and sensing capability this Enclosure for full Success Criteria the TS and can be directly included only) associated with associated discussion of in the RTR tool for the RICT Unit 1 4.16 kV channels 1. Loss of Voltage instrumentation logic Program. The success criteria are Emergency <20% consistent with the design basis.

Safeguard System 2. Degraded (ESS) Buses in one Voltage 65%

Division 3. Degraded inoperable for the Voltage 93%

performance of Unit 1 SR 3.8.1.19

Enclosure 2 to PLA-7984 Page 7 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.3.8.1.B As required by The Loss of Not Undervoltage Refer to Section 2.9 of Same as Design Relays and other components (Unit 1) Action A.1 and Power (LOP) explicitly sensing capability this Enclosure for full Success Criteria related to the 65% and 20%

referenced in Instrumentation discussion of undervoltage condition are included 3.3.8.1.C Table 3.3.8.1-1 includes sensors, 1 Loss of Voltage instrumentation logic in the PRA. The 93% undervoltage (Unit 2) relays, bypass <20% condition is not modeled. As a capability, circuit 2. Degraded result, some SSCs are modeled and breakers, and Voltage 65% can be directly included in the RTR switches that are 3. Degraded tool for the RICT Program. Where necessary to trip Voltage 93% individual inputs are not explicitly offsite power modeled, a surrogate is selected.

circuits and start the diesel The PRA does not assume credit for generators (DGs) SSCs affected by a degraded voltage condition. The PRA models nominal power, loss of offsite power (LOOP), and station blackout (SBO) conditions.

3.3.8.1.C As required by The LOP Not Undervoltage Refer to Section 2.9 of Same as Design Relays and other components (Unit 1) Action A.1 and Instrumentation explicitly sensing capability this Enclosure for full Success Criteria related to the 65% and 20%

referenced in includes sensors, discussion of undervoltage condition are included 3.3.8.1.D Table 3.3.8.1-1 relays, bypass 1 Loss of Voltage instrumentation logic in the PRA. The 93% undervoltage (Unit 2) capability, circuit <20% condition is not modeled. As a breakers, and 2. Degraded result, some SSCs are modeled and switches that are Voltage 65% can be directly included in the RTR necessary to trip 3. Degraded tool for the RICT Program. Where offsite power Voltage 93% individual inputs are not explicitly circuits and start modeled, a surrogate is selected.

the DGs The PRA does not assume credit for SSCs affected by a degraded voltage condition. The PRA models nominal power, LOOP, and SBO conditions.

Enclosure 2 to PLA-7984 Page 8 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.1.A One low pressure CS and LPCI Yes Low pressure One Core Spray Same as Design SSCs are modeled consistent with ECCS trains injection subsystem or one LPCI Success Criteria the TS and can be directly included injection/spray capability subsystem (only one in the RTR tool for the RICT subsystem pump required) Program. The success criteria are inoperable for consistent with the design basis.

reasons other than Condition B 3.5.1.B One LPCI pump in LPCI trains Yes Low pressure Four pumps. Two 100% Loss of Coolant SSCs are modeled consistent with one or both LPCI injection capacity pumps per Accident the TS and can be directly included subsystems capability subsystem. One pump for (LOCA) in in the RTR tool for the RICT inoperable success. bottom head - Program. The PRA success criteria One RHR pump are generally consistent with the in each design basis.

subsystem LOCA in the bottom head is a low Other LOCAs, likelihood and non risk-significant BOC, and sequence which is not required to be Interfacing analyzed in the design bases.

System LOCAs -

One RHR pump in either subsystem

Enclosure 2 to PLA-7984 Page 9 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.1.D HPCI system HPCI Yes High pressure 5/6 ADS Valves and one RCIC System SSCs are modeled consistent with inoperable injection of two Core Spray the TS and can be directly included capability subsystems OR in the RTR tool for the RICT Program. The success criteria are OR Feedwater consistent with the design basis.

System 5/6 ADS valves and one The ADS design success criteria are of two LPCI subsystems OR established consistent with the (only one pump required) single failure criterion and represent 3/6 ADS valves the complement of equipment with and one of two which the DBA analyses are Core Spray performed. The ADS PRA success subsystems criteria are based on performance of thermal hydraulic analyses which OR demonstrated only one division of ADS (i.e., three valves) are required 3/6 ADS valves to de-pressurize the reactor and one of two assuming control rods are inserted.

LPCI subsystems Additionally, the PRA success criteria take credit for non-safety related RCIC and Feedwater, which cannot be credited in the design success criteria.

Enclosure 2 to PLA-7984 Page 10 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.1.E HPCI System HPCI coincident Yes High pressure and 5/6 ADS valves and RCIC System SSCs are modeled consistent with inoperable. with one or more low pressure remaining low pressure the TS and can be directly included AND LPCI subsystems injection injection capability OR in the RTR tool for the RICT Condition A or or one CS capability Program. The success criteria are Condition B subsystem out of Feedwater consistent with the design basis.

entered service System The ADS design success criteria are OR established consistent with the single failure criterion and represent 3/6 ADS valves the complement of equipment with and remaining which the DBA analyses are low pressure performed. The ADS PRA success injection criteria are based on performance of capability thermal hydraulic analyses which demonstrated only one division of ADS (i.e., three valves) are required to de-pressurize the reactor assuming control rods are inserted.

Additionally, the PRA success criteria take credit for non-safety related RCIC and Feedwater, which cannot be credited in the design success criteria.

Enclosure 2 to PLA-7984 Page 11 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.1.F One ADS valve ADS valves and Yes Reactor vessel 5/6 ADS Valves and one RCIC System SSCs are modeled consistent with inoperable supporting depressurization of two Core Spray the TS and can be directly included components subsystems OR in the RTR tool for the RICT Program. PRA success criteria are OR Feedwater dependent on the initiating event.

System 5/6 ADS valves and one The ADS design success criteria are of two LPCI subsystems OR established consistent with the (only one pump required) single failure criterion and represent 3/6 ADS valves the complement of equipment with OR and one of two which the DBA analyses are Core Spray performed. The ADS PRA success HPCI System subsystems criteria are based on performance of thermal hydraulic analyses which OR demonstrated only one division of ADS (i.e., three valves) are required 3/6 ADS valves to de-pressurize the reactor and one of two assuming control rods are inserted.

LPCI subsystems Additionally, the PRA success criteria take credit for non-safety related RCIC and Feedwater, which cannot be credited in the design success criteria.

Enclosure 2 to PLA-7984 Page 12 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.1.G One ADS valve ADS coincident Yes Reactor vessel 5/6 ADS valves and RCIC System SSCs are modeled consistent with inoperable AND with one or more depressurization remaining low pressure the TS and can be directly included Condition A OR LPCI subsystems and low pressure injection capability OR in the RTR tool for the RICT Condition B or one CS injection Program. The success criteria are entered subsystem out of capability OR Feedwater consistent with the design basis.

service System HPCI System The ADS design success criteria are OR established consistent with the single failure criterion and represent 3/6 ADS Valves the complement of equipment with and remaining which the DBA analyses are low pressure performed. The ADS PRA success injection criteria are based on performance of capability thermal hydraulic analyses which demonstrated only one division of ADS (i.e., three valves) are required to de-pressurize the reactor assuming control rods are inserted.

Additionally, the PRA success criteria take credit for non-safety related RCIC and Feedwater, which cannot be credited in the design success criteria.

Enclosure 2 to PLA-7984 Page 13 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.5.3.A RCIC System RCIC Yes Supply high HPCI System HPCI System SSCs are modeled consistent with inoperable pressure makeup the TS and can be directly included water to the RPV. OR OR in the RTR tool for the RICT Program. The success criteria are 5/6 ADS Valves and one Feedwater consistent with the design basis.

of two Core Spray System subsystems The ADS design success criteria are OR established consistent with the OR single failure criterion and represent 3/6 ADS valves the complement of equipment with 5/6 ADS valves and one and one of two which the DBA analyses are of two LPCI subsystems Core Spray performed. The ADS PRA success (only one pump required) subsystems criteria are based on performance of thermal hydraulic analyses which OR demonstrated only one division of ADS (i.e., three valves) are required 3/6 ADS valves to de-pressurize the reactor and one of two assuming control rods are inserted.

LPCI subsystems Additionally, the PRA success criteria take credit for non-safety related RCIC and Feedwater, which cannot be credited in the design success criteria.

3.6.1.2.C Primary Primary Not Primary One of two doors to N/A The airlocks are not explicitly containment air containment explicitly containment maintain boundary modeled in the PRA. Containment lock inoperable for airlock boundary failure is used as a conservative reasons other than maintained surrogate for the RICT calculation.

Condition A or B

Enclosure 2 to PLA-7984 Page 14 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.6.1.3.A One or more Containment Not Primary One of two isolation Same as Design Not all primary containment penetration flow penetration flow explicitly containment valves per penetration Success Criteria isolation valves are modeled.

paths with one paths with isolation Containment failure is used as a Primary isolation valves capability conservative surrogate for the RICT Containment maintained calculation.

Isolation Valve (PCIV) inoperable, except for purge valve leakage not within limit 3.6.1.6.A One suppression Suppression Yes Suppression- Four of five vacuum Same as Design SSCs are modeled consistent with chamber-to- chamber-to- chamber-to- breaker pairs Success Criteria the TS and can be directly included drywell vacuum drywell vacuum drywell vacuum in the RTR tool for the RICT breaker pair breakers mitigation Program. The success criteria are inoperable for consistent with the design basis.

opening 3.6.2.3.A One RHR RHR Yes RHR suppression One of two subsystems Same as Design SSCs are modeled consistent with suppression pool suppression pool pool cooling Success Criteria the TS and can be directly included cooling subsystem cooling trains in the RTR tool for the RICT inoperable Program. The success criteria are consistent with the design basis.

3.6.2.4.A One RHR RHR No RHR suppression One of two subsystems Same as Design Suppression pool spray is not suppression pool suppression pool pool spray Success Criteria modeled in the PRA. A surrogate set spray subsystem spray subsystems of events representing failure of the inoperable drywell sprays and the suppression pool cooling subsystem is used to bound the RICT calculation.

Enclosure 2 to PLA-7984 Page 15 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.7.1.A One valve in Table Residual Heat Yes RHRSW System One of two subsystems Same as Design SSCs are modeled consistent with 3.7.1-1 inoperable Removal Service and ultimate heat Success Criteria the TS and can be directly included OR Water (RHRSW) sink (UHS) in the RTR tool for the RICT One valve in Table valves Program. The success criteria are 3.7.1-2 inoperable consistent with the design basis.

OR One valve in Table 3.7.1-3 inoperable OR Any combination of valves in Table 3.7.1-1, Table 3.7.1-2, or Table 3.7.1-3 in the same return loop inoperable 3.7.1.B One RHRSW RHRSW Yes RHRSW System One of two subsystems Same as Design SSCs are modeled consistent with subsystem subsystem - and UHS Success Criteria the TS and can be directly included inoperable pumps, in the RTR tool for the RICT flowpaths, and Program. The success criteria are UHS consistent with the design basis.

Enclosure 2 to PLA-7984 Page 16 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.7.2.A One Emergency ESW pumps Yes ESW cooling One ESW pump in each For all cooling SSCs are modeled consistent with Service Water subsystem loads including the TS and can be directly included (ESW) pump in TBCCW and in the RTR tool for the RICT each subsystem RBCCW, one Program. The success criteria are inoperable pump in each consistent with the design basis.

subsystem The design success criteria are For all cooling established consistent with the loads not single failure criterion and represent including the complement of equipment with TBCCW and which the DBA analyses are RBCCW, one of performed. The PRA success four pumps criteria are based on performance of thermal hydraulic analyses which demonstrated only one ESW pump is required to provide the required cooling to all safety-related ESW loads, but that one pump from each ESW division is required to provide adequate cooling to the non-safety related RBCCW and TBCCW systems. These systems are not required to mitigate a design basis event and are excluded from the design success criteria.

Enclosure 2 to PLA-7984 Page 17 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.7.2.B One or two ESW ESW Yes ESW cooling flow One of two subsystems One ESW pump SSCs are modeled consistent with subsystems not subsystems, to DGs in remaining the TS and can be directly included capable of ESW flow to subsystem in the RTR tool for the RICT supplying ESW support DG Program. The success criteria are flow to at least operation consistent with the design basis. A three required DGs RICT is only applied to a single inoperable ESW subsystem.

The design success criteria are established consistent with the single failure criterion and represent the complement of equipment with which the DBA analyses are performed. The PRA success criteria are based on performance of thermal hydraulic analyses which demonstrated only one ESW pump is required to provide the required cooling to all safety-related ESW loads.

Enclosure 2 to PLA-7984 Page 18 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.7.2.C One ESW ESW pumps Yes ESW cooling One of two subsystems For all cooling SSCs are modeled consistent with subsystem loads not the TS and can be directly included inoperable for including in the RTR tool for the RICT reasons other than TBCCW and Program. The success criteria are Condition B RBCCW, one of consistent with the design basis.

four ESW pumps The design success criteria are established consistent with the single failure criterion and represent the complement of equipment with which the DBA analyses are performed. The PRA success criteria are based on performance of thermal hydraulic analyses which demonstrated only one ESW pump is required to provide the required cooling to all safety-related ESW loads, but that one pump from each ESW division is required to provide adequate cooling to the non-safety related RBCCW and TBCCW systems. These systems are not required to mitigate a design basis event and are excluded from the design success criteria.

3.8.1.A One offsite circuit Offsite power Yes Supply AC loads One of two offsite As needed to SSCs are modeled consistent with inoperable circuits during normal circuits supply supported the TS and can be directly included operation functions in the RTR tool for the RICT Program. The success criteria are consistent with the design basis.

Enclosure 2 to PLA-7984 Page 19 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.8.1.B One required DG DGs and Yes Supply AC loads 3/4 DGs As needed to SSCs are modeled consistent with inoperable required support during abnormal supply supported the TS scope and so can be directly systems operation functions included in the RTR tool for the RICT Program. The success criteria are consistent with the design basis 3.8.1.C Two offsite Offsite power Yes Supply AC loads 3/4 DGs As needed to SSCs are modeled consistent with circuits inoperable circuits during normal supply supported the TS and can be directly included operation functions in the RTR tool for the RICT Program. The success criteria are consistent with the design basis.

3.8.1.D One offsite circuit Offsite power Yes Supply AC loads One of two offsite As needed to SSCs are modeled consistent with inoperable AND circuits during normal/ circuits supply supported the TS and can be directly included One required DG abnormal functions in the RTR tool for the RICT inoperable DGs and operation OR Program. The success criteria are required support consistent with the design basis.

systems 3/4 DGs

Enclosure 2 to PLA-7984 Page 20 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.8.4.A One battery 125 VDC battery Yes Provide DC For 125 VDC, 3/4 As needed to SSCs are modeled consistent with charger on one chargers power during subsystems with their supply supported the TS and can be directly included 125 VDC normal operations associated battery functions in the RTR tool for the RICT electrical power 250 VDC battery and maintain DC chargers Program. The success criteria are subsystem chargers battery voltage consistent with the design basis.

inoperable and float current For 250 VDC, 1/2 OR subsystems. If Division II One battery 250 VDC, then the charger on subsystem requires its 250 VDC corresponding battery Division II charger. If Division I 250 electrical power VDC, then the subsystem subsystem requires one of two inoperable battery chargers.

OR Two battery chargers on 250 VDC Division 1 electrical power subsystem inoperable 3.8.4.B One 125 VDC 125 VDC battery Yes Provide DC For 125 VDC, 3/4 As needed to SSCs are modeled consistent with battery bank bank power during subsystems supply supported the TS scope and so can be directly inoperable abnormal functions included in the RTR tool for the OR 250 VDC battery operations For 250 VDC, One of RICT Program. The success criteria One 250 VDC bank two subsystems. are consistent with the design basis battery bank inoperable Design success criteria is dependent upon the load supplied.

Enclosure 2 to PLA-7984 Page 21 of 29 Table E1-1 In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered Function Modeled PRA Success SSES TS TS Description by TS LCO Covered by TS Design Success Criteria Comments in PRA Criteria Condition LCO Condition 3.8.4.C One DC electrical 125 VDC Yes Provide DC For 125 VDC, 3/4 As needed to SSCs are modeled consistent with power subsystem subsystem power during subsystems supply supported the TS scope and so can be directly inoperable for normal and functions included in the RTR tool for the reasons other than 250 VDC abnormal For 250 VDC, One of RICT Program. The success criteria Conditions A or B subsystem operations two subsystems. are consistent with the design basis Design success criteria is dependent upon the load supplied.

3.8.7.A One or more AC AC buses, load Yes Distribute AC One of two divisions As needed to SSCs are modeled consistent with electrical power centers, motor power to required supply supported the TS scope and so can be directly distribution control centers, loads functions included in the RTR tool for the subsystems distribution RICT Program. The success criteria inoperable panels are consistent with the design basis 3.8.7.B One or more DC DC electrical Yes Distribute DC One of two divisions As needed to SSCs are modeled consistent with electrical power power power to required supply supported the TS scope and so can be directly distribution distribution loads functions included in the RTR tool for the subsystems subsystems RICT Program. The success criteria inoperable are consistent with the design basis 3.8.7.C One Unit 1 AC AC buses, load Yes Distribute AC One of two divisions As needed to SSCs are modeled consistent with (Unit 2 electrical power centers, motor power to required supply supported the TS scope and so can be directly only) distribution control centers, loads functions included in the RTR tool for the subsystem distribution RICT Program. The success criteria inoperable panels are consistent with the design basis 3.8.7.D Two Unit 1 AC AC buses, load Yes Distribute AC One of two divisions As needed to SSCs are modeled consistent with (Unit 2 electrical power centers, motor power to required supply supported the TS scope and so can be directly only) distribution control centers, loads functions included in the RTR tool for the subsystems on one distribution RICT Program. The success criteria division inoperable panels are consistent with the design basis for performance of Unit 1 SR 3.8.1.19

Enclosure 2 to PLA-7984 Page 22 of 29 Table E1-2 Example RICT Calculations RICT TS LCO Condition Estimate (Days) (1)(2) 3.1.7.B One SLC subsystem inoperable for reasons other than Condition A 30.0 3.3.1.1.A One or more required channels inoperable 0.1(3) 3.3.1.1.B One or more Functions with one or more Functions with one or 0.1(3) more required channels inoperable in both trip systems 3.3.2.1.A One RBM channel inoperable 30.0(3) 3.3.2.2.A One feedwater - main turbine high water level trip channel 30.0 inoperable 3.3.4.1.A One or more channels inoperable AND 30.0 MCPR limit for inoperable EOC-RPT not made applicable 3.3.4.2.A One or more channels inoperable 30.0 3.3.5.1.B As required by Required Action A.1 and referenced in 11.2 Table 3.3.5.1-1 3.3.5.1.C As required by Required Action A.1 and referenced in 7.3 Table 3.3.5.1-1 3.3.5.1.D As required by Required Action A.1 and referenced in 30.0(3)

Table 3.3.5.1-1 3.3.5.1.E As required by Required Action A.1 and referenced in 30.0(3)

Table 3.3.5.1-1 3.3.5.1.F As required by Required Action A.1 and referenced in 0.1 Table 3.3.5.1-1 3.3.5.3.B As required by Required Action A.1 and referenced in 30.0 Table 3.3.5.3-1 3.3.5.3.D As required by Required Action A.1 and referenced in 30.0 Table 3.3.5.3-1 3.3.6.1.A One or more required channels inoperable 0.0(3) 3.3.8.1.B One or more required channels associated with Unit 1 4.16 kV ESS 30.0 (Unit 2) Buses in one Division inoperable for the performance of SR 3.8.1.19 3.3.8.1.B As required by Required Action A.1 and referenced in 30.0 (Unit 1) Table 3.3.8.1-1 3.3.8.1.C As required by Required Action A.1 and referenced in 30.0 (Unit 2) Table 3.3.8.1-1

Enclosure 2 to PLA-7984 Page 23 of 29 Table E1-2 Example RICT Calculations RICT TS LCO Condition Estimate (Days) (1)(2) 3.3.8.1.C As required by Required Action A.1 and referenced in Table 3.6 (Unit 1) 3.3.8.1-1 3.3.8.1.D As required by Required Action A.1 and referenced in Table 2.5 (Unit 2) 3.3.8.1-1 3.5.1.A One low pressure ECCS injection/spray subsystem inoperable for 7.3 reasons other than Condition B 3.5.1.B One LPCI pump in one or both LPCI subsystems inoperable 30.0 3.5.1.D HPCI system inoperable 27.5 3.5.1.E HPCI System inoperable AND Condition A or Condition B entered 6.6 3.5.1.F One required ADS valve inoperable 30.0 3.5.1.G One ADS valve inoperable AND Condition A OR Condition B 7.3 entered 3.5.3.A RCIC System inoperable 30.0 3.6.1.2.C Primary containment air lock inoperable for reasons other than 10.1(3)

Condition A or B 3.6.1.3.A One or more penetration flow paths with one PCIV inoperable 10.1(3) except for purge valve leakage not within limit 3.6.1.6.A One suppression chamber-to-drywell vacuum breaker pair 30.0 inoperable for opening 3.6.2.3.A One RHR suppression pool cooling subsystem inoperable 30.0 3.6.2.4.A One RHR suppression pool spray subsystem inoperable 30.0(3) 3.7.1.A One valve in Table 3.7.1-1 inoperable OR 30.0 One valve in Table 3.7.1-2 inoperable OR One valve in Table 3.7.1-3 inoperable OR Any combination of valves in Table 3.7.1-1, Table 3.7.1-2, or Table 3.7.1-3 in the same return loop inoperable 3.7.1.B One RHRSW subsystem inoperable 30.0 3.7.2.A One ESW pump in each subsystem inoperable 3.7 3.7.2.B One or two ESW subsystems not capable of supplying ESW flow to 2.0 at least three required DGs 3.7.2.C One ESW subsystem inoperable for reasons other than Condition B 2.0 3.8.1.A One offsite circuit inoperable 30.0

Enclosure 2 to PLA-7984 Page 24 of 29 Table E1-2 Example RICT Calculations RICT TS LCO Condition Estimate (Days) (1)(2) 3.8.1.B One required DG inoperable 30.0 3.8.1.C Two offsite circuits inoperable 6.8 3.8.1.D One offsite circuit inoperable AND One required DG inoperable 30.0 3.8.4.A One battery charger on one 125 VDC electrical power subsystem 3.4 inoperable OR One battery charger on 250 VDC Division II electrical power subsystem inoperable OR Two battery chargers on 250 VDC Division I electrical power subsystem inoperable 3.8.4.B One 125 VDC battery bank inoperable OR 3.0 One 250 VDC battery bank inoperable 3.8.4.C One DC electrical power subsystem inoperable for reasons other 0.4 than Conditions A or B 3.8.7.A One or more AC electrical power distribution subsystems 0.9 inoperable.

3.8.7.B One or more DC electrical power distribution subsystems 0.4 inoperable 3.8.7.C One Unit 1 AC electrical power distribution subsystem inoperable 30.0 (Unit 2) 3.8.7.D Two Unit 1 AC electrical power distribution subsystems on one 30.0 (Unit 2) division inoperable for performance of Unit 1 SR 3.8.1.19 NOTES:

1. RICTs are based on the internal events, internal flood, and internal fire PRA model calculations with seismic penalties. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest tenth of a day.

2. Per NEI 06-09-A, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.

3. Not explicitly modeled, surrogate modeling was used to represent the TS function.

Enclosure 2 to PLA-7984 Page 25 of 29 Table E1-4 RPS Instrumentation Diversity Credited Safety Analysis Event Function FSAR Diverse Instrumentation Event Transient/Accident Section

1. Intermediate Range Monitors 1.a Neutron Flux - High 15.4.1 Rod Withdrawal Error - Low 1) Automatic Initiation - AOT Power - IRM High Neutron Flux Trip

- APRM 2-out-of-4 Voter Logic Trip

2) Manual Scram 1.b Inop None None Manual Scram None

2. Average Power Range Monitors 2.a Neutron Flux - High (Setdown) 15.4 Reactivity and Power 1) Automatic Initiation - AOT Distribution Anomalies - IRM High Neutron Flux Trip

- APRM 2-out-of-4 Voter Logic Trip

2) Manual Scram 2.b Simulated Thermal Power - High None None 1) Automatic Initiation - None

- APRM 2-out-of-4 Voter Logic Trip

2) Manual Scram 2.c Neutron Flux - High 15.4.9 Control Rod Drop Accident 1) Automatic Initiation - DBA (CRDA) - APRM 2-out-of-4 Voter Logic Trip

2) Manual Scram 5.2.2 Overpressure Protection 1) Automatic Initiation - AOT

- APRM 2-out-of-4 Voter Logic Trip 15.2 Increases in Reactor Pressure 2) Manual Scram 2.d Inop None None Manual Scram None 2.e 2-Out-Of-4 Voter 5.2.2 Overpressure Protection Manual Scram AOT 15.2 Increases in Reactor Pressure 15.4 Reactivity and Power Distribution Anomalies 15.4.9 CRDA

Enclosure 2 to PLA-7984 Page 26 of 29 Table E1-4 RPS Instrumentation Diversity Credited Safety Analysis Event Function FSAR Diverse Instrumentation Event Transient/Accident Section 2.f OPRM Trip None None 1) Automatic Initiation - None

- OPRM 2-out-of-4 Voter Logic Trip

2) Manual Scram

3. Reactor Vessel Steam Dome 15.2.1 Pressure Regulator Failure - 1) Automatic Initiation - AOT -

Pressure - High Closed - IRM Neutron Flux High Trip Expected

- APRM 2-out-of-4 Voter Logic Trip

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram 15.2.3 Turbine Trip 1) Automatic Initiation - AOT -

- IRM Neutron Flux High Trip Expected

- APRM 2-out-of-4 Voter Logic Trip

- Reactor Vessel Steam Dome High Pressure Trip

- TSV Closure Trip

- TCV Closure Trip

2) Manual Scram 15.2.4 MSIV Closures 1) Automatic Initiation - AOT -

- IRM Neutron Flux High Trip Expected

- APRM 2-out-of-4 Voter Logic Trip

- Reactor Vessel Steam Dome High Pressure Trip

- MSIV Closure Trip

2) Manual Scram

4. Reactor Vessel Water Level - Low, 15.2.7 Loss of Feedwater Flow 1) Automatic Initiation - AOT -

Level 3 - Reactor Vessel Water Level 3 Trip Expected

- MSIV Closure Trip

2) Manual Scram

Enclosure 2 to PLA-7984 Page 27 of 29 Table E1-4 RPS Instrumentation Diversity Credited Safety Analysis Event Function FSAR Diverse Instrumentation Event Transient/Accident Section

4. (continued) 15.6.5 LOCAs (Resulting from 1) Automatic Initiation - DBA Spectrum of Postulated Piping - Reactor Vessel Water Level 3 Trip Breaks within the Reactor - High Drywell Pressure Trip Coolant Pressure Boundary 2) Manual Scram (RCPB)) - Inside Containment (Hereafter simply referred to as LOCA within Enclosure 1 Tables)

5. Main Steam Isolation Valve - Closure 15.2.4 MSIV Closures 1) Automatic Initiation - AOT -

- MSIV Closure Trip Expected

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram 15.6.4 Steam System Piping Break 1) Automatic Initiation - DBA Outside Containment - MSIV Closure Trip

2) Manual Scram

6. Drywell Pressure - High 15.6.5 LOCA 1) Automatic Initiation - DBA

- Reactor Vessel Water Level 3 Trip

- High Drywell Pressure Trip

2) Manual Scram

7. Scram Discharge Volume Water Level - High 7.a Level Transmitter None None 1) Automatic Initiation - None

- SDV High Water Level (level transmitter) Trip

- SDV High Water Level (float switch) Trip

2) Manual Scram 7.b Float Switch None None 1) Automatic Initiation - None

- SDV High Water Level (float switch) Trip

- SDV High Water Level (level transmitter) Trip

2) Manual Scram

Enclosure 2 to PLA-7984 Page 28 of 29 Table E1-4 RPS Instrumentation Diversity Credited Safety Analysis Event Function FSAR Diverse Instrumentation Event Transient/Accident Section

8. Turbine Stop Valve - Closure 15.1.2 Feedwater Controller Failure - 1) Automatic Initiation - AOT -

Maximum Demand - TSV Closure Trip Expected

- TCV Closure Trip

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram 15.2.3 Turbine Trip 1) Automatic Initiation - AOT -

- TSV Closure Trip Expected

- TCV Closure Trip

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram 15.2.5 Loss of Condenser Vacuum 1) Automatic Initiation - AOT -

- TSV Closure Trip Expected

- TCV Closure Trip

- MSIV Closure Trip

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram 15.3.1 Recirculation Pump Trip 1) Automatic Initiation - AOT -

- TSV Closure Trip Expected

- TCV Closure Trip

2) Manual Scram

9. Turbine Control Valve Fast Closure, 15.2.2 Generator Load Rejection 1) Automatic Initiation - AOT -

Trip Oil Pressure - Low - TSV Closure Trip Expected

- TCV Closure Trip

- Reactor Vessel Steam Dome High Pressure Trip

2) Manual Scram

10. Reactor Mode Switch - Shutdown None None Manual Trip None Position - Manual Scram

- Reactor Mode Switch - Shutdown Position

- Manually initiate alternate rod insertion (ARI)

Enclosure 2 to PLA-7984 Page 29 of 29 Table E1-4 RPS Instrumentation Diversity Credited Safety Analysis Event Function FSAR Diverse Instrumentation Event Transient/Accident Section

11. Manual Scram None None Manual Trip None

- Manual Scram

- Reactor Mode Switch - Shutdown Position

- Manually initiate ARI

Enclosure 3 of PLA-7984 Marked-Up Technical Specification Pages Revised Technical Specification Pages Unit 1 TS Pages 3.7-1, 3.7-2, 3.7-3, 3.7-3a, 3.7-3b, 3.7-3c, 3.7-3d, 3.7-3e, 3.7-4, 3.7-5, 3.7-5a, 3.7-5b, 5.0-18c, and 5.0-18d Unit 2 TS Pages 3.7-1, 3.7-2, 3.7-3, 3.7-3a, 3.7-3b, 3.7-4, 3.7-5, 3.7-5a, 3.7-5b, 3.8-44, 3.8-45, 3.8-46, 3.8-47, 3.8-48, 3.8-49, 3.8-49a, 5.0-18c, and 5.0-18d

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 3.7 PLANT SYSTEMS 3.7.1 Residual Heat Removal Service Water (RHRSW) System and the Ultimate Heat Sink (UHS)

LCO 3.7.1 Two RHRSW subsystems and the UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE-----------------------------------------------------------

Enter applicable Conditions and Required Actions of LCO 3.4.8, Residual Heat Removal (RHR)

Shutdown Cooling System-Hot Shutdown, for RHR shutdown cooling made inoperable by RHRSW System.

CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------ A.1 Declare the associated Immediately Separate Condition entry RHRSW subsystems is allowed for each valve. inoperable AND One valve in Table 3.7.1-1 inoperable. A.2 Establish an open flow path 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to the UHS.

OR AND One valve in Table 3.7.1-2 inoperable. A.3 Restore the inoperable 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months from the valve(s) to OPERABLE discovery of an OR status. inoperable RHRSW subsystem in the One valve in opposite loop from the Table 3.7.1-3 inoperable. inoperable valve(s)

OR AND SUSQUEHANNA - UNIT 1 3.7-1 Amendment 178, 206, 246, XXX

RHRSW System and UHS 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME Any combination of A.3 (continued) 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months valves in Table 3.7.1-1, Table 3.7.1-2, or OR Table 3.7.1-3 in the same return loop inoperable. In accordance with the Risk Informed Completion Time Program B. One Unit 1 RHRSW B.1 Restore the Unit 1 RHRSW 14 days during the subsystem inoperable. subsystem to OPERABLE replacement of the status. Unit 2 ESW piping(1)

OR 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from discovery of the associated Unit 2 RHRSW subsystem inoperable OR In accordance with the Risk Informed Completion Time Program AND 7 days OR In accordance with the Risk Informed Completion Time Program OR SUSQUEHANNA - UNIT 1 3.7-2 Amendment 178, 182, 206, 275, XXX

RHRSW System and UHS 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) --------------------NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

B.2 Restore the Unit 1 RHRSW 14 days during the subsystem to OPERABLE replacement of the status. Unit 2 ESW piping(1)

C. Both Unit 1 RHRSW C.1 Restore one Unit 1 RHRSW 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months from discovery subsystems inoperable. subsystem to OPERABLE of one Unit 2 RHRSW status. subsystem not capable of supporting associated Unit 1 RHRSW subsystem AND 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND OR D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months UHS inoperable.

(1)This Completion Time is only applicable during the Unit 2 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2027.

SUSQUEHANNA - UNIT 1 3.7-3 Amendment 178, 182, 206, 246, 266 XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.1.1 Verify the water level is greater than or equal to In accordance with 678 feet 1 inch above Mean Sea Level. the Surveillance Frequency Control Program SR 3.7.1.2 Verify the average water temperature of the UHS is: In accordance with the Surveillance

a. -----------------------------NOTE----------------------------- Frequency Control Only applicable with both units in MODE 1 or 2, or Program with either unit in MODE 3 for less than twelve (12) hours.

85°F; or

b. -----------------------------NOTE-----------------------------

Only applicable when either unit has been in MODE 3 for at least twelve (12) hours but not more than twenty-four (24) hours.

87°F; or

c. -----------------------------NOTE-----------------------------

Only applicable when either unit has been in MODE 3 for at least twenty-four (24) hours.

88°F.

SR 3.7.1.3 Verify each RHRSW manual, power operated, and In accordance with automatic valve in the flow path, that is not locked, the Surveillance sealed, or otherwise secured in position, is in the Frequency Control correct position or can be aligned to the correct Program position.

SR 3.7.1.4 Verify that valves HV-01222A and B (the spray array In accordance with bypass valves) close upon receipt of a closing signal the Surveillance and open upon receipt of an opening signal. Frequency Control Program SUSQUEHANNA - UNIT 1 3.7-3a Amendment 206, 246, 266, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.7.1.5 Verify that valves HV-01224A1 and B1 (the large In accordance with spray array valves) close upon receipt of a closing the Surveillance signal and open upon receipt of an opening signal. Frequency Control Program SR 3.7.1.6 Verify that valves HV-01224A2 and B2 (the small In accordance with spray array valves) close upon receipt of a closing the Surveillance signal and open upon receipt of an opening signal. Frequency Control Program SR 3.7.1.7 Verify that valves 012287A and 012287B (the spray In accordance with array bypass manual valves) are capable of being the Surveillance opened and closed. Frequency Control Program SUSQUEHANNA - UNIT 1 3.7-3b Amendment 206, 246, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 TABLE 3.7.1-1 Ultimate Heat Sink Spray Array Valves VALVE NUMBER VALVE DESCRIPTION HV-01224A1 Loop A large spray array valve HV-01224B1 Loop B large spray array valve HV-01224A2 Loop A small spray array valve HV-01224B2 Loop B small spray array valve SUSQUEHANNA - UNIT 1 3.7-3c Amendment 246, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 TABLE 3.7.1-2 Ultimate Heat Sink Spray Array Bypass Valves VALVE NUMBER VALVE DESCRIPTION HV-01222A Loop A spray array bypass valve HV-01222B Loop B spray array bypass valve SUSQUEHANNA - UNIT 1 3.7-3d Amendment 246, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 TABLE 3.7.1-3 Ultimate Heat Sink Spray Array Bypass Manual Valves VALVE NUMBER VALVE DESCRIPTION 012287A Loop A spray array bypass manual valve 012287B Loop B spray array bypass manual valve SUSQUEHANNA - UNIT 1 3.7-3e Amendment XXX

ESW System 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Service Water (ESW) System LCO 3.7.2 Two ESW subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

Editorial change ACTIONS

NOTE-----------------------------------------------------------

Enter applicable Conditions and Required Actions of LCO 3.8.1, AC Sources - Operating, for DGs made inoperable by ESW.

CONDITION REQUIRED ACTION COMPLETION TIME A. One ESW pump in each A.1 Restore both ESW pumps to 7 days subsystem inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program SUSQUEHANNA - UNIT 1 3.7-4 Amendment 178, 275, XXX

ESW System 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One or two ESW B.1 Restore ESW flow to the 14 days during the subsystems not capable required DGs to ensure that replacement of the of supplying ESW flow to each ESW subsystem is Unit 2 ESW piping(1) at least three required supplying at least three DGs. DGs. OR 7 days OR

NOTE-----------

Not applicable if there is a loss of function.

In accordance with the Risk Informed Completion Time Program OR

NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

B.2 Restore ESW flow to the 14 days during the required DGs to ensure that replacement of the each ESW subsystem is Unit 2 ESW piping(1) supplying at least three DGs.

(1) This Completion Time is only applicable during the Unit 2 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2027.

SUSQUEHANNA - UNIT 1 3.7-5 Amendment 178, 266, 275, XXX

ESW System 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One ESW subsystem C.1 Restore the ESW 14 days during the inoperable for reasons subsystem to OPERABLE replacement of the other than Condition B. status. Unit 2 ESW piping(1)

OR 7 days OR In accordance with the Risk Informed Completion Time Program OR

NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

C.2 Restore the ESW 14 days during the subsystem to OPERABLE replacement of the status. Unit 2 ESW piping(1)

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B or AND C not met.

D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Both ESW subsystems inoperable for reasons other than Conditions A and B.

(1) This Completion Time is only applicable during the Unit 2 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2027.

SUSQUEHANNA - UNIT 1 3.7-5a Amendment XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY ESW System 3.7.2 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 -------------------------------NOTE--------------------------------

Isolation of flow to individual components does not render ESW System inoperable.

Verify each ESW subsystem manual, power In accordance with operated, and automatic valve in the flow paths the Surveillance servicing safety related systems or components, that Frequency Control is not locked, sealed, or otherwise secured in Program position, is in the correct position.

SR 3.7.2.2 Verify each ESW subsystem actuates on an actual or In accordance with simulated initiation signal. the Surveillance Frequency Control Program SUSQUEHANNA - UNIT 1 3.7-5b Amendment XXX

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.14 Control Room Envelope Habitability Program (continued)

e. The quantitative limits on unfiltered air inleakage into the CRE. These limits shall be stated in a manner to allow direct comparison to the unfiltered air inleakage measured by the testing described in paragraph c. The unfiltered air inleakage limit for radiological challenges is the inleakage flow rate assumed in the licensing basis analyses of DBA consequences. Unfiltered air inleakage limits for hazardous chemicals must ensure that exposure of CRE occupants to these hazards will be within the assumptions in the licensing basis.

f. The provisions of SR 3.0.2 are applicable to the Frequencies for assessing CRE habitability, determining CRE unfiltered inleakage, and measuring CRE pressure and assessing the CRE boundary as required by paragraphs c and d, respectively.

5.5.15 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, Risk-Informed Method for Control of Surveillance Frequencies, Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days; SUSQUEHANNA - UNIT 1 5.0-18c Amendment 252, 266, XXX

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.16 Risk Informed Completion Time Program (continued)

b. A RICT may only be utilized in MODE 1 and 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods approved for use with this program, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

SUSQUEHANNA - UNIT 1 5.0-18d Amendment XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 3.7 PLANT SYSTEMS 3.7.1 Residual Heat Removal Service Water (RHRSW) System and the Ultimate Heat Sink (UHS)

LCO 3.7.1 Two RHRSW subsystems and the UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE-----------------------------------------------------------

Enter applicable Conditions and Required Actions of LCO 3.4.8, Residual Heat Removal (RHR)

Shutdown Cooling System-Hot Shutdown, for RHR shutdown cooling made inoperable by RHRSW System.

CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------ A.1 Declare the associated Immediately Separate Condition entry RHRSW subsystems is allowed for each valve. inoperable.

AND One valve in Table 3.7.1-1 inoperable. A.2 Establish an open flow path 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to the UHS.

OR AND One valve in Table 3.7.1-2 inoperable. A.3 Restore the inoperable 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months from the valve(s) to OPERABLE discovery of an OR status. inoperable RHRSW subsystem in the One valve in opposite loop from the Table 3.7.1-3 inoperable. inoperable valve(s)

OR AND SUSQUEHANNA - UNIT 2 3.7-1 Amendment 151, 180, 224, 238, 248 257, XXX

RHRSW System and UHS 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME Any combination of A.3 (continued) 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months valves in Table 3.7.1-1, Table 3.7.1-2, or OR Table 3.7.1-3 in the same return loop inoperable. 7 days during the replacement of 480 V ESS Load Center Transformers 1X210 and 1X220 in Unit 1(1)

OR In accordance with the Risk Informed Completion Time Program B. One Unit 2 RHRSW B.1 Restore the Unit 2 RHRSW 7 days during the subsystem inoperable. subsystem to OPERABLE replacement of 480 V status. ESS Load Center Transformers 1X210 and 1X220 in Unit 1(1)

OR 14 days during the replacement of the Unit 1 ESW piping(2)

OR 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from discovery of the associated Unit 1 RHRSW subsystem inoperable OR In accordance with the Risk Informed OR Completion Time Program SUSQUEHANNA - UNIT 2 3.7-2 Amendment 151, 156, 180, 238, 248 257, XXX

RHRSW System and UHS 3.7.1 AND 7 days OR In accordance with the Risk Informed Completion Time Program (1)Upon completion of the replacement of the 480 V ESS Load Center Transformers 1X210 and 1X220 in Unit 1, this temporary extension is no longer applicable and will expire on June 15, 2020.

SUSQUEHANNA - UNIT 2 3.7-2 Amendment 151, 156, 180, 238, 248 257, XXX

RHRSW System and UHS 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) --------------------NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

B.2 Restore the Unit 2 RHRSW 14 days during the subsystem to OPERABLE replacement of the status. Unit 1 ESW piping(1)

C. Both Unit 2 RHRSW C.1 Restore one Unit 2 RHRSW 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months from discovery subsystems inoperable. subsystem to OPERABLE of one Unit 1 RHRSW status. subsystem not capable of supporting associated Unit 2 RHRSW subsystem AND 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND OR D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months UHS inoperable.

(21)This Completion Time is only applicable during the Unit 1 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2026.

SUSQUEHANNA - UNIT 2 3.7-3 Amendment 151, 156, 180, 224, 247 257, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.1.1 Verify the water level is greater than or equal to In accordance with 678 feet 1 inch above Mean Sea Level. the Surveillance Frequency Control Program SR 3.7.1.2 Verify the average water temperature of the UHS is: In accordance with the Surveillance

a. ------------------------------NOTE---------------------------- Frequency Control Only applicable with both units in MODE 1 or 2, or Program with either unit in MODE 3 for less than twelve (12) hours.

85°F; or

b. ------------------------------NOTE----------------------------

Only applicable when either unit has been in MODE 3 for at least twelve (12) hours but not more than twenty-four (24) hours.

87°F; or

c. ------------------------------NOTE----------------------------

Only applicable when either unit has been in MODE 3 for at least twenty-four (24) hours.

88°F.

SR 3.7.1.3 Verify each RHRSW manual, power operated, and In accordance with automatic valve in the flow path, that is not locked, the Surveillance sealed, or otherwise secured in position, is in the Frequency Control correct position or can be aligned to the correct Program position.

SR 3.7.1.4 Verify that valves HV-01222A and B (the spray array In accordance with bypass valves) close upon receipt of a closing signal the Surveillance and open upon receipt of an opening signal. Frequency Control Program SUSQUEHANNA - UNIT 2 3.7-3a Amendment 180, 224, 247, 257, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY RHRSW System and UHS 3.7.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.7.1.5 Verify that valves HV-01224A1 and B1 (the large In accordance with spray array valves) close upon receipt of a closing the Surveillance signal and open upon receipt of an opening signal. Frequency Control Program SR 3.7.1.6 Verify that valves HV-01224A2 and B2 (the small In accordance with spray array valves) close upon receipt of a closing the Surveillance signal and open upon receipt of an opening signal. Frequency Control Program SR 3.7.1.7 Verify that valves 012287A and 012287B (the spray In accordance with array bypass manual valves) are capable of being the Surveillance opened and closed. Frequency Control Program SUSQUEHANNA - UNIT 2 3.7-3b Amendment 180, 224, 257, XXX

ESW System 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Service Water (ESW) System LCO 3.7.2 Two ESW subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

Editorial change ACTIONS

NOTE-----------------------------------------------------------

Enter applicable Conditions and Required Actions of LCO 3.8.1, AC Sources - Operating, for DGs made inoperable by ESW.

CONDITION REQUIRED ACTION COMPLETION TIME A. One ESW pump in each A.1 Restore both ESW pumps to 7 days subsystem inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program SUSQUEHANNA - UNIT 2 3.7-4 Amendment 151, 257, XXX

ESW System 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One or two ESW B.1 Restore ESW flow to the 14 days during the subsystems not capable required DGs to ensure that replacement of the of supplying ESW flow to each ESW subsystem is Unit 1 ESW piping(1) at least three required supplying at least three DGs. DGs. OR 7 days OR

NOTE-----------

Not applicable if there is a loss of function.

In accordance with the Risk Informed Completion Time Program OR

NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

B.2 Restore ESW flow to the 14 days during the required DGs to ensure that replacement of the each ESW subsystem is Unit 1 ESW piping(1) supplying at least three DGs.

(1)This Completion Time is only applicable during the Unit 1 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2026.

SUSQUEHANNA - UNIT 2 3.7-5 Amendment 151, 247, XXX

ESW System 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One ESW subsystem C.1 Restore the ESW 14 days during the inoperable for reasons subsystem to OPERABLE replacement of the other than Condition B. status. Unit 1 ESW piping(1)

OR 7 days OR In accordance with the Risk Informed Completion Time Program OR

NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 14-day Completion Time is in effect.

C.2 Restore the ESW 14 days during the subsystem to OPERABLE replacement of the status. Unit 1 ESW piping(1)

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, or AND C not met.

D.2 Be in MODE 4 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Both ESW subsystems inoperable for reasons other than Conditions A and B.

Editorial change (1)This Completion Time is only applicable during the Unit 1 A and B ESW piping replacement while the compensatory measures identified in Enclosure 2 to letter PLA-7830 are in place.

Upon completion of pipe replacement activities, this temporary extension is no longer applicable and will expire on June 25, 2026.

SUSQUEHANNA - UNIT 2 3.7-5a Amendment XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY ESW System 3.7.2 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 --------------------------------NOTE-------------------------------

Isolation of flow to individual components does not render ESW System inoperable.

Verify each ESW subsystem manual, power In accordance with operated, and automatic valve in the flow paths the Surveillance servicing safety related systems or components, that Frequency Control is not locked, sealed, or otherwise secured in Program position, is in the correct position.

SR 3.7.2.2 Verify each ESW subsystem actuates on an actual or In accordance with simulated initiation signal. the Surveillance Frequency Control Program SUSQUEHANNA - UNIT 2 3.7-5b Amendment XXX

Distribution Systems - Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Distribution Systems - Operating LCO 3.8.7 The electrical power distribution subsystems in Table 3.8.7-1 shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. -------------NOTE------------- --------------------NOTE--------------------

Not applicable to DG E Enter applicable Conditions and DC Bus 0D597 Required Actions of LCO 3.8.4, DC

Sources - Operating, for DC source(s) made inoperable by One or more Unit 2 AC inoperable power distribution electrical power subsystem(s).

distribution subsystems -------------------------------------------------

inoperable.

A.1 Restore Unit 2 AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution subsystem(s) to OPERABLE OR status.

NOTES----------

1. Not applicable if there is a loss of function.

2. Only applicable to AC electrical power sources included in the PRA model.

In accordance with the Risk Informed Completion Time Program SUSQUEHANNA - UNIT 2 3.8-44 Amendment 151, 202, 208, 238, 248 255, XXX

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. -------------NOTE------------- B.1 Restore Unit 2 DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Not applicable to DG E power distribution DC Bus 0D597. subsystem(s) to OPERABLE OR

status.

NOTE-----------

One or more Unit 2 DC Not applicable if there electrical power is a loss of function.

distribution subsystems ------------------------------

inoperable.

In accordance with the Risk Informed Completion Time Program C. One Unit 1 AC electrical C.1 Restore Unit 1 AC electrical 7 days during the power distribution power distribution replacement of 480 V subsystem inoperable. subsystem to OPERABLE ESS Load Center status. Transformers in Unit 1(1)

OR 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR

NOTE-----------

Only applicable to AC electrical power sources included in the PRA model.

In accordance with the Risk Informed Completion Time Program OR SUSQUEHANNA - UNIT 2 3.8-45 Amendment 151, 208, 255, 263, XXX

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. (continued) --------------------NOTE--------------------

The Risk Informed Completion Time Program cannot be applied if the temporary 7-day Completion Time is in effect.

C.2 Restore Unit 1 AC electrical 7 days during the power distribution replacement of 480 V subsystem to OPERABLE ESS Load Center status. Transformers in Unit 1(1)

D. Two Unit 1 AC electrical D.1 Restore at least one Unit 1 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution AC electrical power subsystems on one distribution subsystems to OR Division inoperable for OPERABLE status.

performance of Unit 1 -----------NOTE-----------

SR 3.8.1.19. Only applicable to AC electrical power sources included in the PRA model.

In accordance with the Risk Informed Completion Time Program E. Required Action and E.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Associated Completion Time of Condition A, B, or AND C not met.

E.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (1) This temporary 7-day completion time is applicable during the replacement of Unit 1 480 V ESS Load Center Transformers 1X230 and 1X240, while Unit 1 is in MODES 4 or 5, and will expire on June 15, 2024.

SUSQUEHANNA - UNIT 2 3.8-46 Amendment 151, 208, 255, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. Diesel Generator E DC F.1 Verify that all ESW valves 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months electrical power associated with Diesel subsystem inoperable, Generator E are closed.

while not aligned to the Class 1E distribution system.

G. Diesel Generator E DC G.1 Declare Diesel Generator E 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months electrical power inoperable.

subsystem inoperable, while aligned to the Class 1E distribution system.

H. Two or more electrical H.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of safety function.

I. -------------NOTE------------- I.1 Transfer associated Unit 1 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Not applicable to DG E and common loads to DC Bus 0D597. corresponding Unit 2 DC

electrical power distribution subsystem.

One or more Unit 1 DC electrical power AND distribution subsystem(s) inoperable. I.2 Restore Unit 1 and common 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after Unit 1 loads to corresponding DC electrical power Unit 1 DC electrical power subsystem is restored distribution subsystem. to OPERABLE status J. Required Actions and J.1 Declare associated common Immediately Associated Completion loads inoperable.

Times of Condition I not met.

SUSQUEHANNA - UNIT 2 3.8-47 Amendment 151, 247, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY Distribution Systems - Operating 3.8.7 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct breaker alignments and voltage or In accordance with indicated power availability to required AC and DC the Surveillance electrical power distribution subsystems. Frequency Control Program SUSQUEHANNA - UNIT 2 3.8-48 Amendment 151, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY Distribution Systems - Operating 3.8.7 Table 3.8.7-1 (page 1 of 2)

Unit 2 AC and DC Electrical Power Distribution Subsystems TYPE VOLTAGE DIVISION I DIVISION II AC Buses 4160 V 1A201 (Subsys. A) 1A202 (Subsys. B)

Load Groups 1A203 (Subsys. C) 1A204 (Subsys. D) 2A201 (Subsys. A) 2A202 (Subsys. B) 2A203 (Subsys. C) 2A204 (Subsys. D) 480 V 1B210 (Subsys. A) 1B220 (Subsys. B)

Load Centers 1B230 (Subsys. C) 1B240 (Subsys. D) 2B210 (Subsys. A) 2B220 (Subsys. B) 2B230 (Subsys. C) 2B240 (Subsys. D) 480 V 0B516 (Subsys. A) 0B526 (Subsys. B)

Motor Control Centers 0B517 (Subsys. A) 0B527 (Subsys. B) 1B216 (Subsys. A) 1B226 (Subsys. B) 1B217 (Subsys. A) 1B227 (Subsys. B) 0B536 (Subsys. C) 0B546 (Subsys. D) 0B136 (Subsys. C) 0B146 (Subsys. D) 1B236 (Subsys. C) 1B246 (Subsys. D) 2B216 (Subsys. A) 2B246 (Subsys. D) 2B236 (Subsys. C) 2B247 (Subsys. D) 2B237 (Subsys. C) 2B226 (Subsys. B) 2B217 (Subsys. A) 2B227 (Subsys. B) 208/120 V 1Y216 (Subsys. A) 1Y226 (Subsys. B)

Distribution Panels 1Y236 (Subsys. C) 1Y246 (Subsys. D) 2Y216 (Subsys. A) 2Y226 (Subsys. B) 2Y236 (Subsys. C) 2Y246 (Subsys. D)

SUSQUEHANNA - UNIT 2 3.8-49 Amendment 151, XXX

NO CHANGES - CONTENT ROLLED ACROSS PAGES ONLY Distribution Systems - Operating 3.8.7 Table 3.8.7-1 (page 2 of 2)

Unit 2 AC and DC Electrical Power Distribution Subsystems TYPE VOLTAGE DIVISION I DIVISION II DC Buses 250 V Buses 2D652 2D662 2D254 2D264 2D274 125 V Buses 1D612 (Subsys. A) 1D622 (Subsys. B) 1D614 (Subsys. A) 1D624 (Subsys. B) 1D632 (Subsys. C) 1D642 (Subsys. D) 1D634 (Subsys. C) 1D644 (Subsys. D) 2D612 (Subsys. A) 2D622 (Subsys. B) 2D614 (Subsys. A) 2D624 (Subsys. B) 2D632 (Subsys. C) 2D642 (Subsys. D) 2D634 (Subsys. C) 2D644 (Subsys. D)

DG E DC Bus 125 V Bus 0D597 SUSQUEHANNA - UNIT 2 3.8-49a Amendment XXX

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.14 Control Room Envelope Habitability Program (continued)

e. The quantitative limits on unfiltered air inleakage into the CRE. These limits shall be stated in a manner to allow direct comparison to the unfiltered air inleakage measured by the testing described in paragraph c. The unfiltered air inleakage limit for radiological challenges is the inleakage flow rate assumed in the licensing basis analyses of DBA consequences. Unfiltered air inleakage limits for hazardous chemicals must ensure that exposure of CRE occupants to these hazards will be within the assumptions in the licensing basis.

f. The provisions of SR 3.0.2 are applicable to the Frequencies for assessing CRE habitability, determining CRE unfiltered inleakage, and measuring CRE pressure and assessing the CRE boundary as required by paragraphs c and d, respectively.

Editorial changes 5.5.15 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical sSpecifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the sSurveillance Frequency Control Program shall be made in accordance with NEI 04-10, Risk-Informed mMethod for Control of Surveillance Frequencies, Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, Risk Managed Technical Specifications (RMTS) Guidelines. The program shall include the following:

a. The RICT may not exceed 30 days; SUSQUEHANNA - UNIT 2 5.0-18c Amendment 232, 247, XXX