SBK-L-19120, Response to Request for Additional Information Related to Seabrook Inverter Amendment

Response to Request for Additional Information Related to Seabrook Inverter Amendment

ML19305A301
Person / Time
Site:	Seabrook
Issue date:	10/30/2019
From:	Mccartney E NextEra Energy Seabrook
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
SBK-L-19120
Download: ML19305A301 (24)

Text

I

• NEXTera ENERGYe SEABROOK October 30, 2019 10 CFR 50.90 Docket No. 50-443 SBK-L-19120 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Seabrook Station Response to Request for Additional Information Related to Seabrook Inverter Amendment

References:

1. NextEra Energy Seabrook, LLC letter SBK-L-19104, "License Amendment Request 19-02, One-Time Change to the Seabrook Technical Specifications Onsite Power Distribution Requirements," October 3, 2019 (ML192768055).

2. NRG, "Request for Additional Information Related to Seabrook Inverter Amendment (L-2019-LLA-0216))," October 23, 2019 (ML192960912).

In Reference 1, NextEra Energy Seabrook, LLC (NextEra Energy Seabrook) submitted License Amendment Request 19-02, requesting a one-time change to Technical Specification (TS) 3.8.3.1, "Onsite Power Distribution - Operating."

In Reference 2, the NRG requested additional information to complete the review of the NextEra Energy Seabrook License Amendment Request 19-02.

Enclosure 1 provides NextEra Energy Seabrook's response to the NRC's Request for Additional Information (RAI).

This supplement does not alter the conclusion in Reference 1 that the change does not involve a significant hazards consideration pursuant to 10 CFR 50.92, and there are no significant environmental impacts associated with this change. A- /I b /

No new or revised commitments are included in this letter. tJte~

NextEra Energy Seabrook, LLC, P.O. Box 300, Lafayette Road, Seabrook, NH 03874

If you have any questions regarding this correspondence, please contact Mr. Ken Browne, Director of Nuclear Safety Assurance and Learning, at (603) 773-7932.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on October ~o , 2019.

Sincerely, NextEra Energy Seabrook, LLC

~~~

Site Director (VP) - Seabrook Nuclear Power Plant

Enclosures:

- Response to Request for Additional Information Regarding License Amendment Request 19-02 cc: NRC Region I Administrator NRC Project Manager NRC Senior Resident Inspector Director Homeland Security and Emergency Management New Hampshire Department of Safety Division of Homeland Security and Emergency Management Bureau of Emergency Management 33 Hazen Drive Concord, NH 03305 Katharine Cederbeg, Lead Nuclear Planner The Commonwealth of Massachusetts Emergency Management Agency 400 Worcester Road Framingham, MA 01702-5399

Enclosure 1 to SBK-L-19120 Response to Request for Additional Information Related to

• Seabrook Inverter Amendment

SBK-L-19120, Enclosure 1 Page 1 of21 APLC RAI 01-Tier 2 and Tier 3: AVOIDANCE OF RISK-SIGNIFICANT PLANT CONFIGURATIONS and the Configuration Risk Management Program {CRMP)

Regulatory Guide (RG) 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," identifies a three-tiered approach for the evaluation of the risk associated with a proposed Completion Time (CT) [or allowed outage time (AOT)] TS change.

The Tier 3 evaluation ensures the configuration risk management program (CRMP or maintenance rule) is adequate when maintenance is about to commence, whereas the Tier 2 evaluation is meant to be an early evaluation to identify and preclude potentially high-risk plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, are taken out of service simultaneously, or if other risk significant operational factors, such as concurrent system or equipment testing, are also involved. To distinguish between Tier 2 and Tier 3 reliance on the CRMP, and address Tier 2 in its entirety, address the following observations:

a. The table provided in Section 3.3 provides a list of risk-significant functions affected by the unavailability of EDE-l-1E. The licensee further states, "[p]rocedure OS1247.02, Loss of 120 V AC Vital Instrument Bus PP-1E or PP-1F, Revision 16, was reviewed to determine what potentially risk significant functions would be impacted by the loss of bus PP1 E," however the License Amendment Request (LAR) does not describe the process or criteria considered, in the review to identify the risk-significant functions included in the table. Qualitative review of an operational procedure to identify risk significant functions in lieu of a probabilistic risk analysis (P.RA) model does not appear to consider all the interfacing system functions or all potential plant configurations that could be impacted, rather just those procedurally addressed in OS1247.02.

Describe how the list of risk-significant functions/conditions considered in the PRA affected by the unavailability of EDE-1-1 E were initially identified (e.g., importance factors, etc.). Include the criteria used (e.g., Risk Achievement Worth (RAW) and Risk Reduction Worth (RRW) thresholds values, etc) to assess the risk significance. Include in the discussion, the process used to identify the testing or maintenance activities that could potentially cause a plant transient listed as compensatory action No. 1 in Section '

3.2 of the LAR.

b. The licensee provided six compensatory actions in Section 3.2. Section 3.0 of the LAR states that no specific contingency actions are required for each of the vital panel EDE-PP-1 E specified functions and Section 3.2.4 of the LAR further states, [p]otentially risk significant plant configurations will not occur during the proposed one-time AOT extension." Reliance on the CRMP is more appropriate for the Tier 3 evaluation, which ensures that adequate programs and procedures are in place for the identified risk-significant plant configurations and ensures that appropriate actions are taken to avoid such configurations. To address the Tier 2 evaluation in its entirety, provide the following:

i. Confirm/clarify for compensatory action No. 2 in Section 3.2 of the LAR that no testing or surveillances is intended to be performed on "alt inverters during the extended AOT. For the confirmation, include a list of each inverter that the compensatory action is intended to address.

SBK-L-19120, Enclosure 1 Page 2 of21 NextEra Energy Seabrook Response to RAl-01 APLC RAI 01.a:

The Seabrook PRA Model of Record (MOR) considers all the interfacing system functions and all potential plant configurations that can be impacted by the unavailability of inverter EDE-1-1 E.

However, the PRA MOR does not explicitly model inverter EDE-1-1 E. The model was modified to assure the evaluation correctly and fully portrays the consequence of the inverter unavailability. The following process was used to review and modify the model.

1. Inverter EDE-1-1 E is the normal and primary power source to this bus. The maintenance supply fed by 460V MCC E531 is the secondary source of power for this bus and will the primary and only source of power for bus PP1 E for the duration of inverter EDE-1-1 E unavailability. As such, the impact of the loss of its maintenance bus is the focus of the model review and modification.

2. Procedure OS1247.02, Loss of 120 V AC Vital Instrument Bus PP1E or PP1F, Revision 16, Attachment A, was reviewed to determine what equipment failures would result in the event of a loss of bus PP1 E; i.e., loss of the maintenance supply feed. Equipment failures and operator errors that could result in a loss of a mitigating function or that would result in an initiating event that could lead to core damage or large early release were considered in the review of the PRA model.

3. "ACTION/RESPONSE" and "RESPONSE NOT OBTAINED" sections of the procedure

. were reviewed to understand the detailed plant response, relevant actions, and supplementary procedures required for event mitigation. Operator actions were added or modified as necessary.

4. Logic was added to the model for SSCs and operator actions not in the original base model and that have an impact on core damage or large early release.

5. PP1 E will be powered solely by the maintenance bus. The components in the supply line to this bus were added to the model with their corresponding mean failure probabilities. These components included two breakers and one transformer in line between MCC E531 and bus PP1 E. This logic was specifically applied to capture the potential for a run failure of a diesel, given a successful start, that is due to failure of one of these components concurrent with a loss of offsite power and unavailability of EDE 1E. This sequence of failures results in overcooling of the diesel, which requires operators to declare the diesel inoperable if the operators do not succeed in manually controlling coolant temperature as described in Attachment B of procedure OS1247.2.

This failure mode is discussed in more detail later in this response. To provide model symmetry, similar logic was added for PP1 F/EDE-1-1 F for its respective breakers and transformer.

6. Sensitivities and demonstrably conservative values and assumptions were applied wherever there was uncertainty associated with an SSC failure or operator error impact on plant response.

a. Both containment Primary Component Cooling Water (PCCW) loops are isolated (on restoration of power) and loss of PCCW temperature control, causing PCCW flow control to fail to full cooling mode. Although unlikely, overcooling could lead to stresses that may fail the thermal barrier heat exchanger, which then leads to

SBK-L-19120, Enclosure 1 Page 3 of21 a small LOCA and potential failure of the ECCS. Engineering studies and plant operating experience indicate failure of the PCCW is very unlikely. Since the consequence of this event is potentially consequential, a sensitivity was performed by applying a demonstrably conservative screening value of 0.1 for the probability that this event would lead to stresses that may fail the thermal barrier of the heat exchanger and then lead to a small LOCA. In addition, a conservative sensitivity screening value of 0.1 was applied for manually control PCCW from the control room. For this sensitivity, the risk increased the total ICCDP to roughly BE-08, still significantly below the maximum acceptance criteria. This shows that the analysis has a significant risk margin, given the demonstrably conservative assumptions applied.

b. Overcooling of the diesel jacket coolant was assumed always to fail the diesel and no recovery was credited. Note that operators will likely take manual control of the jacket coolant control valve within 1O minutes, as described in Attachment B of procedure OS1247.2. Note that once started, the diesel jacket cooling water will rapidly heat up. This event is expected to be a long-term reliability issue versus a short-term failure concern, i.e., the initial overcooling event is not expected to fail the diesel during the 24-hour mission time. Therefore, this assumption is considered bounding. This event has a minor impact on CDF (less than a 1% increase) since the PRA model credits the Supplemental Emergency Power Supply (SEPS) diesel generators and, of course, the redundant emergency diesel generator.

c. Loss of capability to trip ED-l-2A DC supply breaker was assumed to result in the inability of operators to shed DC loads. This assumption is bounding since this event will not prevent shedding of other large DC loads. Given that the battery life and loading calculations are conservative, it is likely the objective of extending battery life to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> can still be achieved. This event has a minor impact on CDF (less than a 1% increase) since the redundant DC supply is not impacted.

d. Loss of Train A MSIV control was modeled as a failure to open ADVs. This fails long-term pressure injection with RCS depressurization. No operator actions were credited for manual control. This has a minor impact on CDF (less than a 1% increase).

e. As a sensitivity, the initiating event developed for. loss of power from the inverter and maintenance supply was linked to the model's loss of RCP seal initiating event. Although operations can take manual control of charging, no operator action was credited. This event has a minor impact on CDF (less than a 1%

increase) and is subsumed by the small LQCA sensitivity performed for breach of the TBC heat exchanger [refer to sub-bullet a]. .

With regards to the process used to identify the testing or maintenance activities that could potentially cause a plant transient, a risk review meeting is conducted for every work week to provide management team reviews and approval of risk classification and Risk Management Plans for high risk activities. Any testing or maintenance activities that could potentially cause a plant tra*nsient would be identified during this process and reschedule as necessary.

SBK-L-19120, Enclosure 1 Page 4 of21 APLC RAI 01.b:

No testing or surveillances will be performed on all vital inverters during the extended AOT. The following table lists the Vital Instrument Bus Inverters that compensatory action #2 is intended to address.

Vital Instrument Bus Inverter EDE-1-1A (EDE-1-1 E out of service)

EDE-l-1B EDE-1-1 F EDE-l-1C EDE-1-1D APLC RAI 02 - Closure of Facts and Observations (F&Os)

Section 3.3 of the LAR states, in part, "[i]n October 2017, all resolved findings were reviewed to Appendix X to NEI 05-04, 07-12, and NEI 12-13, "Close-Out of Facts and Observations (F&Os) as accepted by NRC in the staff memorandum dated May 3, 2017 (ML17079A427)." Provide the following information to clarify and confirm that the F&O closure review was performed consistent with accepted Appendix X guidance (Agencywide Document Access Management System (ADAMS) Accession No. ML16158A035).

a. Confirm that the closure review team was provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constitutes a PRA upgrade or maintenance update, as defined in AS ME/ANS RA-Sa-2009 and qualified by RG 1.200, Revision 2. If the written assessment and justification for the determination of each F&O was not performed and reviewed by the F&O closure review team, provide the list of all F&O's that were closed using the Appendix X process along with a disposition for each F&O that includes discussion of the impact to the requested AOT extension.

b. Confirm whether the F&O closure review scope included all finding-level F&Os, including those finding-level F&Os tha_t are associated with "Met" Supporting Requirements (SRs) at capability category (CC)-11. If not, identify and describe those "MET" findings that were excluded from the F&O closure review scope. For each identified finding-level F&O, provide the disposition and the impact of the F&O on the PRA as it pertains to the requested AOT extension.

NextEra Energy Seabrook Response to RAl-02

a. Closed findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os)

(Reference 1) as acc~pted by NRC in the staff memorandum dated May 3, 2017 (ML17079A427) (Reference 2). The documentation reviewed by the independent assessment team and the final report documenting the Appendix X review of resolved findings do not contain detailed evaluations documenting the bases for Maintenance

SBK-L-19120, Enclosure 1 Page 5 of21 Update determination for each finding. As such, the table below provides the closed findings, their resolution, and independent assessment for closure. Since all of the finding-level F&Os provided in the table below were assessed as closed by the independent assessment team, there is no impact to the requested AOT extension.

b. The scope of the F&O closure review included all finding-level F&Os; this includes met and not met findings from the early peer-reviews. All open F&Os and their impact were provided in the LAR submittal. All resolved finding-level F&Os, their resolution, and independent assessment for closure are provided in the table below. Since all of the finding-level F&Os provided in the table below were assessed as closed by the independent assessment team, there is no impact to the requested AOT extension.

References:

1. NEI Appendix X to Guidance 05-04, 07-12, and 12-13, Close-out of Facts and Observations (F&Os), February 2017

2. NRC Staff Memorandum, USNRC Staff Expectations for Industry Facts and Observations Independent Assessment Process, May 3, 2017 (ML17079A427)

SBK-L-19120, Enclosure 1 Page 6 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

F&O IE-ClO NIA The frequencies of initiators L2CCA and L2CCB are under Actions to Address Finding IE-2 estimated due to the common cause model. The common cause Changes were made to the CCF models in PCC and SWS initiators to use I year as the mission term should include T=l year (rather than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). time. This was included in the 1999 PRA Update to quantify initiators Loss of PCCW (LPCCA/LPCCB) and Loss of Service Water (LSWSA/LSWSB). The capturing ofrelevant combinations of events is done internally in the RISKMAN quantification of system IEs. The I year mission time is assigned to the basic events related to fail-to-operate over time and applied appropriately to one basic event in each cutset. Refer to SSPSS-2014 PRA documentation, Sections 10.3.5.4 (LPCCA/B) and 10.3.4.4 (LSWSA/8) for description of the CCFlmission time application. Also refer to RISKMAN model SB2014XI, systems initiating events, basic event equations for initiators LPCCA/B and LSWSA/8, which include mission time @YR, which is the local variable for 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> Acceptability Evaluation Document SSPSS-2014 was reviewed. Section 10.3.5.4 addresses the use of 1 year for the LPCC running pumps in the system initiator tree:

"The PCC initiator models change the equations of all time-based basic events (except the standby basic events, *. *SB) from @MT= 24 hrs to @YR= 8760 hrs. Thus, the normally operating components use the I yr mission time and their related cutsets are expanded as follows AB -->

A(l YR)B(24H) + A(24H)B(I YR)."

Section 10.3.4.4 addresses the use I year for the LSWS running pumps in the system initiator tree:

"SWS initiator models change the equations of all time-based basic events (except the basic events

• . *SB) from @MT= 24 hrs to @YR= 8760 hrs. Thus, the normally operating components use the I yr mission time and the expansion of cutsets AB --> A(I YR)B(24H) + A(24H)B(I YR)."

The other system initiator trees were reviewed (LRCPS and LOSPP) were reviewed and there is a statement that operating components used a mission time of I year. This F&O is considered to be closed.

F&O IE-Cl4 NIA The existing analyses for ISLOCA should be reviewed for Actions to Address Finding IE-6 consistency with a methodology for identification and Reviewed NUREGICR-5744 for ISLOCA methodology and revised the ISLOCA assessment in quantification of ISLOCA pathways such as that provided in the 2005 PRA Update. It is noted that the NUREG does not provide a "methodology" for NUREGICR-5744, and updated if appropriate. identification of pathways that differed from the Seabrook SSPSA analysis. No revision to ISLOCA analysis was necessary (ISLOCA pathways evaluated are consistent) however, the documentation of the ISLOCA assessment was improved. Refer to SSPSS-2014 Section 5.1.2.6 for a description of the ISLOCA initiating event model and Section 5.7 for ISLOCA sequence model description. Note also that SSPSS Section 14.3.1 provides an assessment of containment penetrations relative to containment isolation capability, which identifies the specific penetrations assessed for containment bypass including ISLOCA.

Acceptability Evaluation Document SSPSS-2014 section 5.1.2.6 and Table 14.3.1-1 were reviewed. The criteria used to screen the ISLOCA pathways is consistent with NUREGICR- 5744. For the identified pathways, Section 5.1.2.6 discusses the calculation ofISLOCAinitiator frequencies, including consideration of the state of knowledge correlation. This F&O is considered to be closed.

SBK-L-19120, Enclosure 1 Page 7 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC)

F&O DA-D5 NIA The values for BETA2, GAMMA2, and DELTA2 are not Actions to Address Finding DA-4 derived as recommended in NUREG/CR-5485 as stated in the The values for GAMMA2 and DELTA2 were recalculated using the correct equations. Also beta text. That document (p.76) recommends that "the values of a2, distributions were developed for these generic distributions.

a3, and a4 in Table 5 11 be reduced by a factor of2 when With regard to the comment that BETA! should be 5/105 rather than 0.05, these are essentially the applied to frequency of failure during operation." The effect of same number. Refer to SSPSS Section 13.2.4 Generic CCF Factors: NUREG/CR-5485 for reducing theses values (and adding the difference to *1) is to documentation of the MGL factors used in the systems analysis quantification.

reduce only the Beta factor - the gamma factors and delta Acceptability Evaluation factors are unchanged since the factor of onehalf factors out Document SSPSS-2014 section 13.2.4 was reviewed. The comment about the gamma and delta Contrary to this guidance, the MGL factors corresponding to factor being reduced by a factor of2 was addressed by the use of the correct equation. The correct the alpha factors in Table 5-11 were calculated, then the Beta equation cancels out the reduction and therefore the gamma and delta factors are not reduced. The factors were reduced by a factor of 2. Note these values were error of using 5/100 instead of5/105 was not addressed. This is an isolated item, the numerical used in the PCC system and initiating event analyses, resulting difference is small, and should not significantly affect the PRA results. As recommended in the in some factors being under-estimated by a factor of 4. The F&O, the BETA!, GAMMA!, and DELTA! factors were recalculated using a beta distribution.

discussion in 6.3.3 regarding variable BETA! is in error - 5 This F&O is considered to be closed.

CCFs and 100 independent failures provides a beta factor of 5/105 if staggered testing is used, not the .05 indicated. A lognormal distribution is not appropriate for the GAMMA!* and DELTA! - they should be modeled using beta distributions.

F&O DA-C15 NIA (1) The recovery model for the turbine driven EFW pump Actions to Address Finding DA-6 - includes factors for "fraction of failure that are non recoverable (1) Addressed in the 1999 PRA model update. Based on plant specific data for the TD-EFW pump, within 1 hr" and "probability of operator failing to recover the TD-EFW recovery credit is no longer modeled. Only three systems are modeled for repair of (recoverable failures) within 1 hr. The former is assigned a hardware faults: Switchyard (ROSP), EDGs (RDGLl), and PCC (RPCC). ROSP and RPCC are value of0.5 based on failure data from the original SSPSA. It modeled using generic data for repair/restoration. These repair models are documented in SSPSS does not appear that model has been updated in light of more Section 11. 7 .(2) Operator dependencies were examined, resulting in changes made to the logic recent plant data The latter is based on a detailed evaluation of rules and HEP quantification. - Included in 1999 PRA Update - operator dependence analysis was the time available for recovery actions given other operator addressed under F&O HR-7 (HR-G7) (MC#173, 165, 180 and 184) This was subject to 2005 commitments following Joss of all ac power. The HEP is focused peer review. Refer below to item 12, F&O HR-G7-1.(3) SSPSS Section 11. 7 .2 presents determined to be SE-03 (i.e. insignificant compared with the operator actions that are grouped as recovery actions. While most operator action analyses include fraction offailures that are non recoverable).(2) A potential some credit for recovery, these actions are distinct in that the focus is on equipment more than on concern with the operator error analysis is that it neglects to errors in human action. They are based on recoverability of components, where the human actions consider dependencies of this recovery action with other actions are included implicitly. Some also involve alternative hardware and actions outside the control included in the plant model. Particular dependencies of concern room. These actions are typically not proceduralized to the extent of the EOPs, if at all. Generally, are the initiation of feed and bleed and manually aligning the recovery actions are limited to scenarios in the plant model by event tree rules that specify when start up feed pump. (note: Appropriately, no credit has been they should be credited.(4) Component failure data and recovery has been updated periodically and taken for this recovery action following SGTR where demands remains current Refer above to Item 3 (DA-C15).

on operators may be greater than the loss of all power case Acceptability Evaluation modeled. Further, common cause failures are appropriately not Section 10.4.3.3 of the Tier 2 PRA documentation was checked to confirm that EFW recovery is recovered.)(3) Examine dependencies ofHEPs embedded no longer credited. Section 11.7 was also reviewed to confirm that for the at-power PRA, only within recovery models with other human actions included in recovery of OSP, EDGs and PCC are now considered and the approach used appears reasonable.

the plant model.(4) Examine most recent component failure Human action dependency analysis is performed, as documented in section 11.8. This F&O is data to ensure recoverable failure fraction remains valid. considered to be closed.

SBK-L-19120, Enclosure 1 Page 8 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Finding No. Category Description Disposition Requirement (CC)

F&O QU-B2 Met A discussion of the limitations ofusing the saved sequences as Actions to Address Finding QU-3 a PRA model of the plant was not located. Although a very low This issue of truncation has been addressed in the PRA documentation along with general guidance cutoff is used to generate saved sequences, it is important that for setting the truncation level. Refer to SSPSS Section 2.1.4 Truncation Evaluation for CDF, for all analysts understand where limitations may exist so that they an explanation of the truncation limitations.

can be evaluated for specific applications. Include a short Acceptability Evaluation discussion in the Tier 2 results or in the application that Section 2.1.4 of the Tier 2 PRA documentation presents the results of the truncation sensitivity

- study. Since BBD solution is used for the system-level analyses, truncation is not a concern. For discusses the saved sequence limitations.

the event sequence truncation, a detailed study was performed to ensure that a sufficiently low truncation value (lE-14) was used. This F&O is considered to be closed.

F&O AS-A7 NIA Following a reactor trip, loss of all DC, and success of offsite Actions to Address Finding QU-4 power, RCP seal integrity questions are asked without 1. In the 2002 model, the sequence "reactor trip -and- loss of all DC power" goes to MELT determining the probability of failure of the operating charging because EFW and SUFP require at least one train ofDC power. Also, the PORVs are failed given and PCCW pumps. Include hardware faults of the running loss of DC power. Thus, this sequence goes to MELT because both AFW and Feed & Bleed pumps as part of the necessary logic for RCP seal LOCA This cooling are unavailable (not the seal LOCA sequence).

appears to lead to overestimating reactor trip contribution to 2. While there is opportunity for recovery of an AFW pump (by locally starting either pump), the CDF.) probability ofloss of both DC buses is extremely small (3E-7). Also, this may cause other plant conditions that would confuse the operator. Thus, no operator recovery credit is taken.

Acceptability Evaluation Section 5.1.4.1 discusses losses of single DC buses as an initiating event and Table 5.1-2 notes that losses of the second DC bus is modeled as a top event in the loss of a single DC bus logic (i.e., a second bus fails following the initial bus failure leading to loss of all DC). The GDOC response states that a loss of all DC goes directly to core damage due to the failure of the EFW and SUFP and inability to perform feed and bleed cooling. So consideration of an RCP seal LOCA during this event is a moot point. From the overall sequence of events, one can infer this from the support

. system event trees and the TRANS event tree logic rules described in section 4 of the Tier 4 documentation. Random failure of the second DC bus is captured in the event tree analysis as stated in table 5.1-2. Loss of all DC power will result in core damage. These sequences are of very low frequency- LDCPA with DC-B failure is sequence #42 and LDCPB with failure of DC-A is sequence #43; each sequence contributes only 0.4% to the total transient" group CDF. These are perhaps less important sequences than others and do not necessarily warrant special description beyond the description of the loss of a single DC bus, which is described in the special initiator section. This F&O is considered to be closed.

F&O QU-E4 NIA At present no parametric uncertainty analysis exists based on Actions to Address Finding QU-9 the current plant model. While such studies were performed for An analysis has been performed to address model uncertainty, assumptions and sensitivities. As earlier versions of the SSPSA, the results have significantly part of this analysis, all event tree top event split fractions were quantified using Monte Carlo to changed (internals are far less dominant) and the uncertainty develop an uncertainty distribution. Also quantified the system initiating events with Monte Carlo.

distribution may no longer be valid. At present there is no These uncertainty distributions are updated periodically during the data update process. Quantified formal analysis which addresses plant specific uncertainty or uncertainty for dominant sequences for CDF and LERF. The model uncertainty analysis is sensitivity issues. For example, cases where thermal hydraulic documented in report: "Uncertainties, Assumptions, & Sensitivity Analysis" as part of the PRA analyses predict only small margins for success in terms of the Tier 3 documentation. This report documents a number of sensitivity cases that address key model number of trains required, or the time available for operator uncertainties and assumptions and addresses how the PRA model is affected by each uncertainty.

actions, are prime candidates. Other examples might be cases Uncertainties and key assumptions for internal flood events are addressed in SSPS Section where unique success criteria or modeling have been applied 12.1.10.4.

SBK-L-19120, Enclosure 1 Page 9 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC) such as for feed and bleed and for RWST make up following Acceptability Evaluation LOCA. Perform a set of sensitivity runs and a qualitative or Parametric uncertainty analyses were performed for both CDF and LERF, as summarized in quantitative uncertainty analysis for the model. Risk Section 2 of the Tier 2 PRA documentation. The "Uncertainties, Assumptions, and Sensitivity achievement analyses may be used to focus the search for Analysis" Tier 3 documentation provides an extensive evaluation of key assumptions and sources potentially significant cases. of modeling uncertainty. The assumptions and source ofuncertainty for the model as a whole was addressed. This F&O is considered to be closed.

F&O SY-A2 NIA During a review of plant design changes incorporated into the Actions to Address Finding MU-2 1999 PRA models, it appeared that Design Change Request A review of the PRA documentation (Service Water Notebook) indicated that this DCR had indeed (DCR)89-061 had not been incorporated into the service water been incorporated in the PRA model. In fact, the system notebook describes the modeling of the fault tree. This DCR deleted the cooling tower fan auto-start cooling tower and indicates that the operator must manually initiate CT operation and provides a feature. Therefore, a human error basic event was to be added justification for why this action is not modeled. The Service Water notebook was updated to ensure to the service water fault tree. The service water fault tree did completeness. Also, a review ofDCRs for the 1999 update was performed to ensure that all DCRs not appear to have been modified. Also, the PRA that impact the PRA model were addressed (1999 PRA Update). Refer to the Service Water documentation still includes the cooling tower fans being System Notebook, SSPSS Section 10.3.4.3(5), Operator Action Modeling.

actuated by a TA signal. It is believed that this is an isolated Acceptability Evaluation occurrence. However, the host utility should check for any Document SSPSS-2014 section 10.3.4.3 was reviewed. The auto-start of the cooling tower fans others. was remov:ed from the model. Section 10.3.4 (page 171), "item "(5) Operator Action Modeling" Incorporate this DCR into the system fault tree / notebook. describes the operator actions that are model to adequately reflect the SW system reliability. This section (on page 172) provides the following with regard to the action to start the cooling tower fans: "The operators also have to manually initiate cooling tower fan operation after a TA signal.

This action is not explicitly modeled, but is part of the long term success of the cooling tower. If the air temperature is below freezing, the operators must monitor the return flow temperature to avoid ice buildup in the tower tile. It is assumed that, once the operators diagnose that they need to actuate the cooling tower, they can perform this action highly reliably based on the simple nature of the early actions and the long term nature of the ice buildup concern."

The above provides the basis for the human action model. A judgment was made and documented that the action is highly reliable and thus was not explicitly modeled. Discussions with SBK staff confirmed that have hours to take this action and there wouldn't be any scenario in which cooling would be rapidly degraded if they didn't start the fans. There was no intention of building an

. explicit HEP basic event for this action. The human action required to operate the fans is, in fact, considered in the model as highly reliable, as documented in 10.3.4. Therefore, this F&O is considered to be closed.

SBK-L-19120, Enclosure 1 Page 10 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

F&O AS-A9 Met The ASME Category II capability for this SR requires the use Actions to Address Finding AS-A9-1 ofrealistic, applicable T/H analyses for accident sequence The 2005 update effort used MAAP to provide substantial additional plant-specific, realistic parameters. Category III requires use of realistic, plant specific support. In some cases such as the CST example noted, hand calculations were considered to be T/H analyses. Although most of the SSPSS parameters have appropriate and were reviewed to assure adequate realism. The actions below were taken to supporting calculations that are plant specific, it appears that address realistic/plant specific success criteria: Listed all current Level I success criteria, including some would benefit from more realistic analyses. In at least one impact of power uprate, RCPs, 1A, etc. Identified current basis fur success criteria. Ran series of case (i.e., CST depletion) more realistic analyses may impact MAAP runs where needed to provide basis. Refer to the SSPSS Section 5.2.5 Bases for Success sequence development (and are dependent on whether the EFW Criteria for the most recent summary of the MAAP cases. This section presents the plant-specific pump or SUFP is running). Expectation for future applications MAAP cases that support a number of success criteria. The more recent MAAP cases include is more extensive use of realistic codes (e.g., MAAP), as assessment of CST inventory depletion and the timing for refill actions, described in SSPSS applicable. Section 11.3.14 (action OCSTM).

. Acceptability Evaluation SSPSS Section 5.2.4 identifies the bases for the sequence success criteria and SSPS Section 5.2.5 provides the details of the MAAP runs cited in Section 5.2.4. MAAP cases are used to support all of the sequence success criteria for which MAAP can be used. SSPSS Section 11.3 .14 provides a MAAP case reference that is used to establish the time to CST depletion. These actions address the general concern that some SSPSS parameters would benefit from more realistic analyses as well as the specific concern identified regarding the use of hand calculations to estimate CST depletion timing. This resolution addresses the concern of the F&O.

F&O HR-G4 Met In general, the time available to complete actions is based on Actions to Address Finding HR-G4-1 either generic T/H analyses for similar Westinghouse 4-loop Revised the HR.A Calculator quantification using time windows from Seabrook Station-specific plants or plant-specific analyses. Several issues were identified MAAP runs. The time windows are based on the success criteria analysis using a number of that may point to the need for establishing a more thorough and MAAP runs documented in SSPSS Section 5.2.5 or on hand calculations documented in SSPSS realistic basis. For example: The write-up for the operator Section 16. The at-power HR.A is documented in SSPSS Section 11.0. The basis for the time action ODEPl for SBO events states that 8.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> are available is documented for each human action. For example, the time window for sump recirc available to perform this action, which is based on 9 .8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to actions (see Section 11.3.5) is based on calculations in Section 16.1.5. The timing of the cue is core damage from WCAP-16141, less one hour to restore factored into the HR.A through the delay time, as required for each action. For example, Feed &

equipment. However, WCAP-16141 states that without Bleed action (Section 11.3.8) includes a delay of-28 min to account for the time to boil off to the depressurization, core damage can occur as early as 2. 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. SG level cue for a general transient and a delay of -8 min for a LMFW transient.

Therefore, the time available to perform this action should not Acceptability Evaluation exceed the time to core damage without credit for the action. It Document SSPSS-2014 section 11.3.8 was reviewed. Review of the F&O resolution indicated that should be noted that WCAP-16141 does not specifically time windows used in the HR.A that had been based on generic T/H analyses for similar mention when depressurization must begin, but it seems to be Westinghouse plants had been revised to be based on plant-specific MAAP runs. The specific assumed that depressurization will typically begin within 30 - HEPs identified in the Description of Finding were reviewed and were confirmed to now be based 45 minutes. Since this action has a low F-V and RAW on plant-specific MAAP analyses. Additional spot checks confirmed that many additional HEPs importance, SRHR-G4 is judged to be satisfied. WCAP-16141, also had time windows based on plant-specific MAAP runs. This resolution addresses the concern which is used as a basis, assumes that the turbine-driven AFW oftheF&O.

pump supplies 1145 gpm, which seems to exceed the capacity of the Seabrook Station TD AFWP. The basis of the time available for operator action ODEP3 does not appear to be realistic. SSPSS-2004 credits post-LOCA cooldown and depressurization for MLOCA with high head injection (HHI) success.

SBK-L-19120, Enclosure 1 Page 11 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC)

Operator Action timing (3.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) is based on a small LOCA, not MLOCA The success criteria indicates that only 42.8 minutes are available before reaching low-low level for MLOCA. While it is true that MLOCAs at the high end of the spectrum should not require this action and MLOCAs on the low end of the spectrum behave more like a small LOCA, the majority ofMLOCAs will be in between. Using the average timing between the high end (42.8 minutes) and low end (3.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) would not leave enough time to successfully establish low pressure recirculation prior to reaching the RWST low-low level switchover set point. The time assumed to be available for feed and bleed using the Safety Injection (SI) pumps, which is based on the time until SG dryout, may not be realistic. It would seem that establishing feed and bleed with the charging pumps would have different timing than establishing feed and bleed with the SI pumps due to the lower shutoff head of the SI pumps. In particular, while waiting until SG dryout could allow successful feed and bleed cooling using the charging pumps, it isn't clear that waiting until SG dryout would allow successful feed and bleed cooling using the SI pumps.

The time available for operator action HH.ORSGC2.FL is 2.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which is based on time to core damage. However, restoring secondary cooling at the time of core damage will not prevent core damage. In order to prevent core damage, secondary cooling must be completed earlier (e.g., core uncovery). With respect to the items identified: Reevaluate the time available to perform RCS cooldown and depressurization following an SBO. Also evaluate the applicability ofWCAP-14161 assumptions regarding flow from the turbine-driven AFW pump. Re-evaluate the time available used to quantify operator actions for depressurization and feed and bleed by performing sequence-specific MAAP (or other) thermal-hydraulic runs.

In the case of operator action to perform depressurization for MLOCA sequences, T/H runs may need to be performed for an "average" MLOCA break size. Use MAAP or some other calculations to determine the latest time at which secondary cooling can be restored and still prevent core damage. More generally, complete the ongoing effort to establish appropriate timeframes using realistic codes (e.g. MAAP).

SBK-L-19120, Enclosure 1 Page 12 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

F&O HR-G7 Met Dependency between multiple human actions was considered, Actions to Address Finding HR-G7-1 and the process for quantifying dependencies is described in - The following actions were taken to address the F&0:1. Identified all dynamic actions embedded in hardware top events. 2. Created new Operator Action top events, separate from hardware where SSPSS-2002. This appears to be a good approach. However, there is no guidance as to how to identify sequences with appropriate. 3. For PCCW, redefined System split fractions to be conditional on Operator Action multiple operator actions for inclusion in the dependency OPCC and added house events. 4. Added new top events to event trees 5. Modified logic rules to analysis. Also, while the matrix showing dependency between account for operator action dependency to system. A detailed dependency analysis was conducted two operator actions is good, it does not include new actions of all operator actions that may appear in the same accident sequence group. This accounts for time since the 2002 update. The review discovered at least two resources as well as other cognitive-related factors impacting one HFE on another. This analysis is examples where dependencies appear to be inadequately documented in SSPSS Section 11.8. In addition, the dependency analysis process is documented in addressed: (1) The dependency between operator actions instruction PRA-106, Section E.4.

ORSGC and OFB does not appear to be modeled, other than The HEP dependency analysis was originally developed in response to Findings MC#l 73 &

time consumed associated with responding to feed and bleed MC#l 84 (PR-1999). The analysis was expanded in Section 11.8 in response to Finding MC#538 criteria There is also some dependency in diagnosing the loss (P~-2005).

of secondary heat sink for these two actions. (2) The procedural Acceptability Evaluation guidance in Functional Restoration Procedure FR-H.1 for DocumentSSPSS-2014 Section 11.7.2 was reviewed. The dependency analysis is discussed in aligning fire water is contained in the RNO column of Step 14, detail in section 11.8. The methodology and the analysis are reasonable. The combination of more which is predicated on not being able to open the PORVs. than two operator actions per scenario is discussed and the methodology for analyzing the However, if the PORVs are opened too late, the procedure will dependency is discussed. RISKMAN rules are used to capture dependencies as necessary. This not direct the operator to establish fire water to the SGs. This section satisfies the F&O and the SR. This F&O is considered closed.

dependency is not modeled. Although significant progress has been made in this area since the 1999 peer review, it appears that there remains a need to develop an overall process for identifying multiple operator actions that need to be addressed in the deoendency analvsis.

F&O IFQU-A7 Not Met Appendix 12. lH describes assumptions and uncertainties. Actions to Address Finding 4-6 However, the level of detail with respect to sequence reviews IF analysis sequence review and results review were performed collectively, in an integrated and results, including integration are not judged to be of fashion with all Level 1 results. No issues were identified with IF sequences. IF dominating sufficient detail (e.g., QU-A3, Dl, D5, D6, D7, E3). Integration sequences are described in SSPSS Section 12.1.10 and are reasonable and as expected for the into internal event QU notebook will resolve some of this. model inputs. It is noted that the initial review of sequences identified the potential need to reduce Possible Resolution: Review the analysis results and identify flooding risk in the Control Building. This led to the proposed modification to install the flow additional risk insights or areas for enhancement. reducing orifice in the FP piping upstream of the CB.

Acceptability Evaluation The internal flooding results are discussed as part of the overall Level 1 results in section 2.2.3 of the Tier 2 PRA documentation. As part of that integrated documentation, most of the various QU requirements are addressed (e.g., truncation sensitivity, significant and non-significant cutset/sequence reviews, important basic events, etc.) The specific flooding results are also separately discussed in Section 12 and in Appendix 12. lK. The flooding results spreadsheets in Appendix 12.lK include important flood initiators, doors, human errors, etc. The combined documentation in these sections address the QU SRs that were specifically noted in the F&O. See also F&O 4-7. This F&O is considered to be closed.

SBK-L-19120, Enclosure 1 Page 13 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC)

F&O IFQU-B3 Not Met The completeness of assumptions and sources of uncertainty in Actions to Address Finding 4-9 the pipe failure data (e.g., error factor, applicability of data), A check of the data and assumptions used in the internal flooding study was performed for failure probability of doors, generic data and modeling choices reasonableness and for identification of additional uncertainties. Appendix 12.lH, Uncertainties needs to be reviewed against other industry studies. Possible was revised to clarify/ensure areas of uncertainty and important assumptions are adequately Resolution: Review all the inputs to quantification and identify captured and characterized. Refer to SSPSS Section 12.1.10.4 for the latest flood analysis list of additional assumptions to ensure all sources of uncertainties and uncertainty and assumptions.

assumptions are included. Acceptability Evaluation Additional uncertainties and assumptions were identified and documented in Section 12.1.10.4 of the SSPSS 2014 Update (specifically Table 12.1.10-4) and Appendix 12.lH. The Tier 3 PRA documentation provides a review of sources of uncertainties and key assumptions in each of the internal flooding technical areas. The evaluation in this appendix addresses the issues noted in the F&O. This F&O is considered to be closed.

F&O IFSO-B3 CCIII Appendix 12.lH acknowledges uncertainty in break flow rate. Actions to Address Finding 5-2 Need to expand uncertainty review to discuss other source Tier 3 Appendix 12. lH identifies assumptions and uncertainties. No major uncertainties or related uncertainties such as maintenance-induced events and assumptions were associated with identification of sources. Other assumptions and uncertainties are potential, if any, source pressure or temperature impacts. -Also, associated with assumed flow rates (e.g., tendency to assume highest flow rate) and completeness discuss potential for breaks or human induced events greater of human induced events (lack of data). To specifically address the CW flood rate, a sensitivity than assigned (i.e., catastrophic CW expansion joint failure evaluation was performed to conservatively determine the risk significance of a postulated could far exceed 56,000 gpm). Potential for larger floods can maximum CW flood event. The maximum CW break flow was estimated at approximately 300,000 represent key insights. Specifically, CW flood rates greater than gpm. A door failure evaluation was performed to estimate the capacity of the various door 56,000 gpm could represent a more significant threat to the configurations at Seabrook. Doors Cl02, ClOl and ClOO provide an interface between the TB and Essential Switchgear rooms due to the configuration at ESWGR-A. The door evaluation indicates that the capacity of these types of doors loaded against Seabrook. Possible Resolution: A small enhancement to the the jam/frame is in excess of any credible flood height in the TB. In addition, other doors in the uncertainty notebook should identify the potential for CW flood Turbine Building are expected to fail at considerably less water height- approximately 10 feet (or rates higher than 56,000 gpm. Combined with any uncertainty less) and there is an unlatched door on the east side near condensate polishing that opens out. The in the capacity of Door Cl 02, this can be a major insight benefit of this door was not credited. Once a flood height of -10 ft or less is achieved, failure of regarding overall plant risk. these other doors (which includes the rollup doors, glass sliding door, misc. double doors) is expected to vent the flood water to outdoors and result in a steady-state water level in the TB of -4 feet. It is noted that this TB flooding scenario is likely to cause a loss of offsite power or fail non-essential electrical buses, resulting in a trip of the flooding source - the CW pumps long before there is propagation impact in the essential switchgear rooms. Based on the above, a conservative flood scenario was developed as sensitivity case FOTCWS. Based on this sensitivity case, the CDP from a postulated maximum CW break event in the TB is approximately lE-09/yr. This scenario is screened from further detailed evaluation using criterion QN4a - Specific flood source in a flood area with CDP <-l~-9 per yr based on flood-initiated accident sequences from a specific flood source in the flood area This assessment is conservative. Realistic modeling would eliminate conservatisms and further reduce the impacts. The max CW flooding sensitivity case is documented in Tier 3 IF Appendix 12.lF Section 19.

Acceptability Evaluation Appendix 12.lH discusses the sources of uncertainty. The F&O specifically concerns possible worst-case CW flood scenarios with subsequent door failures that allow water to flow into vital areas. Based on additional evaluations, the PRA still notes that there are no specific sources of uncertainty pertaining for flood areas and sources. However, human-induced flooding is noted as a

SBK-L-19120, Enclosure 1 Page 14 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC) source ofuncertainty separately in Table 12.1.10.1. To support the conclusion that a worst case CW break is not a significant contributor, an additional sensitivity case was developed for this CW pipe break. Structural evaluations for the key doors were also performed to show that these door would not fail during a CW flood event. Beneficial failures in the turbine building were neglected, other than crediting a 90% likelihood of a LOSP occurring (which would trip the CW pumps to end the flood event). The results of the sensitivity case demonstrate that the worst-case CW break can be screened on the basis of very low probability. On the basis of the sensitivity study and the fact that significant source of uncertainty are not generally associated with PRA technical areas IFPP and IFSO, this F&O is considered to be closed.

F&O IFSN-A2 CCIII The assessment indicates that there are some "rugged" doors Actions to Address Finding 5-3 capable of withstanding a water-height of 6-7 feet. These were A structural evaluation of typical doors at Seabrook Station was performed and documented in a walked-down for the peer review and they are indeed rugged in calculation, "Structural Evaluation of Door Capacity Under Flooding Loading Conditions". The appearance. However, there is limited basis for door capacity evaluation was performed for 3 typical" -type doors including: (1) rugged security door, (2) other than "Industry Sources" which include a PWR OG email. industrial 3-hour rated fire door, and (3) double-wide industrial door with and without a center Uie EPRI Flood Guideline says the following: If there are doors locking pin. The evaluation addressed the difference in potential failure when each type of door is within the boundaries of the area then the following guidance loaded against its frame/jamb (stronger door configuration) verses being loaded against its latch can be applied: Water tight doors should be considered as and hinges (weaker door configuration). It is noted that the door frames at Seabrook are embedded failing only through human actions. If the door is alarmed its into the adjacent concrete and are not supported by installed anchor bolts. This represents a much failure probability can be considered to be zero. If the door is stronger configuration than a conventionally installed frame with anchor bolts. Door not alarmed then assume the normal egress failure condition of a capacity/failure insights from the structural evaluation are included in IF Tier 3 Appendix 12. lA, door opening out of the flood area if the water tight door opens Methodology. Door failures and the resultant propagation are assessed on an individual out of the area. If the water tight door opens into the area then door/scenario basis. If the scenario's floodwater height does not exceed the door's capacity, the consider the failure probability to be zero. Normal egress and door is not expected to fail, is assumed to remain intact with only gap leakage contributing to fire doors should be considered failed after 3 foot of flood level propagation. On the contrary, if the scenario's floodwater height exceeds the door capacity, door if the door opens into the area. Normal egress and fire doors failure is assumed and the resulting propagation is via the failed (open) door. No credit is given for should be considered failed after I foot of flood level if the door failure of a barrier to limit the flood consequence without some assessment of the door failure opens out of the flood area. The I and 3 foot EPRI Guideline potential.

should be used unless a higher value can be justified. While the Acceptability Evaluation doors are clearly rugged, some more detailed justification IF Tier 3 Appendix 12.lA section 5.1, Door Failures, was reviewed. This section references a should be presented. Possible Resolution: The plant has design structural evaluation, Calculation C-S-1-100146, Structural Evaluation of Door Capacity under information for HELB doors which are rated for 6 psid (13 feet Flooding Loading Conditions, Revision 0. This calculation satisfies the F&O and provides of water). Perhaps a comparison between these doors and the justification for the door heights used in the flooding analysis. This F &O is considered to be "rugged" doors could demonstrate equivalency. Alternately, closed.

there may be some engineering inputs that could better quantify and justify "ruggedness".

SBK-L-19120, Enclosure 1 Page 15 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

F&O IFSN-A9 CCIII Flood calculations are available in spreadsheets Jinked to the Actions to Address Finding 5-5 master summary for each area However, these are dynamic and Internal flooding F&O 5-5 (IFSN-A9) identified a potential documentation issue and there were no direct identification of key parameters can be difficult. For discrepancies in the assumed flooding flow rates used to develop the associated scenarios. The example, a key time for TB flood response is 11 minutes. In the proper internal flooding flow rates estimated for the various flood sources in the plant, including spreadsheet related to this parameter (Turbine Buidling.xls) the the Turbine Building, are used in the development of the associated flooding scenarios. A snapshot flow rate was set to 15000 gpm versus the defined source value of spreadsheet calculations has not been provided. However, all spreadsheets have been cleaned up of 56,000 gpm. Therefore, the 11 minute time estimate was not and all superfluous spreadsheets and information have been eliminated.

depicted by the spreadsheet. In addition, some spreadsheet Spreadsheets are also referenced in the text and master tables to improve retrieveability. Refer to worksheets and tables are not used in the analysis and have IF Tier 3 Appendix 12. lF for IF scenario descriptions and referenced spreadsheets used to confusing negative signs. This is all an unnecessary distraction calculate flooding flow rates and propagation rates.

in an already complicated analysis. Tractability between the Acceptability Evaluation flood area definition and HRA is required to justify the As noted in the GDOC, a review of all of the flood documentation and calculations was performed analysis. to remove extraneous information and to ensure that all values shown in the reports and the supporting tables and spreadsheets are consistent. References to the supporting documentation were added to the Appendix 12. lF report. In addition, to support future updating, data that is likely to change (e.g., flooding initiating event frequencies) are highlighted in red. Spot checks of data in various places did not identify any inconsistencies. This F&O is considered to be closed.

F&O IFPP-A2 CCI Specific rooms are discussed in the detailed analysis but there Actions to Address Finding 5-9 appears to be no specific definition at the room (or combined A new table is developed to define the Seabrook flood areas within the various buildings. The new room level). There is no definition of what specifically table "Flood Area Definition" is contained in IF Tier 3 Appendix 12.lB and is discussed in Section constitutes a flood area other than the Building Level 3.0 of Appendix 12. lA, Internal Flooding Methodology. The flood areas are defined using the fire definitions presented in Appendix 12. lB Summary Table. areas/rooms identified on the Seabrook Pre-Fire Strategy drawings.

Room level definition is left to be inferred based on discussions Acceptability Evaluation within the detailed analysis. Possible Resolution: Provide a Section 3.0 of Tier 3 IF Appendix 12.lA was added and Tablel2.1B (in spreadsheet format) was table, or equivalent, that provides a link between the High Level developed that identifies the rooms/areas that are grouped to define flood areas for each building.

Areas discussed in Table 12.lB and the detailed discussion of This table also includes propagation paths associated with each defined flood area. This F &O is individual rooms in Appendix 12.lF. This could focus on the considered to be closed.

Fire Zone identifiers, which is a common approach for this issue at other plants, or could involve some other defined grouping.

F&O IFSO-A4, Not Met Limited evidence of review of potential for maintenance or Actions to Address Finding 5-13 IFSN-Al2 operationally induced flooding events. Review of potential for IF Tier 3 Appendix 12.lA, Section 4 Flood Mechanisms and Maintenance-Induced Flood Events maintenance induced floods is a specific requirement. documents the review of maintenance-induced flooding events. A review of the potential for maintenance-induced flooding events is performed for the major flood source systems. These systems included: CW, SW, FP and PCCW. The potential for maintenance-induced flood events from other sources, for example DW, PW, RW are judged to be less limiting because of their lower flooding flow rates. Development of maintenance-induced flooding events included performing a review of industry and plant-specific flood OE, performing a general survey of all Seabrook Work Orders (WO) performed on these systems between 1990 and 2009 to identify any potential flood related maintenance events, an assessment of water hammer potential, and a discussion with the respective system engineer. Based on the overall review performed, maintenance-induced actuation of fire protection deluge systems (inadvertent FP actuation) in the CSR, DG Fuel Tank

SBK-L-19120, Enclosure 1 Page 16 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

Rooms and TB is specifically accounted for in the flooding risk assessment. Other maintenance activities including water hammer phenomena are judged not to have a significant potential to initiate flooding events; their likelihood to cause a flooding event is very low and judged to be adequately accounted for in the random flood initiating event frequencies.

Acceptability Evaluation in A detailed discussion of the maintenance-induced flood events is provided Section 4 of Tier 3 IF

• Appendix* 12.lA. This discussion bins flood events into a number of categories (tank overfill events, flow diversion events, inadvertent FP actuation events, etc.) and evaluates each category's impact at Seabrook. Section 4 also identifies a number of systems (CW, SW, FP and PCC systems) that are considered major flood sources and evaluates each one to qualitatively determine if it is a candidate for inclusion in the model as maintenance-induced flooding event. Ultimately it was judged that the only maintenance-induced flooding event applicable to Seabrook is inadvertent fire protection deluge system during testing/maintenance. No other maintenance-induced flooding events were expected to be significant contributors to risk at Seabrook. This F &O is considered to be closed.

F&O IFSO-AS ccm Basis for flow rates is not specified (e.g., Page 31, Appendix Actions to Address Finding 5-14 12.lF, says 24" SW discharge pipe is -12,000gpm. No apparent Additional flow calculations were performed to improve the basis for the selected scenario-specific basis for the 12,000gpm value is presented. The assignment of break flow rates. Application of these flooding flow rates is described in IF Tier 3 Appendix break flow rates is a key analysis input and specific, traceable 12. lA, Section 3.0, Scope, and is summarized here. SW Maximum Break Flow Rate: Maximum basis for the values is required. Values reviewed seem SW pipe break flow rates were developed by specific calculations using the plant's SW flow model

- reasonable but slightly more than just a documentation issue in and ProtoFlow software. Specific SW calculations were performed for scenario development in the that basis is not specified. PAB, TB and yard. Maximum SW break flow rates at other locations (SWPH and CT) are based on inspection of the SW break calculations performed for PAB and discussion with the SW system design engineer. Other System Flood Scenario Maximum Break Flow Rate: The flood source maximum break flow rates used in this analysis for other systems (primarily for FP, CW, DM, PW and tank gravity drain) are based on either: (1) a specific break flow spreadsheet calculation based on actual/conservative system characteristics using flow equations/methodology in Crane Technical Paper 410 or, (2) the maximum break flow rate for the specific pipe size and pressure conditions as suggested in the Appendix C of the EPRI methodology. The maximum break flood scenarios developed in the master tables identify the scenario's maximum estimated break flow and its source reference (either specific spreadsheet calculation or EPRI). Flood Scenario Flow Rates Other Than Maximum: The flood source flow rates for scenarios other than maximum are based on the EPRI methodology for categorizing spray, large and major flood events depending on the flood source capacity. Spray-type events are assumed to be in the flow range ofO to-lOOgpm; large flood events are in the flow range of 100 to -2000gpm and major flood events are in the range of2000gpm to the maximum capacity. The flow rates used in the scenarios (other than the maximum flow rate) are also identified in the master tables with its EPRI source reference. It is noted that although a flow range is specified, the timing for each scenario (time to equipment damage, time for operator mitigative actions, etc) is conservatively based on the upper bound of each flow rate range.

Acceptability Evaluation Additional flow calculations were performed using the plant's SW flow model and ProtoF!ow software as discussed in Section 3 of Tier 3 IF Appendix 12.lA Items (c) and (d). Item (e)

SBK-L-19120, Enclosure 1 Page 17 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC) specifies the maximum break flow rates and where the values were obtained from. The flow rates and their associated references are now documented in the Master Tables for the various flood areas as described in Section 3 of Tier 3 IF Appendix 12. lA. This F&O is considered to be closed.

F&O AFSO-A5 CCIII Some additional, clarifying discussion would be beneficial Actions to Address Finding 5-16 within the master table. Consider the following example and The timing basis for highly reliable operator actions was reviewed, and each is consistent with the address this and similar cases appropriately. Item 6 in the screening criteria. Refer to IF Tier 3 Appendix 12. lF (Scenario Detailed Screening) and Appendix Control Building master table addresses Initiator FlCFPS. The 12. lD (HRA). The scenario screening description includes the timing basis for all operator actions master table indicates that propagation to ESWGRB (correct to including those credited as highly reliable actions. It is noted that the IF flooding documentation be ESWGRA) is screened based on highly reliable mitigation. was reviewed and revised as needed to clarify the scenarios and timing for operator actions. In A separate column provides a time window of 145 minutes. The addition, many scenarios in the Control Building were revisecllreplaced due to the installation of reviewer infers from this that mitigation is highly reliable for the FP flow reducing orifice, which was a PRA-identified plant enhancement to reduce internal this case because a long time is available for operator action flood risk. Because of this revision, initiator FlCFPS (mentioned by the reviewer) no longer exists.

(i.e., > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). However, this is not clearly stated. Clearly Acceptability Evaluation identifying not only the screening criteria but specific attributes A detailed evaluation of"highly reliable actions" is provided in section 6.1 of Appendix 12.l.D of that allow criteria to be met provides the most comprehensive the PRA. The scenario screening description includes the timing basis for all operator actions and reviewable screening summary. including those credited as highly reliable actions. As noted in the GDOC response, the master flooding scenario tables for each flood area were also updated and revised to provide additional clarification of timing, where needed, to show the basis for screening various scenarios. Inspection of Section 6.1 of the HRA document (Tier 3 IF Appendix 12.lD) verified that the attributes comprising highly reliable actions (cue location, cue clarity, procedure clarity, complexity, stress, time, etc.) are clearly documented for various flood sizes. This F&O is considered to be closed.

F&O LE-C3 CCI No credit for repair was taken in the analysis other than Actions to Address Finding LE-C3-01 recovery of AC power. There was no review of the accident Finding'LE-C3-0l addresses the lack of documentation regarding the review of LERF accident progression sequences for opportunities to credit equipment progression sequences for possible credit of equipment repair/recovery (beyond AC power repair. recovery). This involved attempting to provide a realistic assessment of accident sequences that end as LERF by appropriately crediting equipment recovery in the Level 2 model. The resolution to this issue is documentation only, with no change to the LERF model. The MCDB provides the formal documentation. All LERF initiators and associated significant accident progression sequences were reviewed for possible additional credit of equipment repair/recovery that could be applied during the accident progression or after containment failure to further reduce the LERF contribution. This review concluded that no additional equipment repair/recovery should be credited/justified in the LERF model. This conclusion applies to both significant and non-significant accident progression sequences. It is noted that non-significant sequences contribute minimally to LERF and therefore are less important when considering possible realistic/conservative measures to yet further reduce their already low LERF contribution. Refer to MCDB #880 for the detailed description of this resolution.

Acceptability Evaluation MCDB #880 documents a review of the possibility ofrepair actions that could mitigate LERF for all significant contributors to LERF. The review concludes that no additional repair actions are practical for the significant contributors to LERF. This conclusion is based on considerations of

SBK-L-19120, Enclosure 1 Page 18 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC) typical timing for the scenarios, the nature of the failures leading to the scenarios. The review is thorough and reasonable. This resolution addresses the concern of the F&O. To the extent that the MCDB is considered part of the PRA model documentation, this resolution meets CC II/III of the SR. This F&O is considered to be closed F&O LE-CS CCI The only relevant system looked at for this SR was AFW (for Actions to Address Finding LE-CS-01 SGTR scrubbing). No basis for the AFW success criteria, as All "small-early" and "large-late" release bins were reviewed to identify if success of a particular documented in the SSPSS, Sectionl0.4.3.3, is given. It is system (for example EFW) is credited in the Level 2 analysis, which then allows binning of the assumed that these success criteria are based on design sequences as "small" instead of "large" or "late" instead of "early". Such system credit can be calculations, not realistic analyses. thought of as being significant to defining LERF/non-LERF sequences. Of all the release category bins, only bin SEl - "Small Early Containment Bypass - SG1R with Scrubbed Release" credits a specific system (EFW) for release reduction (scrubbing). S;El sequences are SG1R sequences that credit use of the EFW system to maintain/re-establish SG water lev,el in the faulted SG thus scrubbing (reducing) the release. SE-1 sequences are summarized below along with a realistic EFW "Level 2" success criterion. It is noted that SE2 (Interfacing LOCA) also credits scrubbing for release reduction. However, SE2 scenarios include success ofLevel 1 injection ofHPI until the RWST inventory is depleted. Break flow/HP! causes flooding/submergence of the break (RHR pump seal) located in the lower elevation of the RHR vault. There are no specific systems credited in Level 2 for achieving the flood conditions needed for scrubbing/release reduction. There are no other systems specifically credited in the remaining "small" or "late" release bins that require established Level 2 success criteria. Sequences in these small and late bins are there because of the Level I plant damage state and/or containment response. SEl - Small Early Containment Bypass -

SG1R with Scrubbed Release The Level 2 PRA evaluates fission product scrubbing for SG tube rupture events that lead to core damage if water inventory can be maintained/re-established in the faulted SG. With successful SG inventory and scrubbing, the sequence release is a "small" early release (MAAP case #103k). The small-early Level 2 sequences depend on success ofEFW/SUFP.

SAMG guidance in SAG-1 and SAG-5 provide the TSC and plant operators with guidance for restoring SG level (SAG-1) and reducing fission product release (SAG-5) post core damage. SAG-1 guidance considers assessment and alignment (if necessary) of many system options to restore SG inventory including the use ofEFW or SUFP pumps. The Level 2 EFW/SUFP success criteria for restoring SG level after core damage are the same as Level I sequences. That is, either one of the EFW pumps or the SUFP is capable to provide the required flow to restore level in the effected SG. This is consistent with SAG-1 guidance. This has been documented/summarized in SSPSS Section 10.4.3.3 (4).

Acceptability Evaluation SSPSS Section 10.4.3.3 describes the Level 2 / LERF success criteria for long-term SG inventory maintenance by restoration ofEFW/SUFP following core damage. Success of this function during SG1R sequences allows the sequence outcome to be characterized as a small release due to the radionuclide scrubbing obtained by the overlying water pool in the SGs. "Section 14.6 Source Term Worksheet.xis" provides confirmatory details about the source term magnitudes, which are based on MAAP run #103k. The systems analysis write-up and spreadsheet documenting MAAP runs and predicted source terms represent a realistic, plant-specific Level 2 / LERF success criterion for EFW/SUFP. MCDB #881 also orovides additional information concerning whv other

SBK-L-19120, Enclosure 1 Page 19 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC) systems are not explicitly credited in the Level 2 accident sequences. This resolution addresses the

.. concern of the F&O. This F&O is considered to be closed.

F&O LE-CIO, LE- CCI LE-CIO and Cl2 Category II/III require the REVIEW of Actions to Address Finding LE-CIO- Cl2 significant accident progression sequences to determine Finding LE-CI0-01 address the lack of documentation regarding the possibility of crediting 01 whether there is a possibility of continued equipment operation continued equipment operation or operator actions in adverse environments of post containment or operator actions in adverse environments of post containment failure. This involves attempting to provide a realistic assessment of accident sequences that end as failure. No documentation was found to address this LERF by appropriately crediting systems and actions in the Level 2 model. The resolution to this requirement and it is acknowledged that meeting Category I is issue is documentation only, with no change to the LERF model. All LERF initiators and conservative. associated significant accident progression sequences were reviewed for possible additional credit of equipment or operator actions that could be applied during the accident progression or after containment failure to further reduce the LERF contribution. This review concluded that no additional equipment or operator actions should be credited/justified in the LERF model. This conclusion applies to both significant and non-significant accident progression sequences. It is noted that non-significant sequences contribute minimally to LERF and therefore are less important when considering possible realistic/conservative measures to yet further reduce their already low LERF contribution. Refer to MCDB #883 for the detailed description of this resolution.

Acceptability Evaluation MCDB #883 documents a review of the possibility of equipment use and/or operator actions that could be taken after adverse conditions or containment failure have occurred to mitigate LERF for all significant contributors to LERF. The review identifies possible operator actions that could reduce LERF for the sequences of interest. The evaluation of the feasibility of these possible operator action is generally qualitative in nature and concludes that no additional operator actions are practical for the significant contributors to LERF. The review is thorough and reasonable. This resolution addresses the concern of the F&O. To the extent that the MCDB is considered part of the PRA model documentation, this resolution meets CC II/III of the SR, This F&O is considered to be closed.

SBK-L-19120, Enclosure 1 Page 20 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Description Disposition Finding No. Category Requirement (CC)

F&O LE-E4, LE-El Met The LERF result reported in Section 2.4.2 appears to be a point- Actions to Address Finding LE-E4-01 estimate result rather than the mean of the uncertainty (1) Uncertainty distributions were developed for the remaining Level 2 basic events (split distribution. Most Level 2 events do not have uncertainty fractions). This was done by modifying the equations for the point estimate split fractions to distributions and therefore do not propagate through the include multiplication of the point estimate by a LOG Normal data variable (LOGNlO). LOGNlO uncertainty analysis. State of knowledge uncertainty does not provides a range factor of 10 between the 5th and the 95 and this range factor is judged reasonable appear to be addressed throughout the model. In order to meet for the point estimates, which range in value between approximately 0.5 to lE-03. This range the Capability Category II QU requirements, the mean result factor is also consistent with that used in the Level 2 HEP basic event modeling.- The Level 2 top from the LERF uncertainty should be reported, including events that did not already include uncertainty and were modified under this MCDB action consideration of any state-of-knowledge correlation. include: XHLI, XNH2E, XNH2V, XRACE, XRACL, XRPV, XSGTI and XSUMP. The LERF uncertainty distribution and associated mean value are quantified using model SB2014 as part of the 2014 PRA update process and final quantification. The LERF uncertainty results are provided in Section 2.4.2 of the SSPSS2014 (Tier 2) report.(2) The Level I and Level 2 sequences were reviewed to identify where the state-of-knowledge correlation might be important It is noted that the SOKC is explicitly accounted for in the ISLOCA evaluation when determining the mean failure rate and uncertainty associated with failure of similar valves that use the same data variables. Based on review of the sequences, it is judged other sequences would not benefit from application of SOKC corrections. The judgment that other sequences would not benefit from application of the state-of-knowledge correlation corrections was based on a review of sequences and associated group contributions. This is further supported by a check of Monte Carlo (MC) simulation uncertainty results for selected major top event frontline mitigation systems. The check did not identify significant differences between the split fraction MC-generated mean values and the point estimate mean values. This suggested that the key contributors to the selected top events are not particularly sensitive to, or do not involve, multiple occurrences of the same variable.

Therefore, the SOKC was judged to be adequately addressed. Refer to MCDB #886 for additional detail on the SOKC assessment.

Acceptability Evaluation Review ofMCDB #886 identified that uncertainty distributions were developed for the top events that previously had not had uncertainty distributions. While the MCDB entry was reviewed and closed, the new uncertainty distributions could not be confirmed by this reviewer. However, review ofSSPSS-2014 SECTION 2 Results and Review, Rev. 0 identified that the LERF value is now reported as a mean value of a distribution that is also presented graphically. The attachment to MCD #886 includes a thorough discussion of the sensitivity of the PRA model to State of Knowledge Correlation (SOKC). This discussion includes quantitative estimates of the possible effect of SOKC on important equipment top events in the Level 1 and Level 2 models. The results of the quantitative sensitivity studies showed that the possible effect of SOKC on CDF and LERF are small (a few percent) and within the model uncertainty. The SOKC sensitivities were also reviewed to identify whether any of the LERF release categories were affected by SOKC; this review is reported to have shown that the LERF release categories are not p_articularly sensitive to SOKC. As a result of these efforts, it was concluded that no particular modeling action was required to address SOKC. This conclusion is judged to be reasonable. This resolution addresses

SBK-L-19120, Enclosure 1 Page 21 of21 Disposition and Resolution of Resolved Peer Review Findings and Self-Assessment Items Capability Supporting Disposition Finding No. Category Description Requirement (CC) the concern of the F&O. This F&O is considered to be closed.

F&O LE-G6 Not Met No documentation of the quantitative definition used for a Actions to Address Finding LE-G6-0l significant accident progression sequence was found. The The definition of "significant accident progression sequences" used in the LERF analysis is Standard definition for a significant accident progression consistent with the definition provided in the ASME PRA Standard, Section 1-2 (Definitions) and sequence was used for the LERF results, but this fact was not QU-F6 (Quantification). Refer to SSPSS2014 Section 2.5 "Model Review" and Section 2.5.3 documented. Since this is an HLR-G SR which deals with "Review of Significant Contributors to LERF" for improved documentation of significant accident documentation only, this lack of documentation is categorized progression sequence.

as a Finding. Acceptability Evaluation Review of the F&O resolution indicated improved documentation of significant accident progression sequences is contained in SSPSS-2014 SECTION 2 Results and Review, Rev. 0.

Review of Section 2.5.3 of the preceding reference confirmed that the ASME standard definition was explicitly cited and that the review was performed consistently with the cited definition of significant accident sequence. This resolution addresses the concern of the F&O. This F&O is considered to be closed.