ML19192A031

NRR E-mail Capture - LIMERICK-REQUEST for Additional Information: Risk Informed Completion Times TSTF-505, Revison 2, Provide RISK-INFORMED Completion Times - RITSTF Initiative 4B

ML19192A031
Person / Time
Site:	Limerick
Issue date:	07/10/2019
From:	V Sreenivas Plant Licensing Branch 1
To:	Stewart G Exelon Generation Co
References
L-2018-LLA-0567
Download: ML19192A031 (19)

Text

NRR-DRMAPEm Resource From: Sreenivas, V Sent: Wednesday, July 10, 2019 5:20 PM To: Stewart, Glenn H:(GenCo-Nuc) (Glenn.Stewart@exeloncorp.com)

Cc: De Messieres , Candace; Biro, Mihaela; MATHEW, ROY; Li, Ming; Wiebe, Joel; Bucholtz, Kristy; Curran, Gordon; Vasavada, Shilp; Miller, Ed; Tobin, Jennifer

Subject:

LIMERICK-REQUEST FOR ADDITIONAL INFORMATION: RISK INFORMED COMPLETION TIMES TSTF-505, REVISON 2, PROVIDE RISK-INFORMED COMPLETION TIMES -RITSTF INITIATIVE 4B(EPID L-2018-LLA-0567)

Attachments: Limerick TSTF-505 Final RAIs.docx By letter dated December 13, 2018 (Agencywide Documents Access and Management System (ADAMS)

Accession No. ML18347B366), as supplemented by letter dated February 14, 2019 (ADAMS Accession No. ML19030A147), Exelon Generation Company, LLC (Exelon) submitted a license amendment request (LAR) for Limerick Generating Station, Units 1 and 2 (Limerick). The proposed amendment would modify Technical Specifications (TSs) requirements to permit the use of Risk Informed Completion Times (RICTs) in accordance with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" (ADAMS Accession No. ML18183A493).

During June 17, 2019 to June 21, 2019 the Nuclear Regulatory Commission (NRC) staff conducted an audit at the licensees headquarters in Kennett Square, Pennsylvania to support development of its safety evaluation.

Upon completion of the audit, the NRC staff determined that additional information is needed to complete its review of this LAR. A technical clarification was held on July 10, 2019 based on the draft RAI provided to the licensee on July 3, 2019.

Please find enclosed the request for additional information (RAI). Please respond to these RAIs by August 12, 2019, except APLA: RAI-02, RAI-03 and RAI-08. Due to the needed sensitivity analysis and other additional studies, please be advised to provide responses to APLA RAI-02, RAI-03 and RAI-08 by August 30, 2019.

If you have any questions, please contact me at (301) 415-2597 or e-mail at v.sreenivas@nrc.gov V. Sreenivas, Ph.D., C.P.M.

Licensing Project Manager Limerick and Ginna, Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation 1

Hearing Identifier: NRR_DRMA Email Number: 110 Mail Envelope Properties (BL0PR0901MB2948F764B74AEA068391A7CCEFF00)

Subject:

LIMERICK-REQUEST FOR ADDITIONAL INFORMATION: RISK INFORMED COMPLETION TIMES TSTF-505, REVISON 2, PROVIDE RISK-INFORMED COMPLETION TIMES

-RITSTF INITIATIVE 4B(EPID L-2018-LLA-0567)

Sent Date: 7/10/2019 5:20:21 PM Received Date: 7/10/2019 5:20:00 PM From: Sreenivas, V Created By: V.Sreenivas@nrc.gov Recipients:

"De Messieres , Candace" <candace.demessieres@nrc.gov>

Tracking Status: None "Biro, Mihaela" <Mihaela.Biro@nrc.gov>

Tracking Status: None "MATHEW, ROY" <Roy.Mathew@nrc.gov>

Tracking Status: None "Li, Ming" <Ming.Li@nrc.gov>

Tracking Status: None "Wiebe, Joel" <Joel.Wiebe@nrc.gov>

Tracking Status: None "Bucholtz, Kristy" <Kristy.Bucholtz@nrc.gov>

Tracking Status: None "Curran, Gordon" <Gordon.Curran@nrc.gov>

Tracking Status: None "Vasavada, Shilp" <Shilp.Vasavada@nrc.gov>

Tracking Status: None "Miller, Ed" <Ed.Miller@nrc.gov>

Tracking Status: None "Tobin, Jennifer" <Jennifer.Tobin@nrc.gov>

Tracking Status: None "Stewart, Glenn H:(GenCo-Nuc) (Glenn.Stewart@exeloncorp.com)" <Glenn.Stewart@exeloncorp.com>

Tracking Status: None Post Office: BL0PR0901MB2948.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 1785 7/10/2019 5:20:00 PM Limerick TSTF-505 Final RAIs.docx 66106 Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Recipients Received:

REQUESTS FOR ADDITIONAL INFORMATION LICENSE AMENDMENT REQUEST TO ADOPT RISK INFORMED COMPLETION TIMES TSTF-505, REVISON 2, PROVIDE RISK-INFORMED COMPLETION TIMES -

RITSTF INITIATIVE 4B EXELON GENERATION COMPANY, LLC LIMERICK GENERATING STATION UNITS 1 AND 2 DOCKET NOS. 50-352 AND 50-353 (EPID L-2018-LLA-0567)

By letter dated December 13, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18347B366), as supplemented by letter dated February 14, 2019 (ADAMS Accession No. ML19030A147), Exelon Generation Company, LLC (Exelon) submitted a license amendment request (LAR) for Limerick Generating Station, Units 1 and 2 (Limerick).

The proposed amendment would modify Technical Specifications (TSs) requirements to permit the use of Risk Informed Completion Times (RICTs) in accordance with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" (ADAMS Accession No. ML18183A493).

During June 17, 2019 to June 21, 2019 the Nuclear Regulatory Commission (NRC) staff conducted an audit at the licensees headquarters in Kennett Square, Pennsylvania to support development of its safety evaluation. Upon completion of the audit, the NRC staff determined that additional information is needed to complete its review of this LAR.

A. Probabilistic Risk Analysis (PRA) Licensing Branch A (APLA)

APLA RAI Key Assumptions and Sources of Uncertainty Regulatory Position C of Regulatory Guide (RG) 1.174, Revision 3, (Agencywide Documents Access and Management System (ADAMS) Accession Number (No.) ML17317A256) states:

In risk-informed decisionmaking, licensing basis changes are expected to meet a set of key principles In implementing these principles, the staff expects the following Uncertainty receives appropriate consideration in the analyses and interpretation of findings NUREG-1855 provides acceptable guidance for the treatment of uncertainties in risk-informed decisionmaking NUREG-1855, Revision 1 (ADAMS Accession No. ML17062A466) provides guidance on screening sources of uncertainty and determining those that are key sources of uncertainty for the application. NUREG-1855, Revision 1 identifies EPRI Topical Report (TR) 1016737 and EPRI TR 1026511 as providing additional guidance for identifying and characterizing key sources of uncertainty.

Section 2.3.4 of Nuclear Energy Institute (NEI) 06-09, Revision 0-A (ADAMS Accession No. ML12286A322), states that PRA modeling uncertainties be considered in application of the PRA base model results to the risk-informed completion time (RICT) program. The NRC Safety Evaluation (SE) for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1 (ADAMS Accession No. ML100910008). NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation. These sensitivity studies should be used to develop appropriate 1

compensatory Risk Management Actions (RMAs) such as highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions. of the License Amendment Request (LAR) (ADAMS Accession No. ML18347B366) states that the uncertainty analysis for the internal events PRA was performed based on guidance from NUREG-1855, Revision 1, and EPRI TR 1016737. The LAR indicates that plant--specific key assumptions and modeling uncertainties from the internal events PRA documentation were considered, as well as generic sources of uncertainty from EPRI TR 1016737. However, the LAR does not discuss how the sources of modeling uncertainty were identified for the fire PRA or for the Level 2 (e.g., LERF) PRA, nor does it explicitly explain whether both plant-specific and generic modeling sources of uncertainty were considered for the fire and Level 2 PRA models. NRC notes that generic modelling uncertainties for fire and Level 2 PRAs are identified in EPRI TR 1026511.

Tables E9-1, E9-2, and E9-3 of Enclosure 9 of the LAR provide, respectively, 13 sources of uncertainty related to the internal events PRA (none of which are related to internal flooding),

three sources of uncertainty related to translation of the PRA models to the Real-Time Risk (RTR) model, and 16 sources of uncertainty related to the fire PRA. Most of the identified sources of uncertainty were dispositioned as not being key uncertainties because they do not impact or have only a minor impact on the RICT calculations, or because the PRA uses consensus modeling approaches, or because the assumption was determined to not be a source of uncertainty. The LAR does not describe the assessment process used to determine that the assumptions and sources of uncertainty included in these tables are those that are potentially key to the RICT application.

Considering the observations above, address the following:

a. Describe, separately for the internal events, internal flooding and the fire PRAs, the process used to identify and evaluate key assumptions and sources of model uncertainty. Address the following in the response:

i. Discuss how a comprehensive list of plant-specific and generic industry key assumptions and sources of uncertainty were identified as a starting point for this evaluation.

ii. Explain how the comprehensive list of key assumptions and sources of uncertainty sources was screened to a list of uncertainties that were specifically evaluated for their impact on the RICT application.

iii. Explain what criteria or what additional analysis was used to evaluate the impact of the key assumptions and sources of uncertainty on the RICT application.

iv. Describe how the evaluation process aligns with guidance in NUREG-1855, Revision 1, or other NRC-accepted processes.

b. In accordance with the process described in NUREG-1855, Revision 1, describe any additional sources of internal events, internal flooding, or fire PRA model uncertainty and related assumptions relevant to the application that were not provided in LAR Enclosure 9 and describe their impact on the application results.

2

c. For any additional sources of model uncertainty and related assumptions identified in part b:

i. Provide qualitative or quantitative justification that these uncertainties and assumptions do not challenge the RG 1.174 risk acceptance guidelines.

ii. Justify that these key uncertainties and assumptions have no impact on the RICT calculations or, if determined to have a significant impact, consistent with the guidance in NEI 06-09-A, discuss the RMAs for each key uncertainty and assumption that will be implemented to minimize their potential adverse impact.

APLA RAI Specific Key Assumptions and Sources of Uncertainty The NRC SE for NEI 06-09 states:

When key assumptions introduce a source of uncertainty to the risk calculations (identified in accordance with the requirements of the ASME standard), TR NEI 06-09, Revision 0, requires analysis of the assumptions and accounting for their impact to the RMTS [risk-managed technical specifications] calculated RICTs.

a. Regarding the uncertainty associated with continued injection from control rod drive (CRD) after containment failure, the disposition in LAR Table E9-1 states that RMAs will be implemented to address the uncertainty with this assumption for RICTs that are pertinent to loss of containment heat removal scenarios. Address the following:

i. Identify the Limiting Conditions for Operation (LCOs) proposed to be included in the RICT program for which loss of containment heat removal scenarios affect the RICT.

ii. Provide the results of a sensitivity study of the impact on RICTs of this assumption to credit control rod drive injection after containment failure. Discuss the results of this sensitivity study in the context of the RICT estimates provided in Table E1-2 of Enclosure 1 of the LAR.

iii. Describe the RMAs (e.g., operator briefing on the significant human actions in the PRA that are pertinent to loss of containment heat removal scenarios) to be implemented for applicable RICTs and provide justification that these RMAs minimize the potential adverse impact on the RICT.

b. LAR Table E9-1 identifies that, given an uncontrolled flooding of the steam lines, a nominal failure probability of 1 x 10-3 is assigned to Safety Relief Valves (SRVs) being permanently disabled, which precludes the ability to depressurize the reactor pressure vessel through the SRVs. The disposition states that the 1 x 10-3 failure probability provides a slight conservative bias to the results such that the impact on RICT calculations is not unduly influenced. The LAR identifies that this uncertainty affects the RICTs for the LCOs associated with the High Pressure Injection Systems. The disposition further identifies that although the SRVs are designed to pass water, they are never tested in this fashion.

Discuss the sensitivity of this assumption for the RICT application. If determined to be significant to the RICT application, discuss the RMAs that will be implemented to minimize the impact of this assumption.

3

APLA RAI Potential Credit for FLEX Equipment or Actions The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269),

provides the NRCs staff assessment of the challenges of incorporating diverse and flexible (FLEX) coping strategies and equipment into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2 (ADAMS Accession No. ML090410014). Though implementation of FLEX procedures is cited in the LAR as possible RMAs, the LAR and other docketed information do not indicate if Limerick has credited FLEX equipment or actions in the internal events, including internal flooding, or fire PRA models. As such, please address the following:

a. Discuss whether Exelon has credited FLEX equipment or mitigating actions into the Limerick internal events, including internal flooding, or fire PRA models. If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested.

b. If FLEX equipment or operator actions have been credited in the PRA, address the following, separately for the internal events, including internal flooding, and fire PRAs:

i. Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

ii. Discuss whether the credited equipment (regardless of whether it is portable or permanently-installed) are like other plant equipment (i.e. SSCs with sufficient plant-specific or generic industry data) and whether the credited operator actions are similar to other operator actions evaluated using approaches consistent with the endorsed ASME/ANS RA-Sa-2009 PRA standard.

iii. If any credited FLEX equipment is dissimilar to other plant equipment credited in the PRA (i.e. SSCs with sufficient plant-specific or generic industry data), discuss the data and failure probabilities used to support the modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

iv. If any operator actions related to FLEX equipment are evaluated using approaches that are not consistent with the endorsed ASME/ANS RA-Sa-2009 PRA Standard (e.g., using surrogates), discuss the methodology used to assess human error probabilities for these operator actions. The discussion should include:

1. A summary of how the impact of the plant-specific human error probabilities and associated scenario-specific performance shaping factors listed in (a)-(j) of supporting requirement HR-G3 of the ASME/ANS RA-Sa-2009 PRA Standard were evaluated.

2. Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable 4

during an event, and if the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of the ASME/ANS RA-Sa-2009 PRA Standard.

3. If the procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical bases for probability of failure to initiate mitigating strategies.

c. The ASME/ANS RA-Sa-2009 PRA standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

Provide an evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

d. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation. NRC staff notes that the impact of model uncertainty could vary based on the proposed RICTs. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate compensatory RMAs including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions. Uncertainty exists in modeling FLEX equipment and actions related to assumptions regarding the failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities. Therefore, FLEX modeling assumptions can be key assumptions and sources of uncertainty for RICTs proposed in this application. In light of these observations:

i. Describe the sensitivity studies that will be used to identify the RICTs proposed in this application for which FLEX equipment and/or operator actions are key assumptions and sources of uncertainty (e.g., use of generic industry data for non-safety related equipment). Explain and justify the approach (e.g., any multipliers for failure probabilities) used to perform the sensitivity studies.

ii. Describe how the results of the sensitivity studies which identify FLEX equipment and/or operator actions as key assumptions and sources of uncertainty will be used to identify RMAs prior to the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

5

iii. Demonstrate the approaches described in items (i) and (ii) above using an example sensitivity study for the nominal configuration of a proposed RICT where the FLEX equipment and/or operator actions are identified as key assumptions and sources of uncertainty.

APLA RAI Real-Time Risk Model Regulatory Position 2.3.3 of RG 1.174, Revision 3, states that the level of detail in the PRA should be sufficient to model the impact of the proposed licensing basis change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. Full-scale applications of the PRA should reflect this cause-effect relationship in a quantification of the impact of the proposed licensing basis change on the PRA elements.

Section 4.2 of NEI 06-09, Revision 0-A, describes attributes of the configuration risk management tool (CRM). A few of these attributes are listed below:

• Initiating events accurately model external conditions and effects of out-of-service equipment.

• Model translation from the PRA to a separate CRM tool is appropriate; CRM fault trees are traceable to the PRA. Appropriate benchmarking of the CRM tool against the PRA model shall be performed to demonstrate consistency.

• Each CRM application tool is verified to adequately reflect the as-built, as-operated plant, including risk contributors which vary by time of year or time in fuel cycle or otherwise demonstrated to be conservative or bounding.

• Application specific risk important uncertainties contained in the CRM model (that are identified via PRA model to CRM took benchmarking) are identified and evaluated prior to use of the CRM tool for RMTS applications.

• CRM application tools and software are accepted and maintained by and appropriate quality program.

• The CRM tool shall be maintained and updated in accordance with approved station procedures to ensure it accurately reflects the as-built, as-operated plant. of the LAR describes the attributes of the RTR model, Limericks CRM tool, for use in RICT calculations. The LAR explains that the internal flooding PRA model is integrated into the internal events PRA model, but the fire PRA model is maintained as a separate model.

The LAR also describes several changes made to the internal events and fire PRA models to support calculation of configuration-specific risk and mentions approaches for ensuring the fidelity of the RTR to the PRAs including RTR maintenance, documentation of changes, and testing. With regards to development and application of the RTR model, provide the following:

a. Explain how any changes in success criteria based on seasonal variations are accounted for in the RTR model for use in RICT calculations.

6

b. Confirm that out-of-service equipment will be properly reflected in the RTR Model initiating event models as well as in the system response models.

c. Describe the process that will be used to maintain the accuracy of any pre-solved cutsets with changes in plant configuration.

d. Describe the benchmarking activities performed to confirm consistency of the RTR model to base PRA model results, including periodicity of RTR updates compared to the base PRA model updates.

APLA RAI Identification of Compensatory Measures and RMAs The NRC SE for NEI 06-09, Revision 0-A, states that the LAR will describe the process to identify and provide compensatory measures and RMAs during extended CTs. LAR 2 identifies three kinds of RMAs (i.e., actions to provide increased risk awareness and control, reduction of the duration of maintenance activities, and reduction of the magnitude of risk increase). LAR Enclosure 12 also provides examples of RMAs for an unavailable diesel generator, battery charger, RHR pump, and for loss of off-site power. LAR Enclosure 12 does not describe what criteria or insights (e.g., important fire areas, important operator actions) are used to determine what RMAs to apply in specific instances. Therefore:

a. Describe the criteria and insights (e.g., important fire areas, important operator actions) that are used to determine the compensatory measures and RMAs to apply in specific instances.

b. Explain how RMAs are identified for emergent conditions in which the extent of condition evaluation for inoperable SSCs is not complete prior to exceeding the Completion Time to account for the increased possibility of a common cause failure (CCF). Include explanation of if and how these RMAs are different from other RMAs.

APLA RAI Evaluation of Common Cause Failures for Planned Maintenance NEI 06-09, Revision 0-A, states that no common cause failure (CCF) adjustment is required for planned maintenance. The NRC SE for NEI 06-09, Revision 0, is based on conformance with RG 1.177, Revision 1. Specifically, SE Section 2.2 states that, specific methods and guidelines acceptable to the NRC staff are [] outlined in RG 1.177 for assessing risk-informed TS changes. SE Section 3.2 further states that compliance with the guidance of RG 1.174, Revision 1, and RG 1.177, Revision 1, is achieved by evaluation using a comprehensive risk analysis, which assesses the configuration-specific risk by including contributions from human errors and common cause failures.

The guidance in RG 1.177, Revision 1, Section 2.3.3.1, states that, CCF modeling of components is not only dependent on the number of remaining in-service components but is also dependent on the reason components were removed from service (i.e. whether for preventative or corrective maintenance). In relation to CCF for preventive maintenance, the guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states:

If the component is down because it is being brought down for maintenance, the CCF contributions involving the component should be modified to remove 7

the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

According to RG 1.177, Revision 1, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant.

a. Explain how CCFs are included in the PRA model (e.g., with all combinations in the logic models as different basic events or with identification of multiple basic events in the cut sets);

b. Explain how the quantification and/or models will be changed when, for example, one train of a 3x100 percent train system is removed for preventative maintenance and describe how the treatment of CCF meets the guidance in RG 1.177, Revision 1, or meets the intent of this guidance when quantifying a RICT.

APLA RAI Evaluation of Common Cause Failure for Emergent Conditions TS Administrative Section constraint d states:

For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the ACTION allowed outage time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

Regarding option 1 of constraint d, provide the following:

a. Describe and justify how the numerical adjustment for increased possibility of CCF will be performed, or

b. Confirm that numerically accounting for the increased possibility of CCF in the RICT calculation will be performed in accordance with RG 1.177, Revision 1.

APLA RAI PRA Modeling of Instrumentation and Controls The proposed TS limiting conditions for operations (LCOs) include those related to instrumentation and controls (I&C).

PRA technical acceptability attributes are provided in Section 2.3.4 of NEI 06-09, Revision 0-A, and in RG 1.200, Revision 2. The licensee has previously received approval for changes to its I&C completion times, bypass test times, and surveillance intervals consistent with guidance in 8

Technical Specifications Task Force (TSTF) traveler TSTF-411 and TSTF-418. However, the licensee does not address whether the I&C is modeled in sufficient detail to support implementation of TSTF-505, Revision 2 (ADAMS Accession No. ML18183A493). The following additional information is requested:

a. Explain how instrumentation is modelled in the PRA. This should include, but not be limited to, the scope of the I&C equipment (e.g., channels, relays, logic) and associated TS functions for which a RICT would be applied, and PRA modeling of the I&C and functions including how these are modeled in sufficient detail and based on plant-specific data, etc.

b. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation and that sensitivity studies should be used to develop appropriate compensatory RMAs.

Regarding digital I&C, NRC staff notes the lack of consensus industry guidance for modeling these systems for plant PRAs to be used in risk-informed applications. In addition, known modeling challenges exist due to the lack of industry data for digital I&C systems and components and the complexities associated with modeling software failures including common cause software failures. Given these needs and challenges, if the modeling of digital I&C systems or components is included in the RTR model, then address the following:

i. Provide the results of a sensitivity study demonstrating that the uncertainty associated with modeling the digital I&C systems or components has an inconsequential impact on the LCOs included in the RICT program, or ii. If the modeling of digital I&C systems or components is determined to be a key source of uncertainty for the application, identify impacted LCOs and describe how sensitivity studies are used to identify RMAs to minimize the potential adverse impacts of this source of uncertainty, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

APLA RAI PRA Modeling - Other Systems The NRC SE to NEI 06-09, Revision 0, specifies that the LAR is to provide a comparison of the TS functions to the PRA modeled functions and that sufficient justification is to be provided to show that the scope of the PRA model is consistent with the licensing basis assumptions.

Additionally, Item 11 in Section 2.3 of TSTF-505, Revision 2, states:

The traveler will not modify Required Actions for systems that do not affect core damage frequency (CDF) or large early release frequency (LERF) or for which a RICT cannot be quantitatively determined.

Address the following:

a. For LCO 3.6.2.2.a (One suppression pool spray loop inoperable), LAR Table E1-1 states that suppression pool spray is not modeled in the PRA and so failure of the drywell spray will be used as a surrogate for the associated RICT calculation. The basis provided is that 9

the drywell and wetwell airspaces are connected by the downcomers. However, separate containment spray systems are provided in each airspace specifically because different environmental (temperature, pressure) conditions between the two air spaces are expected during severe accidents.

Provide additional justification that removal from service of a drywell spray loop is an appropriate surrogate for removal of a wetwell spray loop. The justification should include discussion of differences in the flowrates and availability/reliability of the two systems.

b. For LCO 3.6.3.a (One or more Primary Containment Isolation Valves inoperable), LAR Table E1-1 states that lines less than two inches in diameter are not considered a significant leakage path, and that for containment isolation valves greater than two inches that are not modeled in the PRA a generic isolation failure event will be used. Address the following:

i. Provide justification that failure of containment penetration lines less than two inches in diameter either do not contribute to LERF or are insignificant contributors to LERF.

ii. Describe the types of containment isolation valves greater than two inches that are not modeled in the PRA and provide justification why the proposed surrogate adequately captures the risk impacts.

c. LAR Table E1-1 makes generic statements that the SSCs covered by LCOs are modeled in the PRA but does not describe how. For each LCO listed below describe how the SSCs are modeled in the PRA, describe its impact on CDF and/or LERF, and justify how a RICT can be quantitatively determined.

i. LCO 3.1.5.1.a: (Standby liquid control system) Only one pump and corresponding explosive valve OPERABLE ii. LCO 3.6.4.1.a: One or more vacuum breakers in one of the three required pairs of vacuum breakers inoperable for opening but known to be closed iii. LCO 3.7.8: Main Turbine Bypass System Inoperable APLA RAI LCO 3.6.5.3, Standby Gas Treatment (SGTS)

The LAR proposes that LCO 3.6.5.3, Standby Gas Treatment, is in the scope of the RICT program. LAR Attachment 4 recognizes that LCO 3.6.5.3 is not in scope of TSTF-505, consistent with Item 11 in Section 2.3 of TSTF-505, Revision 2 that states:

The traveler will not modify Required Actions for systems that do not affect core damage frequency (CDF) or large early release frequency (LERF) or for which a RICT cannot be quantitatively determined.

LAR Attachment 4 further states that SGTS is modeled in the Limerick PRA and that a quantitative RICT can be performed for this TS but does not describe the PRA modeling for this LCO. According to Section 6.5.1.1 of the Limerick Updated Final Safety Analysis Report, the SGTS function is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment. This function mitigates the radiological 10

consequences following DBAs and ensures that the offsite and onsite radiological dose does not exceed the limits stated in 10 CFR 50.67. The NRC staff notes that this system function does not appear to have any impact on CDF and LERF. Therefore, address the following:

a. Describe the functions of the SGTS system and explain how the proposed change is consistent with RG 1.174, Revision 3, key principles 2 and 3 regarding maintaining defense-in-depth and safety margins.

b. Describe and justify how the SGTS functions identified in part a above are modeled in the PRA and how the numerical impact on CDF and/or LERF can be estimated.

c. Alternatively, to items a and b, remove LCO 3.6.5.3 from the scope of the RICT program.

B. PRA Licensing Branch B (APLB) RAIs APLB RAI Bounding Seismic Risk Analysis Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by performing a reasonable bounding analysis and applying it along with the internal events risk contribution in calculating the configuration risk and the associated RICT. The NRC staffs safety evaluation for NEI 06-09 (ADAMS Accession No. ML071200238) states that [w]here

[probabilistic risk assessment] PRA models are not available, conservative or bounding analyses may be performed to quantify the risk impact and support the calculation of the RICT.

A seismic PRA model is not available for LGS. In Section 3 of Enclosure 4 to the LAR, the licensee stated that a seismic core damage frequency (CDF) and large early release frequency (LERF) penalty was determined for this application using the recent seismic hazard curves developed in response to Recommendation 2.1 of the Near-Term Task Force (NTTF) (ADAMS Accession No. ML14090A236).

Details of the approach for determining the seismic penalty are provided in Section 3 of to the LAR. The licensee calculated the seismic LERF using the ratio between LERF and CDF, based on the internal events, including internal flooding. The licensee explained that the ratio was adjusted by removing the risk contribution of certain accident scenarios because they would not be expected to be induced by a seismic event. In Section 3 of Enclosure 4 to the LAR, the licensee stated that the chosen conditional large early release probability (CLERP) value was adequately conservative. As noted earlier, the NEI 06-09, Revision 0-A, as well as the corresponding NRC staff SE, calls for a bounding analysis. In addition, NRC staff observes that LERF-to-CDF ratio for seismic events can be significantly higher than the same ratio for internal events due to the unique nature of seismically-induced failures. It is unclear that the selected CLERP of 20% can be considered as a bounding value for use in the RICT calculation.

a. Justify that the seismic LERF penalties provided in the submittal to support RICT calculations for LGS are bounding. Include the rationale that deriving seismic LERF-to-CDF ratio using the internal events LERF-to-CDF ratio is bounding for seismically induced events, given that internal events random failures do not capture seismically-induced failures that may uniquely contribute to LERF.

11

b. If the approach to estimating seismic LERF cannot be justified as bounding for this application in response to part (a) above, then provide, with justification, the bounding seismic LERF penalties for use in RICT calculations.

APLB RAI Extreme Winds Analysis Section 2.3.1, Item 7, of NEI 06-09, Revision 0-A, states that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 (ADAMS Accession No. ML071200238) states that [o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk. Section 1.2.5 of Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-informed Activities, Revision 2 (ADAMS Accession No. ML090410014), states that the contribution of many external events to CDF and LERF can be screened out (1) if it meets the criteria in the NRCs 1975 Standard Review Plan (SRP) or a later revision; or (2) if it can be shown using a demonstrably conservative analysis that the mean value of the design-basis hazard used in the plant design is less than 10-5 per year and that the conditional core damage probability is less than 10 -1, given the occurrence of the design-basis-hazard event; or (3) if it can be shown using a demonstrably conservative analysis that the CDF is less than 10-6 per year. The screening criteria listed in Section 1.2.5 of RG 1.200 are consistent with those in Section 6-2.3 of the 2009 American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard (RA-Sa-2009), "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications."

In Section 4 of Enclosure 4 to the LAR, the licensee addresses the risk from extreme winds.

The tornado generated missile damage determined by a 1984 hazard analysis that the likelihood of the loss of the ultimate heat sink (UHS) was approximately 8x10-7/yr. A comparison of tornado frequencies was made by the licensee between those in the 1984 hazard analysis and data from NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States, February 2007 (ADAMS Accession No. ML070810400) which showed that estimated tornado frequencies have reduced by more than an order of magnitude from the 1984 hazard analysis. Section 4 of Enclosure 4 to the LAR also states that the 1984 PRA shows that the only damage is from Fujita Scale F4 and greater tornadoes (>206 miles/hour) and that high wind and hurricane frequencies are negligible. Based on the information in the LAR, it is unclear to the staff whether the licensees approach appropriately considers the risk of tornado missile impact for this application.

a. Justify that the loss of UHS is the only non-conforming SSC impacted by tornado generated missiles. If additional impacts exist, discuss and justify how the impact of tornado missiles on such structures, systems, and components (SSCs) is addressed in the context of this application.

b. Describe the approach used to determine the impact of tornado missiles on the likelihood of the loss of UHS and justify its applicability to the screening of tornado missile risk for the proposed RICT program. Include a discussion on (i) the basis for concluding that only tornado category F4 and greater are relevant to this application and (ii) how the frequency and potential for damage from exposure to tornadoes and high winds that are less than F4 are addressed.

12

c. If tornadoes and high winds cannot be screened based on the responses to the above questions, discuss how the risk for these hazards will be addressed in the proposed RICT program.

d. Clarify whether any SSCs are credited in the screening of tornadoes and high winds, including tornado missiles. If such SSCs exist discuss how it will be ensured that assumptions related to the availability and the functionality of those SSCs remain valid during RICTs such that the extreme wind hazard continues to have an insignificant impact on the configuration-specific risk.

C. Electrical Engineeing Operating Reactor Branch (EEOB) RAIs The regulatory requirements related to the content of the TSs are contained in Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36, "Technical specifications." Section 50.36 (c) of 10 CFR requires TSs to include the following categories related to station operation:

(1) safety limits, limiting safety systems settings, and limiting control settings; (2);

limiting conditions for operation (3) surveillance requirements; (4) design features; (5) administrative controls; (6) decommissioning; (7) initial notification; and (8) written reports Section 50.36(c)(2)(i) of 10 CFR states, in part, Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

10 CFR, Appendix A of Part 50, General Design Criterion (GDC) 17, Electric Power Systems, requires, in part, that an onsite electric power system and an offsite electric power system be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents. The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

EEOB RAI-01:

UFSAR Section 3.1, Conformance with NRC General Design Criteria, Design Evaluation for Electric Power Systems states: Either of the two offsite power systems or any three of the four onsite standby diesel generator systems in each unit have sufficient capability to operate safety-related equipment so that specified acceptable fuel design limits and design conditions of the RCPB are not exceeded as a result of anticipated operational occurrences and to cool the reactor core and maintain primary containment integrity and other vital functions if there are postulated accidents.

13

UFSAR Section 8.1.5.2, Onsite Power System, states: The onsite Class 1E electric power system is divided into four independent divisions per unit. With the exception of the power supply requirements for the ESW system, the RHRSW system, the SGTS, CSCWS and the control room and control structure ventilation systems, which are common systems, any combination of three-out-of-four divisions of Class 1E power in each unit can shut down the unit safely and maintain it in a safe shutdown condition. Common loads for the ESW and RHRSW systems are split between the Unit 1 and Unit 2 Class 1E power systems. Common redundant loads for the SGTS, CSCWS and the control room and control structure ventilation systems are fed from Unit 1 Class 1E power supplies.

Any combination of three-out-of-four divisions (EDGs) is acceptable for a single failure.

However, for ECCS requirements (as stated in paragraph 6.3.1.1.2), an EDG operable configuration of 2 out of 4 is also acceptable.

TSTF-505, Revision 2, Model Safety Evaluation states that application of the RICT Program requires that there is no TS loss of function conditions.

Based on the above and the design success criteria listed in LAR Table E1-1, it appears that the following Actions for LCO conditions represent a loss of function (i.e., to ensure three-out-of-four divisions of Class 1E power in each unit are operable):

a. 3.8.1.1.b -Two diesel generators inoperable where design success criteria require three of four diesel generators to be operable

b. 3.8.1.1.b* footnote - Two diesel generators inoperable RHRSW piping replacement

c. 3.8.1.1.e.1 - For two train systems, one or more diesel generators inoperable

d. 3.8.1.1.e.1* footnote- For two train systems, one or more diesel generators inoperable RHRSW piping replacement

e. 3.8.1.1.h - One offsite circuit and two diesel generators inoperable Please confirm for each of the above Actions for LCO conditions, either: (1) Confirm and describe with supporting documentation (NRC approvals) how all design-basis functions are met without loss of safety function of emergency onsite power system when entering any of the conditions listed above consistent with LGS design and licensing basis or (2) Remove the proposed RICT from LGS TS to be consistent with TSTF 505, Revision 2. Please provide appropriate clarifications and TS markup.

EEOB RAI-02: 2 of LAR describes the process for identification and implementation of Risk Management Actions (RMAs) applicable during extended CTs and provides examples of RMAs.

Please clarify specific RMAs and compensatory measures, in addition to the RMAs specified for 3.8.1.1.f (one offsite source inoperable), to maintain defense in depth and safety margins of offsite electric power system that would be required by the RICT for TS 3.8.1.1.g (two offsite circuits inoperable).

EEOB RAI-03:

14

UFSAR Section 8.3.1.1.3, Standby Power Supply, states: Common loads for the ESW and the RHRSW systems are split between Unit 1 and Unit 2 standby power supplies. Common redundant loads for the SGTS, the CSCWS and the control room and control structure ventilation systems are fed from Unit 1 standby power supplies. Staff notes that TS LCO 3.8.1.1b identifies only four diesel generators to be operable in each unit during operational modes 1, 2, and 3 (unitized). It does not identify the minimum number of diesels to be operable from the opposite unit in accordance with 10 CFR 50.36(c)(2)(i) to meet design basis safety functions of systems that are shared between two units. Please explain how the RICT calculations considered minimum required diesel generators as discussed in UFSAR Sections 3.1, 8.1.5.2, 8.3.1.1.3 and Required Actions of each unit. Please provide appropriate clarifications and TS markup, if required to comply with 50.36(c)(2)(i) requirements.

D. Instrumentation and Controls Branch (EICB) RAIs EICB RAI-1 The LAR is a risk-informed request to modify Limerick, Units 1 and 2 Technical Specification consistent with the approach approved in TSFT-505 Revision 2.

In Section 3.1.2.3 Evaluation of Instrumentation and Control Systems of the TSTF505 Revision 2 Model Application, the NRC clarifies the basis of the staffs safety evaluation is to consider a number of potential plant conditions allowed by the new TSs and to consider what redundant or diverse means were available to assist the licensee in responding to various plant conditions. The TSTF-505 Revision 2 position it that at least one redundant or diverse means (e.g., other automatic features or manual action) to accomplish the safety functions (e.g.,

reactor trip, safety injection, or containment isolation) remain available during the use of the RICT. This approach is consistent with maintaining a sufficient level of defense-in-depth in accordance with Regulatory Guide (RG) 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Licensing Basis, May 2011 (ADAMS Accession No. ML100910006), and the guidance in Revision 1 of RG 1.177, An Approach for Plant Specific, Risk Informed Decision making: Technical Specifications, May 2011 (ADAMS Accession No. ML100910008), which further describe the regulatory position with respect to defense-in-depth (including diversity). of the LAR list the FUNCTIONAL UNITs of the Instrumentation and Control Systems; however, this list does not provide NRC staff adequate information to verify at least one redundant or diverse means will remain available to accomplish the intended safety functions of I&C TS with RICT.

Please describe other means that exist to initiate the safety function for each plant accident condition that the identified TS 3/4.3 function is currently designed to address. The evaluation of diverse means, should identify the conditions that the FUNCTIONAL UNIT responds to, and for each condition, other means (e.g., diversity, redundancy, or operator actions) that can be used. Alternatively, provide additional information to demonstrate that defense in depth is maintained during the extended completion times for each function. This information is needed to demonstrate compliance with 10 CFR 50.36(c), and consistent with the implementing guidance in RG 1.174 and the TSTF-505 Revision 2.

15

EICB RAI-2 The TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" (ADAMS Accession No. ML18183A493) excludes loss of function conditions (e.g.

trip capability is not maintained) from the risk informed completion time program. In particular, Note 1 in Table 1 specifies that some Conditions are applicable when an unspecified number of subsystems or instrument channels are inoperable, typically written as "One or more" or "Two or more". These conditions currently apply when all subsystems or channels required to be operable to perform a function are inoperable, and application of a RICT in this situation is prohibited.

The licensee inserted footnotes

• and *** to selected Conditions in this LAR (such as LCO 3.3.4.1.b) that states Not applicable when trip capability is not maintained. However, other Conditions in this LAR and, in which it is possible not to maintain trip capabilities in certain RICT configurations, do not have this footnote. For example, FUNCTIONAL UNIT 3 in Table 3.3.1-1, under LCO 3.3.1 Condition a, the TRIP UNIT A and C could be both inoperable (see Figure 7.2-3 in Limerick UFSAR). This would cause TRIP SYSTEM A inoperable, which would be a loss of function of FUNCTIONAL UNIT 3. Therefore, it appears that under some conditions, certain plant I&C configurations could include loss of function.

Please confirm that all conditions, in which trip capability in not maintained, are excluded from the application of the proposed RICT program for LCO 3.3.1, LCO 3.3.2, LCO 3.3.3, LCO 3.3.4.1, LCO 3.3.4.2 and LCO 3.3.9 for Limerick Generating Station, Units 1 and 2. This information is needed to demonstrate compliance with 10 CFR 50.36(c), and consistent with the implementing guidance in RG 1.174 and the TSTF-505 Revision 2 model SE.

E. Technical Specifications Branch (STSB) RAIs STSB RAI-1 TSTF-505, Revision 21, does not allow for TS loss of function conditions (i.e., those conditions that represent a loss of a specified safety function or inoperability of all required trains of a system required to be operable) in the risk informed completion time program.

Based on the design success criteria provided in the license amendment request Table E1-1 it appears that some LCO actions may constitute a loss of function.

A. Provide a technical basis for why the actions that follow do not constitute a loss of function, or alternatively, remove them from the scope of the risk informed completion time program.

1. LCO 3.1.5, Standby Liquid Control System Action a: With only one pump and corresponding explosive valve operable

2. LCO 3.5.1, ECCS - Operating 1

ADAMS accession number ML18183A493 16

Action d.1: With one of the above required ADS valves inoperable, provided the HPCI system, the CSS and the LPCI system are operable

3. LCO 3.6.1.3, Primary Containment Air Lock Action b: With the primary containment air lock inoperable, except as a result of an inoperable air lock door

4. LCO 3.6.5.3, Standby Gas Treatment System - Common System (Unit 2)

Action a.3: With one standby gas treatment subsystem inoperable and the other standby gas treatment subsystem with an inoperable Unit 1 diesel generator Action a.4: With the Unit 1 diesel generators for both standby gas treatment system subsystems inoperable for more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />

5. LCO 3.7.1.1, Residual Heat Removal Service Water System [RHRSW] - Common System Action a.6: With three RHRSW pump/diesel generator pairs* inoperable

6. LCO 3.7.1.2, Emergency Service Water System - Common System Action a.3: With one emergency service water system loop otherwise inoperable Action a.4: With three ESW pump/diesel generator pairs** inoperable B. There appears to be a discrepancy between the design success criteria column in license amendment request Table E1-1 and the design as described in the updated final safety analysis report for LGS. Update Table E1-1 design success criteria to be consistent with the updated final safety analysis report or explain why the design success criteria discrepancy exists for the following systems:

1. LCO 3.6.2.2, Suppression Pool Spray

2. LCO 3.6.4.1, Suppression Chamber - Drywell Vacuum Breakers 17