ML18138A480

Response to Request for Additional Information for Risk-Informed Completion Times

ML18138A480
Person / Time
Site:	Palo Verde
Issue date:	05/18/2018
From:	Lacal M Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-07691-MLL/MDD
Download: ML18138A480 (110)

Text

10 CFR 50.90 MARIA L. LACAL Senior Vice President Nuclear Regulatory and Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 102-07691-MLL/MDD Tel 623.393.6491 May 18, 2018 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

References:

1. Arizona Public Service Company (APS), License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015, Agencywide Documents Access and Management System (ADAMS) No. ML15218A300

2. APS, License Amendment Request Supplement for Risk-Informed Completion Times, dated November 3, 2017, ADAMS No. ML17307A188

3. NRC Letter, Request for Additional Information License Amendment Request to Adopt TSTF-505-A, Revision 1 (4b)

Risk-Informed Completion Times, dated April 18, 2018, ADAMS No. ML18094B112

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 APS Response to Request for Additional Information for Risk-Informed Completion Times On July 31, 2015, as supplemented by letter dated November 3, 2017, APS submitted a license amendment request (LAR) to modify the Palo Verde Nuclear Generating Station (PVNGS) Technical Specification (TS) requirements to permit the use of Risk Informed Completion Times (RICT) in accordance with the Risk Informed Technical Specification Task Force Initiative 4b, References 1 and 2, respectively.

During the week of February 20, 2018, the NRC staff conducted an audit at PVNGS to gain an understanding of the risk-informed completion time program at PVNGS and to review the probabilistic risk assessment model that will be used by APS for this risk-informed LAR. The NRC staff determined that A member of the STARS Alliance, LLC Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

102-07691-MLL/MDD ATTN: Document Control Desk U.S. Nuclear Regulatory Commission APS Response to RAIs for Risk-Informed Completion Times Page 2 additional information is required to complete their review (Reference 3) and a clarifying phone call was held with APS to discuss the information needed. The NRC questions and the APS responses to the request for additional information (RAI) questions are provided in the enclosure to this letter.

Several of the responses by APS refer to additional work that will be completed subsequent to this response letter. This work will be completed prior to implementation of the RICT program at PVNGS. As described in to the enclosure, a new license condition is proposed to address this work required to be completed prior to implementation of the RICT program at PVNGS.

APS has reviewed the information supporting a finding of no significant hazards consideration that was previously provided to the NRC in the enclosure of Reference 1. APS has concluded that the information provided in this response does not affect the basis for concluding that the proposed license amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92.

Should you need further information regarding this letter, please contact Michael DiLorenzo, Nuclear Regulatory Affairs, at (623) 393-3495.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on May 18, 2018 .

(Date)

Sincerely, Lacal, Maria Digitally signed by Lacal, Maria L(Z06149)

DN: cn=Lacal, Maria L(Z06149)

L(Z06149) Date: 2018.05.18 16:49:50

-07'00' MLL/MDD/PJH/sa

Enclosure:

APS Response to Request for Additional Information for Risk-Informed Completion Times cc: K. M. Kennedy NRC Region IV Regional Administrator M. D. Orenak NRC NRR Project Manager for PVNGS C. A. Peabody NRC Senior Resident Inspector for PVNGS

ENCLOSURE APS Response to Request for Additional Information for Risk-Informed Completion Times

Table of Contents Enclosure - APS Response to Request for Additional Information for Risk-Informed Completion Times - PVNGS RICT PRA Implementation Items - Significant Changes to the PVNGS Internal Events, Internal Flooding, Seismic, and Internal Fire PRA Models - Other External Hazards Screening Peer Review Findings - Guidelines for Determining Barrier Adequacy - Internal Fire PRA Methods - High Estimate T.S. 3.8.4 Condition C Scenario

Enclosure APS Response to RAI for Risk-Informed Completion Times Introduction On July 31, 2015, as supplemented by letter dated November 3, 2017, Arizona Public Service Company (APS) submitted a license amendment request (LAR) to modify the Palo Verde Nuclear Generating Station (PVNGS) Technical Specification (TS) requirements to permit the use of Risk-Informed Completion Times (RICT) in accordance with Risk-Informed Technical Specification Task Force (RITSTF)

Initiative 4b [Agencywide Documents Access and Management System (ADAMS)

Nos. ML15218A300 and ML17307A188].

During the week of February 20, 2018, the NRC staff conducted an audit at PVNGS to gain an understanding of the risk-informed completion time program at PVNGS and to review the probabilistic risk assessment (PRA) model that will be used by APS for this risk-informed LAR. The NRC staff determined that additional information is required in order to complete their review, ADAMS No.

ML18094B112, and a clarifying phone call was held with APS to discuss the information needed. The NRC questions and the APS responses to the request for additional information (RAI) questions are provided. The APS response is provided after each RAI.

Request for Additional Information (RAI) 1 APLA - Internal Events PRA Findings and Observations Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-informed Activities, Revision 2 (ADAMS Accession No. ML090410014), provides guidance for addressing PRA acceptability including addressing the need for the PRA model to represent the as-designed or as-built, as-operated plant; identifying permanent plant changes that have an impact on those things modeled in the PRA but have not been incorporated in the baseline PRA model; documenting that the parts of the PRA required to produce the results used in the decision are performed consistently with the standard as endorsed in the appendices of RG 1.200; a summary of the risk assessment methodology used to assess the risk of the application, including how the base PRA model was modified to appropriately model the risk impact of the application and results; identifying the key assumptions and approximations relevant to the results used in the decision-making process; a discussion of the resolution of the peer review (or self-assessment, for peer reviews performed using the criteria in Nuclear Energy Institute (NEI) 00-02) findings and observations (F&O) that are applicable to the parts of the PRA required for the application; and, documenting the use of the parts of the PRA that conform to capability categories or grades lower than deemed required for the given application. Based on its review, the staff needs additional information to complete its review concerning the resolution of the peer F&O applicable to this application. Please provide the following:

Page 1 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

a. Internal events PRA (IEPRA) F&O AS-03 in LAR dated November 3, 2017 (hereafter called as LAR) Attachment 6 asks about the rationale for why the plant response to small loss-of-coolant accidents (LOCAs) and induced small LOCAs were modelled differently. The disposition to the F&O states that the finding has been resolved and closed by an update of the PRA model and documentation. Please explain and justify why the plant responses are different for these LOCAs and describe the update of the PRA model that was made to resolve the F&O. Please confirm that the success criteria for the plant responses to these LOCAs have received appropriate reviews and are documented.

b. The disposition to F&O IE-07 in LAR Supplement Attachment 6, Table A6-1 states that leakage, spurious operation, and catastrophic failure modes of valves will be considered when addressing the Closure Review Team recommendation. The NRC staff found that common cause failure (CCF) modes of valves is not identified. Please clarify if CCF modes of valves will be considered in the evaluation to close this F&O, consistent with the guidelines in NUREG/CR-5485, Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment, published in November 1998 or provide justification for not considering CCF of valves.

APS Response to RAI 1

a. IEPRA F&O AS-03 questioned the difference in response between induced small LOCAs and the small break LOCAs event tree with respect to containment heat removal. The challenge to containment stems from failure of the pressurizer safety valve (PSV) to reseat. The disposition in the LAR supplement indicated the recommendation would be assessed by performing a Modular Accident Analysis Program (MAAP) analyses and updating the small LOCA event tree modeling if determined necessary for long-term stable end-state. The additional MAAP sensitivity cases have been subsequently performed to demonstrate that a single stuck open PSV (equivalent to a 2.3 inch diameter small break LOCA) with successful steam generator heat removal does not challenge containment pressure. Without successful steam generator heat removal, the event trees for both induced and small break LOCAs lead to core damage prior to containment failure. No model updates are required to the IEPRA for F&O AS-03, however documentation updates are in progress to provide additional clarification and closure will be resolved in accordance with Attachment 1.

b. The interfacing system loss of coolant accident (ISLOCA) documentation is currently being updated to address F&O IE-07. Common cause failure modes of valves will be considered consistent with the recommendations of WCAP-17154-P, ISLOCA Risk Model, Revision 0. That is, common cause is evaluated for active CCFs (for the initiating event portion) and all CCF modes (for the mitigation portion) for analyzed flow paths unless there are significant differences in exposure conditions for the components. Common cause is Page 2 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times addressed at PVNGS utilizing the Alpha Factor model as described in NUREG/CR-5485, Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment, published in November 1998. The resolution of this F&O will be resolved in accordance with Attachment 1.

Page 3 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 2 APLA - Internal Flooding

a. LAR Attachment 13 Table A13-1 explains that because no procedures exist for how to isolate a flooding event associated with the safety injection or chemical and volume control system piping it was conservatively assumed that operators would isolate the leak at the least advantageous point (i.e.,

which results in loss of one train of emergency core cooling system). The explanation then concludes that the impact of this assumption on the RICT program is insignificant.

It is unclear to the NRC Staff whether the internal flood PRA (IFPRA) adequately considers the risk associated with this event because there are no proceduralized operator actions. In addition, if operator action is to isolate as described, it has not been demonstrated that this flood event may not be a significant risk contributor given the plant configuration at the time of the postulated flood event. Please provide adequate technical justification for the conclusion that this would not have a significant impact on the RICT program, or discuss how proper operator actions will be addressed in the IFPRA model and the RICT evaluations.

b. LAR Attachment 13, Table A13-1 explains that floods are assumed to fail all equipment in the initiating room and then propagate out of the room to surrounding flood areas; except for cases in which equipment was sufficiently high or flood barriers are not expected to retain water to sufficient flood levels are treated on an individual basis. Though the explanation concludes that this assumption would not have a significant impact on the RICT program, the discussion states that the top cutsets are not impacted, however if very specific isolation actions were taken this assumption could be significant. Please explain whether these isolation actions are modeled in the IFPRA, or explain why they are excluded. Please confirm that supporting flood analyses for these potentially significant actions are reviewed and documented.

c. Attachment 13, Table A13-1, states:

The flood [human reliability analysis] HRA dependency analysis did not include large early release specific [human failure events] HFEs.

HFEs specific to large early releases (i.e., post-core damage operator actions) are generally performed several hours after the initiating event occurs. No dependency between early and late operator actions.

There is no impact on the model.

Although operator actions may be performed several hours after the initiating event occurs, that does not necessary imply that there is no dependency between early and late operator actions for an internal flood event. Please explain further your conclusion regarding these assumed HRA dependencies.

Page 4 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times APS Response to RAI 2

a. The diagnosis and mitigation for how to isolate a flooding event associated with the safety injection (SI) or chemical and volume control (CH) system piping are considered knowledge-based rather than rule-based. To assess the impact on system, structure, or components (SSCs) and human action failure, a sensitivity case was performed in which each flooding isolation human error probability (HEP) associated with the SI or CH system piping (a total of four) for these flood isolation events were modified from their original HEP of 5E-02 or less to a highly conservative screening value of 1.00. The sensitivity case indicated an increase of 3E-09/year delta core damage frequency (CDF), and an increase of 9E-11/year delta large early release frequency (LERF). The importance contribution of these HRAs for a 30 day out of service condition is considered to be very small and therefore plant configurations are unlikely to impact the RICT calculations.

b. This flooding assumption is a conservative modeling technique that is used to initially fail all equipment within an initiating compartment and if needed, further refinement is applied to dominant cutsets to provide more realistic results. The flood isolation actions for dominant cutsets were developed and proceduralized to mitigate flooding consequences. For example, PVNGS has taken credit for isolating flood events associated with fire protection (FP) and domestic service water (DS) system piping in or near the Engineered Safety Feature (ESF) switchgear room. These isolation actions are modeled in the IFPRA and appear in the top cutsets. Isolating the FP and DS system piping prevents the potential failure of equipment in both ESF switchgear rooms.

Supporting flood analyses for these isolation actions have been reviewed and documented in engineering evaluations and PRA studies. Additionally, operating procedures have been revised for operator success in the diagnosis and mitigation of potential flooding events associated with FP and DS in or near the ESF switchgear room.

c. Figure 2-1 shows the decision tree from the Electric Power Research Institute (EPRI) HRA Calculator utilized to determine HFE dependence. For example, dependency between early and late operator actions for an internal flood event can be represented by the highlighted tree path leading towards zero dependence. The HFEs represents same crew, different common cognitive, at different times, different locations and moderate stress level. All HFE dependency analyses are evaluated in accordance with NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, published in August 1983, and meet all requirements found in the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, (Addendum A to RA-S-2008), as endorsed by RG 1.200, Revision 2.

Page 5 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Same Common SaiM Adaquato Sama High CrM>> Cognlthi* TbiM Rasoureaa LocaUon miNiy 8tfM>>

CD CD HD

' MO LO CD CO 0-15 HD HD 15-30

' MO 30-60 ' MO LO LD

>(60-120)

• 2D LD

• ZD LD

• 20 EPRI HRA Calculator Decision Tree Figure 2-1 Page 6 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 3 APLA - Evaluation of Common Cause Failure for Planned Maintenance NEI 06-09, Revision 0, Risk-informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (ADAMS Accession No. ML063390639), includes guidance that states that CCF adjustment is required for planned maintenance. In a letter dated May 17, 2007 from Jennifer M. Golder, NRC, to Biff Bradley, NEI, (ADAMS Accession No. ML071200238), the NRC provided its safety evaluation for NEI Topical Report NEI 06-09. The NRC staff based its acceptance of NEI 06-09 on RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, August 1998, (ADAMS Accession No. ML003740176). Specifically, SE Section 2.2 states that, specific methods and guidelines acceptable to the NRC staff are also outlined in RG 1.177 for assessing risk-informed TS changes. Further, SE Section 3.2 of the NRC safety evaluation states that compliance with the guidance of RG 1.174, Revision 1, [An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, November 2002, (ADAMS Accession No. ML023240437),] and RG 1.177, for CDF [core damage frequency] and LERF [large early release frequency,] is achieved by evaluation using a comprehensive risk analysis, which assesses the configuration-specific risk by including contributions from human errors and common cause failures.

The guidance in RG 1.177, Section 2.3.3.1, states that, CCF modeling of components is not only dependent on the number of remaining inservice components, but is also dependent on the reason components were removed from service, i.e., whether for preventative or corrective maintenance. In relation to CCF for preventive maintenance, the guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states:

If the component is down because it is being brought down for maintenance, the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of Regulatory Guide 1.177).

According to RG 1.177, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant.

a. Please explain how CCFs are included in the PRA model (e.g., with all combinations in the logic models as different basic events or with identification of multiple basic events in the cut sets);

b. Please explain how the quantification and /or models will be changed when, for example, one train of a 3X100 percent train system is removed for preventative maintenance and describe how the treatment of CCF meets the guidance in RG 1.177 or meets the intent of this guidance when quantifying a RICT.

Page 7 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times APS Response to RAI 3

a. Common cause failure is modeled with basic events for the combinations of components in the respective fault tree. An example is the four motor operated Safety Injection containment sump suction valves (CCF Group 4SI-CC4MV-FO). This group has eleven basic events accounting for the various combinations of components for CCF. For an individual valve fault tree, all CCF combinations with that valve are placed under the gate in the fault tree.

An example with valve 1JSIBUV0675 is provided in Figure 3-1.

Page 8 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Trains Recife Sump Inside Cntmnt Isol Valve Fails to Open-including CCF 4SI-CC4MV-FO-G3 L

1. EOOS# Train B Recirc CCF Of three Sump Inside Cntmnt Isol components:

Valve Fails to Open 4SIAUV673-MV-FO &

4SIAUV674-MV-FO & 4...

4SIBUV675-MV-FO 4SI-CC4MV-FO-123 6.97E-04 A 1.72E-06 CCF of two components: CCF of three 4SIAUV673-MV-FO & components:

4S1BUV675-MV-FO 4SIAUV673-MV-FO &

4SIBUV675-MV-FO & 4...

4SI-CC4MV-FO-13 4SI-CC4MV-FO-134 3.46E-06 4I 1.72E-06 CCF of two components: CCF Of three 4SIAUV674-MV-FO & components:

4SIBUV675-MV-FO 4SIAUV674-MV-FO &

4SIBUV675-MV-FO & 4...

4SI-CC4MV-FO-23 4SI-CC4MV-FO-234 3^ 3.46E-06 4^ 1.72E-06 CCF Of two components: CCF of all components in 4SIBUV675-MV-FO & group *4SI-CC4MV-FO' 4SIBUV676-MV-FO 4SI-CC4MV-FO-34 4SI-CC4MV-FO-ALL 2} 3.46E-06 51 2.49E-05 1JSIBUV0675 Common Cause Modeling Figure 3-1 Page 9 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

b. The RICT software solves the common cause basic events in the fault trees the same as described for the PRA model. For planned maintenance, the RICT software does not adjust the failure probabilities of common cause basic events. For the example of 1JSIBUV0675, the basic event for valve failure (4SIBUV675--MV-FO) is set to 1.0 and the failure probabilities for the common cause basic events are not modified to reflect a reduced number of available components. As a result, the seven common cause basic events involving failure of the component out of service for maintenance remain in the fault tree, and the 11 common cause basic events may appear in the quantification cutsets. Since preventative maintenance is not being done in response to a CCF, it is appropriate to include the component in the common cause group.

The method of modifying common cause basic events when a component is removed from service would involve setting the common cause basic events associated with that component to zero and re-calculating the remaining common cause basic event failure probabilities using common cause factors based on the reduced group size. Only three common cause basic events would remain in the fault trees for the other three valves in the group. Four different common cause basic events may appear in the quantification cutsets. As stated above, APS is not proposing to modify the common cause factors for planned maintenance.

A comparison of the methods using the PVNGS RICT software (Phoenix Risk Monitor) was performed to observe the impact on CDF/LERF results.

The first scenario assessed is the example of 1JSIBUV0675 being removed from service for preventative maintenance. Adjustment of the remaining common cause basic events for a group of three generates a change in CDF of 1.9E-9/year when compared to the result from the approach with no adjustments. Adjustment of common cause events generates no change in LERF compared to the result from the approach that implements no adjustments. The impact of the common cause adjustment is a change of six minutes in the calculated 93.2-day RICT before applying the 30-day backstop.

The second scenario assessed is the removal of the Train B Class 1E battery from service for planned maintenance. The safety-related battery belongs to a common cause group of four Class 1E batteries (1PK-CC1BXAFS).

Adjustment of the remaining common cause basic events for a group of three generates a change in CDF of 9.0E-9/year when compared to the result from the approach with no adjustments. Adjustment of common cause events generates no change in LERF when compared to the result from the approach that implements no adjustments. The common cause adjustment resulted in no change in the 3.4-day RICT (less than the round off error for six significant digits).

Page 10 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times For both a long and a short RICT case, the two methods generate CDF/LERF results that are negligibly different, and thus have a negligible impact on the calculated RICT.

Page 11 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 4 APLA - Instrumentation and Controls The proposed TS limiting conditions for operations (LCOs) include one related to instrumentation and controls, specifically engineered safety features actuation system (ESFAS): TS 3.3.6 ESFAS Logic and Manual Trip. PRA technical adequacy attributes are provided in NEI 06-09-A Section 2.3.4 and the guidance provided in RG 1.200. An example of PRA modelling of instrumentation and controls is illustrated by guidance in TSTF-411, Revision 1, Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-15376), and TSTF-418, Revision 2, RPS and ESFAS Test Times and Completion Times (WCAP-14333). Please provide the following information:

a. Please explain how instrumentation is modelled in the PRA. This should include, but not be limited to, the scope of the instrumentation and controls (I&C) equipment (channels, relays, logic, etc.) and associated TS functions for which a RICT would be applied, and PRA modeling of the I&C and functions including how these are modeled in sufficient detail and based on plant-specific data, etc.

b. Please identify any digital instrumentation and/or controls, which are being proposed for equipment in the RICT program. Please indicate if the Units would apply the RICT to digital systems such as Common Q or hybrid (analog and digital). Please discuss how digital or hybrid I&C are modeled in the PRA.

APS Response to RAI 4 APS LAR supplement for RICT dated November 3, 2017, removed TS 3.3.6, ESFAS Logic and Manual Trip LCOs, Condition A, Condition C, and Condition E from the proposed TSs included in RICT. The following responses are for TS 3.3.6 LCO Condition B and Condition D.

a. The following ESFAS signals listed in TS 3.3.6, Table 3.3.6-1, are modeled in the PVNGS PRA.

• Safety Injection Actuation Signal

• Containment Isolation Actuation Signal

• Recirculation Actuation Signal

• Containment Spray Actuation Signal

• Main Steam Isolation Signal

• Auxiliary Feedwater Actuation Signal SG #1

• Auxiliary Feedwater Actuation Signal SG #2 Page 12 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The ESFAS instrumentation is modeled from the instrument sensor down to the relay that actuates the component:

• Local transmitter (four individual channels)

• Common cause miscalibration HRA

• Current/voltage (I/E) Converter in process protection cabinet (four individual channels)

• Bistable comparator card in the plant protection system (PPS) cabinet (four individual channels)

• Bistable relay card in PPS cabinet (for CCF of three out of four relay/contact pairs)*

• Matrix logic channels (for CCF to de-energize six relay/contact pairs connected in series)*

• Initiation relays in PPS cabinet (four individual trip paths)

• Main control board manual initiation hand switches (four individual switches)

• Actuation relays in auxiliary relay cabinet (individual relay for each actuated component)

• Independent failure was not modeled for these components since the probability was significantly less than the common cause contribution (nine decades less for the relay card and eleven decades less for the matrix relays).

Corresponding to TS 3.3.6, ESFAS Logic and Manual Trip LCOs Condition B and Condition D, any of the individual initiation relays, main control board manual initiation hand-switches, and actuation relays may be selected for determining RICT, since they are individually modeled. Similar to other modeled components in the RICT program, their corresponding basic events are set failed in the PRA model for RICT calculation.

Components located outside of the PPS cabinet have failure rates/probabilities based on industry data and components located inside of the PPS cabinet have failure probabilities based on CEN-327A, RPS/ESFAS Extended Test Interval Evaluation, C-E Owners Group, May 1986, as documented in PRA Engineering Study 13-NS-B096, At-Power PRA System Study for the ESF Actuation System, Revision 1.

b. The ESFAS instrumentation as described in the RAI response part 4.a is composed of analog circuitry and does not use any digital instrumentation or controls.

Page 13 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 5 APLA - Configuration Risk Management Program

a. Please describe how the constraints identified in the program (e.g. CCF, Loss of Function, and short CTs) will be addressed. Please describe the process to maintain the accuracy of pre-solved cutsets.

b. Please explain how the configuration risk management program (CRMP) tool will keep track of PRA functional/non-functional status.

APS Response to RAI 5

a. Common cause failures will be handled quantitatively when calculating a RICT or qualitatively through the application of specific risk management actions (RMAs) to mitigate CCFs. The Phoenix Risk Monitor allows the user to adjust the probability of individual basic events. As such, when a component fails, Phoenix Risk Monitor provides the ability to increase the CCF for the remaining in-service components to account for the increased conditional probability of CCF. The basic events associated with each LCO and their updated CCF values will be predetermined by the PVNGS PRA group and placed in PVNGS procedure(s).

Common cause RMAs are another means by which CCF may be addressed.

These RMAs shall target the success of the redundant and/or diverse SSC of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. These RMAs will be documented in PVNGS procedure(s).

The standard RICT back stop time of 30 days is hard coded in the Phoenix Risk Monitor software. Because the software will not track the 24-hour back stop associated with loss of function conditions, PVNGS will have proceduralized administrative controls in place (i.e., action outside of the Phoenix Risk Monitor software) to ensure the loss of function back stop time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is adhered to.

The PVNGS RICT process will be such that each control room will be responsible for maintaining the current plant configuration in the Phoenix Risk Monitor tool. When an emergent condition arises that requires RICT calculation in a short time, the Phoenix Risk Monitor tool can be used to quantify the RICT associated with a given configuration that supports the short time available (quantification of the hazards for a typical configuration completes in approximately 10-15 minutes).

Page 14 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The accuracy of pre-solved cutsets will be maintained via administrative controls associated with the PVNGS software quality assurance program and PVNGS PRA model control. Cutsets will be stored in a controlled network directory that is subject to regular backup per standard PVNGS data protection processes. The cutsets will remain in this directory until the PRA model is updated, and will only be deleted if a PRA model update invalidates previously calculated results.

b. PRA functional/non-functional status is explicitly tracked within the Phoenix Risk Monitor software. For every item added to the out-of-service list, the user can specify whether the item is considered functional/non-functional separate from its 10 CFR 50.65 (a)(4) availability.

Page 15 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 6 APLB - Seismic PRA (SPRA) RG 1.200, Revision 2, PRA Acceptability, NEI 12-13 LAR Attachment 6 states that the categorization process for seismic hazards will use a peer reviewed plant specific Seismic PRA model in accordance with RG 1.200, Revision 2. The NRC staff was unable to determine, which peer review guidance document, NEI 00-02, Probabilistic Risk Assessment Peer Review Process Guidance, NEI 05-04, Process for Performing Follow-On PRA Peer Reviews Using the American Society of Mechanical Engineers (ASME) PRA Standard, or NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, was used. Please indicate, which guidance document was used to perform the SPRA peer review. If the peer review was performed using guidance not described in RG 1.200, Revision 2, such as NEI 12-13, External Hazards PRA Peer Review Process Guidelines (ADAMS Package Accession No. ML122400044), please provide the following additional information to justify the use of NEI 12-13:

a. Please describe how the qualifications of the SPRA peer review team comply with the peer review requirements in ASME/American Nuclear Society (ANS)

RA-Sa-2009, Sections 1-6.2 and 5-3.2, as endorsed in RG 1.200.

b. Please identify any unreviewed analysis methods (UAMs) used in the SPRA, as determined by the peer review team, and describe each UAM with a level of detail appropriate for the NRC staff to evaluate its acceptability.

c. Please describe if the SPRA relies on expert judgement to meet any supporting requirement (SR) and, if so, demonstrate conformance to the expert judgment requirements of ASME/ANS RA-Sa-2009, Section 1-4.3. Also, please cite any information from the peer review report related to the evaluation of the use of expert judgment by the peer review team and whether the peer review team found the use of expert judgment to be appropriate.

d. Please clarify whether the SPRA was reviewed against Capability Category (CC-I) for any SR. Please provide a list of all SRs that were reviewed against CC-I or found to meet only CC-I without an associated finding. For each such SR, please justify why not meeting the SR at CC-II does not impact this application.

e. Please clarify whether an in-process peer review was performed for the SPRA. If an in-process approach was utilized, please confirm that (i) the approach met the requirements for an independent peer review as stated in ASME/ANS RA-Sa-2009 and the process described in NEI 12-13; (ii) a final review by the entire peer review team occurred after the completion of the SPRA; and (iii) peer reviewers remained independent throughout the PRA development activity as discussed in the enclosure to the letter dated November 16, 2012 from Mr. Donald G. Harrison, NRC to Mr. Biff Bradley, NEI (ADAMS Accession No. ML12321A280).

Page 16 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times APS Response to RAI 6 The PVNGS SPRA peer review was performed using the process defined in NEI 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012.

a. The peer review team was made up of five members who were fully qualified to meet the experience expectations of ASME/ANS RA-Sa-2009, Part 5, Section 5-3, Peer Review for Seismic Events At-Power. Each of the peer review team members has extensive knowledge of the technical requirements of the ASME/ANS RA-Sa-2009 Standard in their area of review.

Three of the five team members each have over 20 years of experience in the nuclear power field specializing in probabilistic risk assessment. The remaining two team members each have over 25 years of experience performing seismological investigations, which includes probabilistic seismic hazards, and at least one member completed Seismic Qualification Utility Group (SQUG) walkdown screening and seismic evaluation training. As such, the peer review team fully complies with Section 1-6.2 of ASME/ANS RA-Sa-2009.

Furthermore, the peer review team has the combined experience to meet the requirement of Section 5-3.2 of ASME/ANS RA-Sa-2009. Each member is an expert in their field, as demonstrated by holding manager level positions such as technical leads of PRA development, lead seismic scientist, or principal investigator.

b. There were no SRs classified as UAMs.

c. There was no need for the use of expert judgment outside of the PRA analysis team to meet any SR. There was no need to obtain broader perspectives on any aspect of the development of the SPRA.

d. Two seismic hazard analysis (SHA) SRs (SHA-E1 and SHA-E2) were evaluated as CC-I. Findings were assessed for each SHA-E1-01 and SHA-E2-

01. Therefore, in accordance with the NRC comment, a finding was written for any SR receiving a CC-I. An F&O closure peer review performed in June 2017 reviewed both SHA findings and verified Finding SHA-E1-01 meets CC-II. However, Finding SHA-E2-01 needed additional actions to be considered as meeting CC-II. SHA-E2-01 will be resolved in a subsequent F&O closure peer review prior to implementing the RICT program, as described in Attachment 1.

e. The PVNGS SPRA was peer reviewed all-at-once and was not an in-process approach.

Page 17 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 7 APLB- RG 1.200, Revision 2, PRA Acceptability, FPIE As Basis for SPRA ASME/ANS RA-Sa-2009, Section 5-2.3, Part 5, Requirements for Seismic Events At-Power PRA, assumes that full-scope internal-events at-power Level 1 and Level 2 LERF PRAs exist, and that those PRAs are used as the basis for the SPRA systems analysis. ASME/ANS RA-Sa-2009, High Level Requirement [HLR]-SPR-B calls for the incorporation of seismic analysis aspects that are different from the at-power IEPRA systems model. Therefore, the technical adequacy of the IEPRA model used as the foundation for the SPRA needs to be established.

Please identify IEPRA finding-level F&Os that were not closed in accordance with an NRC-accepted process and any IEPRA upgrades that had not been peer-reviewed prior to the development of the SPRA. For each identified finding-level F&O, please describe the resolution and the impact of the F&O on the SPRA as it pertains to this application.

APS Response to RAI 7 The SPRA peer review, conducted on December 2012, judged SR SPR-B1 as not met and is described by Finding SPR-B1-01. The basis for this finding is a self-assessment of the IEPRA (Engineering Evaluation 3579223) performed in March 2011 which identified open findings following a 1999 peer review of the internal events model. The self-assessment identified four SRs as not met to CC-II: IE-A8, SY-A4, SY-C1, and SY-C2. Internal events plant walkdowns, interviews, and documentation have since been performed. The F&O closure review, conducted in June 2017, included review of the issues associated with the four not met SRs from the self-assessment (page A-34 of the F&O closure review report). Therefore, SPR-B1 was evaluated as closed based on the closure of the internal events findings closure.

There are three IEPRA upgrades that were subsequently identified for a focused scope peer review: Common cause methodology change (Multiple Greek Letter Method to Alpha Factor Method), HRA methodology change [Systematic Human Action Reliability Procedure (SHARP) model to the EPRI HRA Calculator Software],

and PRA Impact 2003-301 that incorporated new modeling for pressure-induced steam generator tube rupture using CE NPSD-1124, Methodology for Modeling Main Steam Line Breaks, Revision 0. These upgrades were not previously determined to be upgrades since they were already included in the internal flood, internal fire, and seismic PRA models at the time of those peer reviews. A focused scope peer review will be conducted as described in Attachment 1.

Page 18 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 8 EMIB - [SPRA] RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review In LAR Attachment 6, the finding for F&O SFR-F3-01 included a recommendation to justify the use the Best Estimate (BE) In-Structure Response Spectra (ISRS) as the median. The recommendation further states that the soil-structure interaction analysis using BE soil properties, BE structure stiffness and a conservative estimate of BE structure damping results in a 84th percentile response. This recommendation indicates to the NRC staff that the ISRS input may not be correct.

Please discuss your plans to address this recommendation including how your plans to close this finding through a peer review or through the NRC accepted F&O closure process prior to implementing the RICT Program.

APS Response to RAI 8 Finding SFR-F3-01 has been addressed by a Westinghouse Electric Company seismic team per the recommendation provided by the F&O closure panel.

Subsequently, the completed resolutions will be evaluated in accordance with .

The technical rationale in response to the recommendation of the closure team captured in the F&O closure process is summarized as follows:

a) Use of conservative estimate of median damping: The BE ISRS were judged to be appropriate as the median input to fragility analysis because the building response is dominated by low-frequency soil-structure modes. For these modes, the control building (CB) structural distortion is low compared to the rigid body motion resulting from soil compliance. As a result, seismic demand is not sensitive to structural damping. This is further justified by sensitivities demonstrating that applying higher levels of structural damping does not have a significant impact on response due to the relatively large amounts of soil damping due to the embedded structures on deep soil columns.

b) Use of BE properties (soil + structure) instead of averaging lower bound (LB),

BE, and upper bound (UB) properties for median demand: The approach taken is appropriate for the SPRA specifically at PVNGS due to the stability of soil-structure interactions (SSI) results obtained. Soil stiffness variability, which at PVNGS dominates overall variability in response over structural stiffness variability, was determined by varying shear modulus by Cv per American Society of Civil Engineers (ASCE) 4-98, Seismic Analysis of Safety-related Nuclear Structures. Response analyses varying soil properties with BE structural stiffness and conservative median damping were run for one set of artificial time histories [with variability due to time history generation accounted for in the separation of variables (SOV) calculation]. The resulting SSI response analyses were reviewed and determined to be stable and Page 19 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times without considerable deficiencies to conclude that the BE soil property run appropriately represented the best estimate of median demand.

While an increasing number of recent SPRA response analyses may average LB, BE, and UB properties, this may be indicative of more complex response analyses with probabilistic soil uncertainty evaluation and five sets of time histories. The resulting SSI response may not be stable and averaging may be appropriate for median demand. It is noted that neither EPRI 103959, Methodology for Developing Seismic Fragilities, June 1994, EPRI NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin, Revision 1, nor EPRI 1019200, Seismic Fragility Applications Guide Update, December 2009, stipulate the use of response averaging to obtain median demand.

By evaluating the PVNGS response to F&O SFR-F3-01 as summarized above through a second F&O closure process prior to RICT implementation, as described in Attachment 1, PVNGS will demonstrate that the ISRS derived from SSI analysis are appropriate for median-centered response.

Page 20 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 9 APLB - RG 1.200, Revision 2, PRA Acceptability, F&Os Not Resolved by Closure Review In LAR Attachment 6, the finding for F&O SHA-E2-01 included a recommendation to demonstrate that the updated set of soil peak ground acceleration (PGA) hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil PGA hazard curves used in the seismic PGA model. If the updated set of soil PGA hazard curves is greater than those used in the seismic PRA model, the impact on seismic risk quantification should be assessed.

Please discuss your plans to address this recommendation including how your plans to close this finding through a peer review or through the NRC accepted F&O closure process prior to implementing the RICT Program.

APS Response to RAI 9 Finding SHA-E2-01 is currently being addressed per the recommendation provided by the F&O closure review team. Subsequently, the completed resolutions will be resolved in accordance with Attachment 1.

A quantitative evaluation of new seismic hazard data will be performed. In addition, fragility data for plant structures, systems and components will be adjusted for the new uniform hazard response spectra.

A scaling analysis will be performed to estimate the new fragility data. The method of analysis will be similar to that reported in EPRI Report NP-6041-SL, A Methodology for Assessment of Nuclear Plant Seismic Margin, Revision 1.

To support a full re-quantification of the SPRA, the hazard developed for the Near Term Task Force 2.1 in 2015 will be post-processed to extract the needed uncertainty information. The 2015 seismic hazard will be post-processed to obtain a suite of approximately 100 discrete total mean hazard curves. In addition, the seismic hazard will be post-processed to obtain the following fractiles of total mean hazard: 0.05, 0.16, 0.50, 0.84, and 0.95. Fractiles will be computed independent of each amplitude of PGA.

The updated fragility values and the 2015 hazard will be used for a quantification of the base case SPRA CDF and LERF for Unit 1. The quantification will be documented in the updated seismic PRA quantification notebook, CN-RAM-12-22, Palo Verde Seismic Probabilistic Risk Assessment - Quantification.

Page 21 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 10 APLA - RG 1.200, Revision 2, PRA Acceptability, PRA Upgrades Identified in F&O Closure Review Report LAR Attachment 6 states that all PRA upgrades (as defined by the ASME PRA Standard RA-Sa-2009) implemented since conduct of the Combustion Engineering Owners Group (CEOG) peer review in 1999 have been peer reviewed. The LAR indicated that one full-scope peer review was performed on the IEPRA model in July 1999, IFPRA (2010), SPRA (2013), FPRA (2012 and 2014). Please provide the following additional information to enable the NRC staff to evaluate whether the guidance provided in RG 1.200, Revision 2, regarding PRA upgrades was followed:

a. Please describe the changes made to the IEPRA since the full-scope peer review was conducted in 1999, including any changes that would impact the modeling framework for the PRA, such as converting the PRA to a one-top fault tree across all the PRA hazards. Provide the dates for when each change occurred. This description should be of sufficient detail for the NRC to determine whether the changes are considered PRA maintenance or PRA upgrades as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2. Include in your discussion: (1) any new methodologies (i.e., summarize the original method in the PRA and the new method); (2) changes in scope that impact the significant accident sequences or the significant accident progression sequences; (3) changes in capability that impact the significant accident sequences or the significant accident progression sequences.

b. For each change described in Part a. above, please indicate whether the determination for the change was PRA maintenance or a PRA upgrade as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG 1.200, Revision 2, along with justification for the determination.

c. Please discuss any focused-scope (or full-scope) peer reviews that have been performed for the PRA upgrades identified in Part b above, providing the timeline of when the peer reviews were performed and when the peer review reports were approved. For each upgrade identified, either:

i. Please provide the findings of the peer review(s) performed on the upgrade and the disposition of the findings as it pertains to the impact on the 10 CFR 50.69 application. OR, ii. Please confirm that the resulting F&Os from the peer review(s) on the upgrade were assessed in the F&O closure review in June 2017.

d. Please describe the changes that have been made to the IFPRA, SPRA, and FPRA since their respective peer reviews on November 2010, February 2013, December 2012 and December 2014. Provide information commensurate with that requested for the IEPRA in parts (a), (b), and (c), which indicates and justifies the determination of whether the changes were maintenance or an upgrade and, if an upgrade, provides information to support a technical acceptability determination.

Page 22 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times APS Response to RAI 10 As requested, changes made to the PVNGS IEPRA, IFPRA, SPRA, internal FPRA, and external events PRA since their respective peer reviews have been identified, documented, classified and justified as PRA maintenance or PRA upgrade.

a. Changes made to the PVNGS IEPRA model since the 1999 IEPRA peer review have been collected and documented in engineering evaluation 18-00619-003. This evaluation provides details of the PRA model changes captured in the PRA impact database and F&O resolution reports along with the date each change occurred. See Attachment 2, Table 2-1, for a listing of the significant changes made to the PVNGS IEPRA model.

b. As documented in engineering evaluation 18-00619-003, each PRA model change was reviewed against the PRA maintenance or PRA upgrade definitions provided in ASME/ANS RA-Sa-2009 with consideration of the qualifications and clarifications provided in RG 1.200, Revision 2. See Attachment 2, Table 2-1, for a listing of the significant changes made to the PVNGS IEPRA model along with their classification and associated basis.

Justifications for the assessment of a change being a PRA upgrade included new methodologies, changes in scope impacting significant accident sequences or the significant accident progression sequences or changes in capability impacting significant accident sequences or the significant accident progression sequences. Justifications for determining changes as PRA maintenance included specific reference to sections and PRA maintenance examples provided in ASME/ANS PRA Standard Non-mandatory Appendix 1-A.

The majority of the changes were assessed to be PRA maintenance activities.

This included the conversion of the Risk Spectrum PRA model to CAFTA and development of the one-top logic fault tree. With respect to the CAFTA software conversion, ASME Standard RA-Sa-2009 Appendix 1-A, Section 1-A.3, Classification of PRA Changes, Example 11 states that changing from fault tree linking code to another for quantification of sequences is classified as PRA maintenance. All the items listed in the rationale provided for Example 11 being considered maintenance are met for the conversion from Risk Spectrum to CAFTA. Both codes use the same linked fault tree codes and are both well accepted in the PRA community. The conversion of the PVNGS IEPRA model is well documented and includes disposition of code differences. In addition, in-depth reviews of cutsets from both codes were performed, as well as review of truncation, recoveries, importance, and resolution of modeling differences. The documented review also included comparison of results with various plant configurations of significant components out of service. Therefore, this change was determined to be PRA maintenance. Likewise, the one-top logic fault tree developed for the RICT application is also considered maintenance. Each hazard model placed under the single top fault tree has been peer reviewed against RG 1.200, Revision Page 23 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

2. The top gate of the fault tree acts as a simple OR gate allowing solution of individual hazards by solving a lower gate or all hazards together by solving the top gate. The same peer-reviewed fault tree modeling methodology is used. The same basic events are used with appropriate overrides for hazard-specific operator actions. Resulting cutsets from the combined hazard model were compared to the individual hazard models and documented as part of the software quality assurance data qualification process for the Phoenix software. For these reasons, this change was determined to be PRA maintenance as well.

Attachment 2, Table 2-3, provides those IEPRA changes that were determined to be PRA upgrades.

c. Attachment 2, Table 2-4, provides the IEPRA upgrades identified in Part (b) above. For each upgrade, the specific peer review evaluating the upgrade, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings) are provided. It is noted that if an identified upgrade has not undergone a peer review, it will be included in the focused scope peer review planned to be conducted as described in Attachment 1.

d. As documented in engineering evaluation 18-00619-003, the same process described in Parts (a) and (b) above was applied to the changes made to the IFPRA, SPRA, internal FPRA, and External Hazards PRA since their respective peer reviews. Attachment 2, Table 2-5, provides those changes that were determined to be PRA upgrades. See Attachment 2, Table 2-2, for a listing of the significant changes made to the PVNGS internal flooding, seismic, and internal fire PRA models.

Attachment 2, Table 2-6, provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings). It is noted that if an identified upgrade has not undergone a peer review, it will be included in the focused scope and augmented F&O closure peer review which will be completed as described in Attachment 1.

As noted in Attachment 2, Table 2-6, a number of findings resulted from the review of the identified upgrades. New F&Os QLS-A1-01 [14FS], PRM-A3-01

[14FS], and FSS-D2-01 [14FS] were received. Of these, only one, FSS-D2-01

[14FS], was included in the 2017 F&O closure review which determined that this F&O was closed and SR FSS-D2 was met. The remaining findings will be verified closed and the internal FPRA SRs CS-C4 and ES-B3 will be reviewed by an augmented F&O closure review as described in Attachment 1.

Therefore, the disposition of these F&Os for internal fire and seismic PRA models will have no impact on the Initiative 4b application.

Page 24 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times In summary, after reviewing all changes made to the PRA models, APS has identified the following four PRA model upgrades that will be reviewed in an upcoming focused scope peer review:

• The common cause methodology was changed from the MGL method to the Alpha Factor method

• The HRA methodology was changed from the SHARP model to the EPRI HRA Calculator software

• PRA Impact 2003-301 incorporated new modeling for pressure-induced SGTR using CE NPSD-1124, Methodology for Modeling Main Steam Line Breaks, Revision 0

• PRA Impact 2013-151 updated the IFPRA model resulting in a significant impact on the results The resolutions to any existing open F&O findings and any new F&O findings resulting from the upcoming focused scope peer review of upgrades will be resolved prior to implementation of the RITS 4b application, as described in Attachment 1.

Page 25 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 11 APLA - F&O Closure In a letter dated May 3, 2017, the NRC staff transmitted its review results of Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) (ADAMS Accession No. ML17079A427). Based on the NRC staff review, the NRC found the process proposed by Appendix X acceptable, with conditions as specified in the letter, for use by licensees to close F&Os that were generated during a peer review process.

LAR Supplement Attachment 6 states that the F&O closure process was used for the F&Os associated with Internal Events, Internal Flood, Fire, and Seismic PRA models.

The NRC staff has identified three primary issues based on recent observations of industrys implementation of the closure process: 1) closure with respect to Capability Category CC-II for the SR; 2) written justification of basis for why closure is determined to be maintenance or upgrade; and 3) independence of reviewers.

Please summarize how the June 2017 F&O closure process fulfilled each of the guidelines below.

a. The documented licensee justification and associated F&O closure team assessment about whether each F&O finding resolution constitutes a PRA upgrade or maintenance update, as defined in ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2.

b. The review teams summary rationale for determining the adequacy for closure of each finding in relation to the affected portions of the associated SR for every SR and weakness identified in the F&O.

c. The description of remote reviewers participation (if used) confirming web and teleconference connection between any remote reviewers and the on-site review team and host utility to support full participation of the remote reviewers.

d. The confirmation that every weakness in each F&O has been addressed, that a closed finding has been achieved (for applicable F&Os), and that the documentation has been formally incorporated in the PRA Model of Record before closure in the final F&O closure report.

APS Response to RAI 11 APS will perform an F&O closure review to document how these guidelines were met, as described in Attachment 1.

Page 26 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 12 APLA - RG 1.200, Revision 2, PRA Acceptability, Key Assumptions and Key Sources of Uncertainty RG 1.200, Revision 2, Section 3.3.2, states for each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application. Further, RG 1.200, Revision 2, Section 4.2 states that these assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. RG 1.200, Revision 2, Section 3.3.2, defines the terms key assumption and key source of uncertainty.

LAR Attachment 13 states that the list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk. If the PVNGS model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on RICT Program calculations. Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.

a. Please describe the approach used to identify and characterize the key assumptions and key sources of uncertainty in the SPRA for this application. Discuss (1) whether all assumptions and sources of uncertainty related to all aspects of the models (e.g., hazard, fragility, and plant response analysis for the SPRA) were evaluated to determine whether they were key; and (2) the criteria that were used to determine whether the modeling assumptions and sources of uncertainty were considered key.

b. Please describe each key assumption and key source of uncertainty identified in the SPRA. Provide this in sufficient detail to enable the NRC staff to identify whether the key assumptions used in the SPRA involve any changes to consensus approaches.

c. Please discuss how each key assumption and key source of uncertainty identified above was dispositioned for this application. If available, provide the results of any sensitivity studies that will be used to support the disposition for this application or use a qualitative discussion to justify why different reasonable alternative assumptions would not affect this application.

Page 27 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times APS Response to RAI 12

a. The assumptions and sources of uncertainty related to all aspects of the models were reviewed to determine whether they were key. Those that were determined to be key met the following criteria in NRC RG 1.174, Revision 2:

when it could impact the PRA results that are being used in a decision, and consequently, may influence the decision being made.

Sources of model uncertainty and assumptions have been identified using the guidance of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making.

Methods used in the development of the different elements of PVNGS SPRA (i.e., hazard, fragility, and plant response modeling) are documented and summarized in the relevant documentation and follow established methods used in multiple SPRAs in the industry. No specific deviations have been made from these established methods, which can be considered consensus methods in the industry.

1. The hazard assessment addresses assumptions and associated uncertainties explicitly in the Senior Seismic Hazard Analysis Committee (SSHAC) process and in the resulting probabilistic seismic hazard analysis (PSHA) calculation. Epistemic uncertainties are therefore quantitatively translated in the spread of a full family of hazard curves with associated weight factors (96 individual hazard curves have been developed from the entire PSHA decision tree). No specific assumption has been identified in the hazard assessment that required a specific sensitivity in the final quantification of the SPRA.

The final quantification of the SPRA used all the 96 curves for the final SPRA uncertainty assessment for both CDF and LERF. The technique used for the uncertainty propagation in the PVNGS SPRA allowed for a decomposition of the uncertainties between hazard, fragility and system modeling.

2. In the final quantification of the SPRA, two sensitivities were run to address importance of fragility related modeling assumptions, one addressing the fragility of the non-safety auxiliary feedwater N (AFN) pump, and one addressing the impact of surrogate fragilities. In both cases, the model showed little sensitivity to these modeling assumptions.

3. The plant response analysis including seismic modifications to the HRA follows established methods, mainly documented in the EPRI SPRA implementation guidance or the EPRI SPRA Surry report. Key assumptions associated with the modeling of the plant response are identified during the development of the analysis and are then summarized and documented in Section 4.4 of the SPRA modeling Page 28 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times notebook (i.e., CN-RAM-12-015, Palo Verde Seismic Probabilistic Risk Assessment - Model Development, Revision 1) and in Section 4.4 of the Seismic HRA notebook (i.e., CN-RAM-12-024, Palo Verde Seismic PRA - Human Reliability Analysis, Revision 2). Those assumptions are then re-addressed for their potential modeling uncertainties and ad-hoc sensitivities are performed when suitable modeling alternatives are available.

b. The following major assumptions are adopted in the development of the PVNGS SPRA and are consistent with the general guidance discussed in the above mentioned established methods:

1. During the SPRA analysis, major assumptions associated with success criteria (at a system and sequence basis) are reviewed to identify potential inconsistencies with a seismically induced accident.

If not otherwise specified, the success criteria associated with the internal events PRA logic are considered valid and applicable to accident sequences initiated by a seismic event. This assumption implies that all the success criteria runs performed in support of the internal events accident sequences are applicable and are not replicated for the SPRA. A significant limitation of this assumption concerns the potentially different mission time of the SPRA, compared with an internal event PRA. Explicit discussion on this topic is presented in Section 5.1 of the modeling notebook (CN-RAM 015) and a dedicated sensitivity case is performed to address the epistemic uncertainties associated with this assumption in the quantification notebook (CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1). This reflects an industry consensus approach for SPRAs.

2. Seismic failures are assumed to be completely correlated. This assumption implies that a single basic event is used to model the seismic failure of components that are identified as pertaining to the same fragility group by the fragility team. The validity of the assumption of complete correlation is still being discussed at the industry level. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

One significant exception to this general assumption is where failures in the steam path in the turbine building are not considered correlated with failures of the feedwater lines. Since a variety of components in multiple locations and elevations in the turbine building are potentially involved in seismically induced failures of main feedwater lines and the steam path, with a variety of boundary and anchorage conditions, the main feedwater piping and steam line break fragility events are not correlated.

Page 29 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

3. The seismically induced loss of offsite power (LOOP) is assumed to bound the fragility of non-seismic class systems. This assumption implies that a number of non-seismic class systems are not addressed with a specific seismic failure. The basis for this assumption is that seismically induced LOOP has a generally low seismic capacity. Scenarios where the non-seismic support systems incur seismically induced failures while offsite power is still available are considered realistic only for very low magnitude seismic events.

Some exceptions include the instrument air (IA) system and the station blackout generator (SBOG), for which system specific fragility considerations are made. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. This reflects an industry consensus approach for SPRAs.

4. The PVNGS internal events PRA credits recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after a LOOP. In the PVNGS SPRA, LOOP recovery is not credited for any seismic event above the safe shutdown earthquake (SSE), while it is credited with unchanged probability for a seismic event below the SSE. This assumption is based on the consideration that it is realistic to consider that offsite power recovery is available for low magnitude seismic events. As the magnitude of a seismic event increases, the recovery time is expected to increase (i.e., probability of recovery within 1 or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> decreases). The potential to recover is lost for longer time frames (potentially over 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) for larger magnitude events. The selection of the SSE as a threshold between recovery/no-recovery of offsite power is arbitrary.

5. Screening of equipment in the Seismic Equipment List (SEL) is based on fragility analysis. Equipment screened by the fragility team as inherently rugged is not modeled in the SPRA for their seismic induced failure. In order to quantitatively capture the impact of screened out equipment, the fragility team provided generic fragility values for screened out equipment on a location basis (i.e., fragility parameters based on building). The screened equipment is then not explicitly modeled but rather modeled through surrogate basic events at a system level that address seismic induced failure of a system due to a combination of seismic failures of equipment within the system. A sensitivity case is explicitly discussed to address the impact of this modeling approach.

6. It is assumed that the operators will always trip the reactor in case of a seismic event above the operating basis earthquake (OBE) even if plant procedures allow for the option of a controlled shutdown. This is considered a conservative assumption although it is not expected to have significant impact on the overall risk profile of the plant.

Page 30 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

7. Assumption #4 in Section 6 of the fragility analysis report (11C4043-RPT-003, Seismic Fragility Analysis of PVNGS Unit 1 Structures, Systems and Components, Revision 1) states that the AFN pump is assumed to remain functional with small leaks in instrumentation lines. The listed AFN pump fragility does not include instrumentation line failure as the fragility analysis did not address the entire flow path for the AFN pump. Nevertheless, tubing to flow transmitters was found to be vulnerable to seismic motion and interaction. A tube break could not be ruled out and is a potential low capacity failure mode (small break leak). Following the recommendation of the fragility analysis report (11C4043-RPT-003, Revision 1), the uncertainty associated with this assumption is addressed through a sensitivity case in the quantification notebook (CN-RAM-12-022) that changes the fragility parameters of the AFN pump into the same fragility values used for the system level fragility for the IA system.

8. Main steam line safety valves have not been explicitly included in the SEL but are nevertheless screened out by the analysis on the basis that the steam generator and related piping and valves are normally considered very rugged. For this reason the seismic failure of the safety valve is not modeled (this assumption has been supported by discussion with the fragility team). A sensitivity case is developed to assess the impact of this assumption. In the sensitivity case, a fully dependent seismic failure across all 20 relief valves is modeled with a fragility data set given per the screened out equipment in the main steam support structure (MSSS) (11C4043-RPT-003, Revision 1).

9. Structural failures of buildings are assumed to result in major collapse and failure of all equipment hosted inside the building [e.g.,

structural failure of containment will result in failure of reactor coolant system (RCS) lines, structural failure of auxiliary building will result in failure of all pumps and valves, in the structure, structural failure of the MSSS will result in failure of all pumps and valves in the structure and structural failure of the control building will result in failure of all cabinets, etc.]. This is a conservative assumption since the fragility parameters provided are addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The level of detail in the fragility analysis of the building does not allow for crediting partial failure and therefore all equipment in the building is assumed lost. A similar consideration is made for the soil failure underneath the buildings.

Page 31 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The most significant example of this assumption is the structural failure of the turbine building assumed to be also impacting and failing the condensate storage tank (CST) tunnel.

There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA. A more refined fragility analysis of the structures can be done to reduce this conservatism, although this is currently not within the scope of the analysis.

10. The anticipated transient without scram (ATWS) logic for SPRA assumes that the RCS pressure will be above the high pressure safety injection (HPSI) shutoff head for only a short period of time.

In this case, injection following the pressure decrease is expected to be sufficient to provide inventory and boron. The assumption is needed because all ATWS event trees show that, given success of steam generator (SG) heat removal and failure of the PSV to reseat, high pressure injection and high pressure recirculation is sufficient to terminate the transient successfully. However, depending on the moderator temperature coefficient (MTC) and other parameters, the RCS pressure may exceed the HPSI pump shutoff head for a sufficient period of time to lead to core damage before the pressure drops below the shutoff head. This is expected to be the case for a short period of time early in core life (i.e., the success criteria for injection cannot be met because the RCS pressure will be well above the shutoff head for the HPSI pumps). If the high pressure endures long enough, core damage is guaranteed and vessel failure will occur at high pressure. MTC and ATWS pressure transient are not influenced by the fact that the event is initiated by a seismic event rather than a spurious failure and therefore the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. This is a specific case of the more generic assumption b.1. of this response. There is no specific sensitivity analysis that addresses the epistemic uncertainty associated with this assumption in the PVNGS SPRA.

11. Accessibility for completion of non-screened HFE actions during a seismic event is assumed possible for all non-screened HFEs except those which are assumed to fail in the case where the corridor building or turbine building (east) collapses (i.e., CN-RAM-12-024).

Non-accessibility to equipment in the field would result in the associated HEP being set to 1.0; a sensitivity case is developed in the quantification notebook (CN-RAM-12-022) that sets all the HEP to 1.0. Such a sensitivity case is used to address the impact of this assumption on the PVNGS SPRA model.

Page 32 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

12. In the consideration of seismic-induced floods, it is assumed that the seismic performance shaping factors (PSFs) applied to the internal events HEPs will over-ride the flooding PSFs, based on the consideration that the seismic events are more global events than the specific flooding events (i.e., CN-RAM-12-024). There are no specific sensitivity cases that have been designed in the quantification notebook (CN-RAM-12-022) that address the epistemic uncertainty of this assumption.

13. The SPRA dependency analysis assumes that once an accident sequence is initiated, the operator action timing for a seismically induced event is similar to that of an internally induced event for main control room actions. The combinations are qualitatively assessed to ensure sufficient time is available to account for operators potentially requiring extra time to navigate through the plant following a seismic event. The modification of the timing available due to seismic considerations may result in a longer response or identification time and consequentially a higher HEP. A specific sensitivity analysis on this has not been defined; the sensitivity analysis which sets HEPs to 1.0 (see assumption b.11. of this response) is bounding but it does not reflect an increase to specific individual HEPs which reflect timing available changes due to seismic considerations.

14. The weighting factors applied to the three approaches, specified in Section 4.3.2.4 of the Seismic HRA notebook (i.e., CN-RAM-12-024),

assume Surry to be the most accepted and applicable approach due to Surry being the most recent approach of the three implemented in this analysis. A specific sensitivity analysis that adjusts the weighting factors applied to the three approaches is documented in the quantification notebook (CN-RAM-12-022).

c. Each key assumption and key source of uncertainty identified above was dispositioned for this application in Table A13-1, Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations, in ADAMS Accession Number ML17307A188, APS LAR to Revise TS to Adopt TSTF-505A, Revision 1, Risk-Informed Completion Times, dated November 3, 2017.

Page 33 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 13 APLA - PRA Peer Reviews Please describe the peer reviews performed for the IEPRA, IFPRA, SPRA, and internal FPRA. Please confirm that these peer reviews were full-scope reviews meeting industry guidance for a peer review and were reviewed against capability category II (CC-II). In addition, please discuss which organization performed the review, and list the guidance documents followed for each review.

APS Response to RAI 13 Internal Events PRA A full-scope IEPRA peer review was conducted by a diverse industry team, none of whom were involved in development of the PRA model, led by Asea Brown Boveri Combustion Engineering Nuclear Operations (ABB CENO) PRA practitioner in September of 1999. The peer review team included experienced PRA practitioners from the following organizations:

• ABB Combustion Engineering Nuclear Operations

• Consumer Energy

• Northeast Utilities

• Baltimore Gas and Electric

• Institute of Nuclear Power Operation (INPO)

The review was conducted in accordance with:

• BWROG-97026, Transmittal of BWR Owners Group Document, PSA Peer Review Certification Implementation Guidelines, Boiling Water Reactor Owners Group, January 31, 1997 The full scope internal events PRA peer review is documented in Palo Verde Nuclear Generating Station Units 1, 2 and 3, Probabilistic Safety Assessment Peer Review Report, November 1999.

A follow-up self-assessment of the IEPRA (Engineering Evaluation 3579223, Revision 1) was performed by experienced APS PRA engineers in March 2011 against all requirements in ASME/ANS RA-Sa-2009 and NRC clarifications in RG 1.200, Revision 2, Appendix A, reviewing APS responses to all outstanding finding level F&Os generated by previous peer reviews. The review was conducted in accordance with:

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers and the American Nuclear Society, New York, NY, February 2009

• Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, USNRC, March 2009 Page 34 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Internal Flooding PRA A full scope IFPRA peer review was conducted by a diverse industry team, none of whom were involved in development of the PRA model, led by a Westinghouse Electric Company, LLC, PRA practitioner in October 2010. The peer review team included experienced PRA practitioners from Westinghouse Electric Company.

The review was conducted in accordance with:

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers and the American Nuclear Society, New York, NY, February 2009

• Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, USNRC, March 2009

• NEI 05-04, Revision 2, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Nuclear Energy Institute, November 2008

• NEI 00-02, Revision 3A, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, March 2000 The full scope IFPRA peer review is documented in Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Palo Verde Nuclear Generating Station Probabilistic Risk Assessment, November 2010.

Seismic PRA A full scope SPRA peer review was conducted by a diverse team, none of whom were involved in development of the PRA model, led by Westinghouse Electric Company, LLC PRA practitioner in December 2012. The peer review team included experienced PRA practitioners from:

• Westinghouse Electric Company, LLC

• Los Alamos National Laboratory

• Paul Rizzo Associates, Inc.

• Scientech/Curtiss-Wright

• ERIN Engineering and Research, Inc.

The review was conducted in accordance with NEI 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012. The following references were cited as used in the peer review process:

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers and the American Nuclear Society, New York, NY, February 2009 Page 35 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

• Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, USNRC, March 2009

• NEI 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012

• NEI 05-04, Revision 2, Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2008 The full scope SPRA peer review is documented in Peer Review of the Palo Verde Nuclear Generating Station Seismic Probabilistic Risk Assessment Against the Seismic PRA Standard Supporting Requirements of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications, February 2013.

Internal Fire PRA A full scope internal FPRA peer review was conducted by a diverse industry team, none of whom were involved in development of the PRA model, led by a Westinghouse Electric Company, LLC, PRA practitioner in October 2012. The review was conducted in accordance with NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines. The peer review team included experienced PRA practitioners from:

• Westinghouse Electric Company, LLC

• Tennessee Valley Authority (TVA)

• Hughes Associates, Inc.

• Engineering Planning and Management (EPM)

• Tri-En Corporation

• Reliability and Safety Consulting Engineers, Inc.

• Maracor

• ERIN Engineering The following references were cited as used in the peer review process:

• Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME and the American Nuclear Society, December 2008

• NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Nuclear Energy Institute, November 2008

• NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Electric Power Research Institute and the U.S. Nuclear Regulatory Commission, September 2005

• NEI 05-04, Revision 1 Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2007

• The EPRI HRA Calculator 3.0, 2005 Page 36 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

• Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, USNRC, 2009

• NUREG-1921, EPRI/NRC-RES Fire Human Reliability Guidelines, Electric Power Research Institute and the U.S. Nuclear Regulatory Commission, November 2009

• NEI 00-02, Revision 3A, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, March 2000

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers and the American Nuclear Society, New York, NY, February 2009

• ANSI/ANS 58.23-2007, Fire PRA Methodology, American Nuclear Society, November 2007 The full scope internal FPRA peer review is documented in Fire PRA Peer Review of the Palo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS Standard, December 2012.

A focused scope internal FPRA peer review was conducted by a team, none of whom were involved in development of the PRA model, led by a Hughes and Associates, Inc., PRA practitioner in December 2014. The focused scope peer review included a complete re-review of all supporting requirements not determined met to CC-II in the earlier full scope peer review. The peer review team included experienced PRA practitioners from:

• Ratchford Diversified Services, LLC

• Ameren

• Hughes and Associates, Inc.

• Westinghouse Electric Company, LLC The review was conducted in accordance with NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Sections 3.5 and 4.4.

The following internal FPRA elements were included in the scope of the focused scope peer review process:

Element SRs Reviewed Plant Boundary Definition and Partitioning (PP) 4(B7, C1, C2, C3)

Fire PRA Equipment Selection (ES) 2(A1, D1)

Fire PRA Cable Selection (CS) 4(A2, A6, A9, B1)

Qualitative Screening (QLS) 2(A1, A2)

Fire PRA Plant Response Model (PRM) 8(A3, B2, B5, B6, B8, B13, B14, B15)

Fire Ignition Frequency (IGN) 1(A7)

Fire Scenario Selection and Analysis (FSS) 10(D1, D2, D4, D11, E1, G3, G5, G6, H8, H9)

Circuit Failure Analysis (CF) 3(A1, A2, B1)

Postfire Human Reliability Analysis (HRA) 2(C1, D2)

Fire Risk Quantification (FQ) 1(E1)

Uncertainty and Sensitivity Analyses (UNC) 1(A1)

Page 37 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The following references were cited as used in the focused scope peer review process:

• ASME/ANS RA-Sa-2009, Addenda A to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME and the American Nuclear Society, February 2009

• NEI 07-12, Revision 1, Fire Probabilistic Risk Assessment (FPRA) Peer Review process Guidelines, Nuclear Energy Institute, July 2010

• ANSI/ANS 58.23-2007, Fire PRA Methodology, American Nuclear Society, November 2007

• NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Electric Power Research Institute and the U.S. Nuclear Regulatory Commission, September 2005

• NEI 05-04, Revision 2, Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Nuclear Energy Institute, November 2008

• Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, USNRC, 2009 The focused scope internal FPRA peer review is documented in Palo Verde Nuclear Generating Station Fire PRA Focused-Scope Peer Review Report, January 2015.

Page 38 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 14 APLA - Other External Hazards Peer Review LAR Attachment 6 states that a full-scope external hazards screening peer review was performed in December 2011 in accordance with RG 1.200, Revision 2. The LAR does not discuss the results from this external hazards screening peer review and does not state whether the F&O closure review in June 2017 addressed any findings from the external hazards screening peer review.

a. Please clarify whether the finding-level F&Os, if any, from the December 2011 peer review of the external hazards screening process was encompassed in the scope of the June 2017 F&O closure review.

b. If finding-level F&Os from the December 2011 peer review of the external hazards screening process were not addressed in the June 2017 F&O closure review, please provide these findings and the associated dispositions as it pertains to this application. For any open findings, please discuss your plans to close those findings through a peer review or through the NRC accepted F&O closure process prior to implementing the RICT Program.

APS Response to RAI 14 The other external hazards screening peer review identified three findings (see ). Two findings, EXT-D1-01 and EXT-D1-02, concerned five issues identified during the walkdown. The third finding, EXT-E2-01, concerned insufficient documentation of transportation accident and tornado missile impact. These findings were inadvertently excluded from the June 2017 F&O closure review. All these findings were resolved in Attachment 3. These three findings will be included and verified closed in an augmented F&O closure review as described in Attachment 1.

Page 39 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 15 APLB - External Hazards NEI 06-09, Section 3.3.5, External Events Consideration, clarifies that external hazards impact on incremental configuration risk should be addressed for each RICT calculation. LAR Attachment 8, Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models, addresses external events. This attachment summarizes the evaluation of the risk of external hazards that appears to be consistent with the ASME/ANS RA-Sa-2009, (i.e., screening associated with the baseline risk contribution). The results of the evaluation summarized in Table A8-1 seem to indicate, however, that the external hazards will be excluded from every configuration risk evaluation, (e.g. no unique PRA model for seismic events is required in order to assess configuration risk for the RICT Program). However, there may be situations where the hazard may be important in a configuration risk calculation even though the baseline risk can be screened out consistent with the ASME/ANS RA-Sa-2009. For example, external floods seem to be excluded because the plant design conforms to the standard review plan (SRP) criteria. Presumably smaller flood levels may fail plant equipment not required to be protected by the SRP criteria which could affect configuration risk, and sometimes the flood barriers themselves may be degraded or undergoing maintenance which could affect configuration risk. Similarly, extreme wind or tornado seem to be fully excluded because of low frequency of occurrence but those factors for the barriers may not have considered the plant configuration during a RICT.

a. Please clarify if the external hazard risks are excluded from the RICT program or if the program includes guidance to assure that the assumptions supporting the screening of the hazards remain applicable given the plant configuration during the RICT. If the hazards are fully excluded, please address the issue related to screening based on meeting the SRP criteria (e.g., design flood height and mitigating features) or based on low nominal risk values. If, instead guidance is provided, please describe the guidance, (e.g., in certain instances, hazards which were initially screened out from the RICT calculation may be considered quantitatively if the plant configuration could impact the RICT).

b. The LAR does not mention how design basis assumptions for external hazards are treated in the RICT program. A design basis assumption applicable to a hazard may temporarily be not applicable (e.g., barrier degradation), which may increase the likelihood of a plant challenge.

i. Please discuss how structures, systems, and components (SSCs) important for the design basis assumptions for external events will be considered in RICT program guidance.

Page 40 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times ii. Prior to entering a RICT or during a RICT, please discuss how the CDF and LERF are evaluated if design basis assumptions important for the screened-out hazard are or may be impacted by plant conditions.

APS Response to RAI 15 APS will include steps in RICT implementing procedures to determine if any plant barriers or plant features credited in mitigating other external events screening are impaired and will either fail those SSCs protected by the impaired barriers in the RICT calculation, or as an alternative, provide a documented engineering evaluation for how to more realistically account for the barrier or plant feature impairment in the CRMP tool. The RICT implementing procedures will include a list of all types of credited barriers or plant features which are credited in the other external hazards screening to ensure the review is comprehensive. Risk management actions may be identified to mitigate these impairments and those RMAs which directly impact the CRMP model will be credited in the RICT calculation based on a documented engineering evaluation.

Page 41 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 16 APLA - RCP Seal Modeling

a. LAR Attachment 13, Table A13-1 states that reactor coolant pump (RCP) seal leakage is not modelled as a loss of reactor coolant system (RCS) inventory because the leakage is within the makeup ability of the charging pumps even if all four RCP seals fail. ASME/ANS RA-Sa-2009 provides for screening of initiating events and components as described in SRs IE-C6, SY-A15, and SY-B13. Please confirm that these screening criteria are met for screening out the RCP seal loss of coolant accident. If not met, please discuss your plans to resolve this issue prior to implementing the RICT program.

b. LAR Attachment 13, Table A13-1, indicated that WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008, and pump seal vendor information was used to conclude that the leakage into the seal package from the RCS is limited to about 17 gallons per minute per pump. WCAP-15749 has not been endorsed by the NRC, however WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS [Nuclear Steam Supply System] Plants, has been endorsed by the NRC (ADAMS Accession No. ML071130391). Please discuss the relationship between these two WCAP documents. Also please explain how the limitations and conditions of WCAP-16175-P-A have been addressed.

APS Response to RAI 16

a. NRC approval of RCP seal failure modeling (WCAP-16175-P-A, 2007) and the subsequent APS screening of loss of RCP seal cooling scenarios (2004) from the IEPRA model were performed after conclusion of the CEOG peer review (1999). The RG 1.200 self-assessment process identified the RCP seal leak or rupture as a key source of uncertainty.

The assessment noted that, based on WCAP-15749-P, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 1, December 2008, and vendor information (refer to WCAP-16175-P-A Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, Revision 0, March 2007), the very tight clearances would limit RCS leakage into the seal package to 17 gallons per minute (gpm) per pump. As a result, even if the seal packages of all four pumps failed, the total leak rate is within the capacity of two charging pumps and does not qualify as a LOCA.

The APS screening determined that modeling RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even when assuming plant operation with one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF.

Page 42 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Prior to implementation of the RICT program, APS will revisit the evaluation of the RCP seal leakage as an initiating event and impact on mitigation functions as described in SRs IE-C6, SY-A15, and SY-B13.

This evaluation will utilize the implementation guidance of WCAP-15749-P, Revision 1, RCP Seal Failure Models of WCAP-16175-P-A, and consider the conditions, limitations, and modifications identified in the safety evaluation (ADAMS No. ML070240429). APS will respond to this question as described in Attachment 1.

b. WCAP-15749-P, Revision 1, contains detailed information on how to incorporate the NRC approved CEOG model for failure of RCP seals, as outlined in WCAP-16175-P-A, Revision 0, into a CE-designed plant-specific PRA model for RCP seal failure in the plant probabilistic safety assessment for LOOP. This guidance specifically addresses treatment of multiple RCP seal failures, discusses model uncertainties and provides general guidance for incorporating station blackout events, loss of component cooling water (LOCCW) events and events with a subsequent loss of cooling water to one or more RCP seals. WCAP-16175-P-A contains the background information and technical justification used in the development of the CEOG reactor coolant pump seal failure model. The NRC approved version of WCAP-16175-P-A specifies an assumed 17 gpm per pump seal leakage rate for PVNGS. WCAP-15749-P, Revision 1, and WCAP-16175-P-A, Revision 0, were used in the process of initially screening the loss of RCP seal cooling scenarios from the internal events PRA at PVNGS.

NRC review of FLEX mitigation strategies (ADAMS No. ML16088A261) concluded that the seal leakage rate of 17 gpm per pump was acceptable based on comparison to the 1989 PVNGS Unit 3 LOOP event. Use of 25 gpm per pump for PVNGS in the extended loss of AC power (ELAP) and station blackout scenario analyses provide additional margin of conservatism for those non-risk-informed applications. The PRA model evaluations will utilize the NRC accepted 17 gpm per pump leakage rate that realistically represents the as-built and as-operated plant in accordance with regulatory position 2.3.4 of RG 1.174, Revision 2, such as not to inadvertently skew risk insights by applying additional conservative margins.

Page 43 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 17 APLA - Fire PRA Methods

a. LAR Attachment 13, Table A13-1 explains that fire areas defined by the Fire Hazards Analysis (FHA) will substantially contain the adverse effects of fires originating from any currently installed fixed ignition source or reasonably expected transient ignition source and that fire zone boundaries are similarly assumed adequate or combined. The description explains that because fire zones have a lesser pedigree than fire areas, their boundaries are verified adequately in this notebook by a FHA review and plant walkdowns and that fire zones boundaries that appear unable to withstand the fire hazards within the zone are combined. Its not clear to the NRC staff from this description what criteria were used to determine when a fire zone was unable to contain the impact of a fire in that zone. Please describe the criteria used to determine when a fire zone was unable to contain the impact of a fire in that zone relative to passive barriers (or spatial separation if used), and active fire barriers, and the basis for those criteria. Justify the basis for this credit consistent with the NRC-accepted guidance.

b. LAR Attachment 13, Table A13-1 indicates that breaker fuse coordination was evaluated for the plant and states when selective tripping cannot be demonstrated, the internal fire PRA model will credit recovery procedures planned to correct the coordination. The explanation also states that this assumption is considered to have low consequence to RICT evaluations because electrical coordination will either be established or recovery procedures will be implemented to correct the coordination. These statements infer that one or more circuits with inadequate breaker fuse coordination were determined to exist at the plant. From the description in the LAR, it is not clear to the NRC staff whether recovery procedures are used to preclude the possibility of failures associated with inadequate circuits (such as loss of a power supply) or whether the inadequacies were modelled in the PRA along with HFEs associated with potential recovery of lost equipment. It is also not clear to the NRC staff how inadequate breaker fuse coordination and recovery procedures are modelled and what the bases is for that modelling. Please address the following:

If inadequate breaker fuse coordination and/or recovery procedures have been modelled in the fire PRA, please provide the following information:

i. Please explain how inadequate breaker fuse coordination is modelled in the fire PRA and justify that this treatment addresses the failures that could occur as a result of the identified circuit inadequacies.

Page 44 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times ii. Please include a description of the circuit failure modes addressed and how associated component failures are modelled in the fire PRA. Also, please describe and justify assumptions made in the fire PRA about how fire-induced faults associated with inadequately coordinated/protected circuits impact upstream and downstream components from the fault.

iii. Given that the sizing and coordination of electrical protective devices appear to be in question, please include an explanation of how the potential for secondary fires is addressed in the fire PRA. If secondary fires are not modelled and fire-induced faults in inadequately protected circuits could lead to secondary fires, then please justify this modeling exclusion.

iv. Please explain how recovery procedures are modelled and how the feasibility of recovering components is established when after the power supply for the associated circuits is lost.

If inadequate breaker fuse coordination and recovery procedures have not been modelled in the fire PRA, then please provide justification for this modeling exclusion or incorporate modeling that addresses the concerns discussed) above. Alternatively, please correct the coordination issues which are relevant for the RICT program.

c. The NRC staff has formally accepted fire PRA method refinements during resolution of UAMs during individual plant reviews, as well as through the frequently asked question (FAQ) program for National Fire Protection association (NFPA) 805 in accordance with Regulatory Issue Summary (RIS) 2007-19, Process For Communicating Clarifications Of Staff Positions Provided In Regulatory Guide 1.205 Concerning Issues Identified During The Pilot Application Of National Fire Protection Association Standard 805.. FAQ guidance relevant to the RICT program are those associated with fire PRA methods and not those specific to the NFPA 805 program.

i. Please identify and provide technical justification for any fire PRA methodology that has not been formally accepted by the NRC staff. Evaluate the significance of the proposed use of any unaccepted fire PRA method on the RICT program.

ii. If a method has been used for the fire PRA, please confirm that the accepted version of the method is used per the NRC position. If not, then please provide justification for the difference in the method or NRC position, or incorporate an NRC accepted method or position into the Fire PRA.

d. For purposes of Risk-informed Technical Specifications Initiative 4b, the fire PRA should be updated with the current studies prior to Page 45 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times implementation of the RICT program in order to ensure it is consistent with currently NRC-accepted fire PRA methods. Please discuss the plans to incorporate acceptable methods in the fire PRA prior to implementing the RICT program. Some example acceptable methods include:

NUREG/CR-7150," Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE)," Volume 2, which is supported by a letter from the NRC to NEI, "Supplemental Interim Technical Guidance on Fire-induced Circuit Failure Mode Likelihood Analysis," (ADAMS Accession Nos. ML14086A165 and ML14017A135).

NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database: United States Fire Event Experience Through 2009 (ADAMS Accession No. ML15016A069).

e. Please describe how the evaluation includes the possible increase in heat release rates (HRR) caused by the spread of a fire from the ignition source to other combustibles, and summarize how suppression is included in the evaluation. Please discuss how this is consistent with, or any differences from, NRC accepted guidance.

f. Please confirm that the manual suppression probabilities are consistent with NUREG/CR-6850, EPRI [Electric Power Research Institute]/NRC-RES[Office of Nuclear Regulatory Research] Fire PRA Methodology for Nuclear Power Facilities, Volume 2, Appendix P (ADAMS Accession No. ML050940189), in that these are not less than the 0.001 floor.

APS Response to RAI 17

a. The PVNGS internal FPRA used fire compartments to be equivalent to fire zones. The primary benefit of adopting existing fire zones as internal FPRA compartments is that many aspects of the fire protection program are defined in their terms, such as cable routing, fire barrier documentation, and fire protection features. Use of the smaller fire zone definitions, as opposed to larger fire area definitions, also improves internal FPRA realism by crediting the generally substantial zone boundaries to limit fire damage to a smaller, more realistic set of targets. Because fire zone boundaries can have a lesser pedigree than fire area boundaries, the zone boundaries are reviewed and evaluated for their adequacy as fire compartment boundaries. The criteria used to determine the adequacy of fire zones meeting the fire compartment criteria during the boundary adequacy walkdowns are shown in Attachment 4.

Page 46 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The guidance used to determine the adequacy of barriers is contained in NUREG/CR-6850, EPRI TR-1011989, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, September 2005. The PVNGS internal FPRA documents provide the basis for crediting a substantial barrier or significant spatial barrier. Plant walkdowns were initially conducted by the fire risk services team lead engineer, who is a licensed fire protection engineer. This team had significant experience with internal FPRA development of the pilot plant and several other utility internal FPRAs. Subsequent walkdowns were performed under the direction of the team lead and the final documentation was reviewed by this lead engineer.

b.i. The breaker fuse coordination issues have been addressed and accounted for in the internal FPRA as described below.

A breaker coordination calculation was completed to evaluate power supplies at PVNGS identified as potentially impacting the internal FPRA. The calculation used existing plant documentation to identify selective coordination and examined power supplies where it was unknown if coordination existed. In accordance with PVNGS calculations, coordination was demonstrated by utilizing the additional impedance introduced by cable lengths along fire boundaries (in the fault current location) in order to introduce the fault current to levels that assure selective coordination. Therefore, the internal FPRA uses cable length to reduce fault current for coordination of branch circuit breakers with upstream devices. Added conservatism was included by applying the cable length to all of the load cables on the power supply.

For example, if the coordination did not exist, a required cable length was calculated to determine if coordination overlap was acceptable.

The cables causing issues for the power supplies were compiled along with their routings, and all fire compartments the cables passed through. This information was used in the internal FPRA to create the failure list for the breaker coordination. Power supplies determined to have inadequate cable length were assumed failed in appropriate areas in the internal FPRA. In cases where the cable length is credited for maintaining breaker coordination, fires that can impact that cable length are assumed to fail the supplying bus. Since fire impacts are mapped to trays and conduits containing the cable, and not to individual cable lengths, there is additional length of cable to provide margin for coordination. These power supplies were added to internal FPRA scenarios where the identified cable routing is a target in the zone of influence. In cases of hot gas layer, loss of the power supply was added to internal FPRA scenarios if the credited cable length is within the compartment being considered for hot gas layer.

Page 47 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times For power supplies that could not have their breaker coordination validated from an existing calculation or evaluation, the power supply was considered always failed in the internal FPRA.

Although NUREG/CR-6850 cautions using feeder cable length to ensure coordination, PVNGS calculations use and justify coordination using the feeder cable lengths outside of the control room. NUREG/CR-6850 cautions against use of cable length for coordination due to the differences between Appendix R separation rules/boundaries and the separation/compartments used in internal FPRAs. The differences in the way the fire is modeled and equipment availability is assumed can lead to discrepancies in circuit coordination between the two programs. However, for this case, coordination is being assured using length of cable starting at the end point of the cable and working back toward the source. Since both programs recognize the hard boundary between the control room and the cable spreading rooms, and the cable length is calculated from the farthest point from the source, moving the fire closer to the entry point of the cable within the control room will not compromise the argument for coordination.

b.ii. The cable failure modes of interest include hot shorts and shorts-to-ground. A controlled database contains both the cable to raceway and cable to impacted basic event relationships. The database also includes fire zone to raceway correlations in conjunction with source-target data and list of all possible ignition sources within these fire zones for which the power supply was assumed to not coordinate. These power supplies are added to internal FPRA scenarios where the identified cable routing is a target in the zone of influence.

The following list provides the associated assumptions for inadequately coordinated/protected circuits:

1. Electrical contacts were assumed closed when performing cable selection. This is a conservative assumption that potentially includes additional cables that may not impact breaker coordination.

2. For instances where we have loss of control power due to coordination, it is conservatively assumed that in addition to a coordination issue, a ground fault occurs on a component cable resulting in a spurious trip to the associated breaker (i.e.,

coordination fault on cable).

3. It is assumed that the circuit breakers on 125 DC panels NKN-D41 and NKN-D42 fail to coordinate with the upstream protective device. Since no calculation could be found for the 30A, 25A, 20A, and 15A branch circuit breakers it is assumed Page 48 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times that no coordination exists with the upstream protective device.

4. It is assumed that the 30AT circuit breakers do not coordinate with the downstream protective device (10A, 15A, and 35A fuse). This assumption is based on input obtained from PVNGS calculation 13-EC-PB-0110, Section 7, Protective Device Coordination: Fire Protection, Revision 12.

5. It is assumed that the 20AT circuit breakers do not coordinate with the downstream 15A and 35A fuses. This assumption is based on input obtained from PVNGS calculation 13-EC-PB-0110, Section 7.

6. It is assumed that the 90A circuit breaker does not coordinate with the 30A fuse. This assumption is based on input obtained from PVNGS calculation 13-EC-PB-0110, Section 7.

b.iii. Review of industry operating experience, Postulated Hot Short Fire Could Adversely Impact Safe Shutdown Equipment, (CR 14-01375) identified two instances where secondary fires due to multiple fire induced faults impacted PVNGS. The two secondary fires of concern were:

• Secondary fires due to multiple fire induced faults in control room DC ammeter circuits, and

• Secondary fires due to multiple fire induced faults in non-class DC motor circuits.

Fuses were installed in the control room DC ammeter and non-class DC motor circuits in all three units to prevent secondary fires. No updates were required to the PRA model since the modifications implemented subcomponents on equipment not credited by the PRA model. The modifications were already accounted for in the PRA model developed for this application, and as such no updates are required to support the RICT program.

Lack of breaker/fuse coordination is not to imply inadequately protected circuits. PVNGS circuits are designed to be protected from spurious grounding. Instances of inadequate breaker coordination only results in premature tripping of upstream power supplies. As such, induced secondary fires are not postulated or modeled.

b.iv. Recovery procedures have not been developed and are not credited in the PRA model for recovering components when the power supplies for associated circuits are lost.

Page 49 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

c. Attachment 5 reviews the status of internal FPRA methodologies which form the basis of the PVNGS internal FPRA model.

i. All incorporated methods in the internal FPRA model cited in the license amendment have been formally accepted by the NRC staff at the time the model was issued. The summary below provides the APS plan to revise the internal FPRA model with the currently approved updated data, in accordance with the PRA model maintenance and update process. APS does not propose to use any unaccepted internal FPRA methods for the RICT program.

ii. Attachment 5 indicates the versions of the methodologies and data currently incorporated, and the incorporation status of all currently accepted versions.

APS plans to complete the following prior to implementation of the RICT program, as described in Attachment 1:

1. Incorporate the updated fire ignition frequencies and non-suppression probabilities (NSP) provided in NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, January 2015. Incorporate a 0.001 floor value directly into the manual suppression NSP calculations.

2. Incorporate the updated electrical cabinet heat release rates provided in NUREG-2178, Refining And Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE), May 2016. APS does not plan to implement the Obstructed Plume methodology upgrade.

3. Update the transient and oil fire growth rates per FAQ 08-0052.

4. Update the KERITE cable type per FAQ 08-0053.

5. Update component binning per FAQ 12-0064. APS plans to retain the transient fire weighting factor methodology of NUREG/CR-6850, and does not plan to take credit for adjusting weighting factors to values between 0.0 and 1.0, as allowed by the methodology in NFPA-805 FAQ 12-0064.

PVNGS internal FPRA ignition source weighting factors are established based on the guidance provided in NUREG/CR-6850 Section 6.5.7.2 (and Table 6-3) and the process is documented in internal FPRA studies. Knowledgeable plant staff was surveyed; including a PRA engineer, fire protection engineer, fire marshal, operations representative, work management Page 50 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times scheduler, mechanical maintenance representative, and an electrical journeyman. The results were qualitatively adjusted (calibrated) as necessary to maintain the Medium (3) factor as the normative value. The full range of influence factor rating values of No (0), Low (1), Medium (3), High (10), and Very High (50) were exercised. Influence factor rating values of Extremely Low (0.1) and Very Low (0.3) were not used.

Two fire compartments are assigned Zero (0) for both maintenance and occupancy influence factors with a storage factor of one (1) assigned to ensure a frequency greater than zero is assigned to each plant analysis unit: filter and ion exchanger rooms (Fire Compartment, FC49A-G) and volume control tank room (Fire Compartment, FC51A). These compartments are encased in concrete and inaccessible at power.

6. Incorporate the updated guidance on treatment of sensitive electronic damage thresholds per FAQ 13-0004.

7. Incorporate updated oil fire split fractions (counting) per NRC position, item 3, ADAMS No. ML12171A583.

8. Incorporate updated uncertainty analysis expectations per NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1.

d. Attachment 5 provides the status of internal FPRA methodologies which form the basis of the PVNGS internal FPRA model.

i. APS has incorporated NUREG/CR-7150.

ii. APS plans to incorporate, as described in Attachment 1:

• NUREG-2169, Updated Ignition Frequencies and Non-Suppression Probabilities

• NUREG-2178, Updated Electrical Cabinet Heat Release Rates iii. APS does not intend to implement:

• Obstructed plume methodology provided in NUREG-2178 Dominant fire scenarios of electrical cabinets with secondary combustibles are generally trays located very close to the ignition source. Thus incorporation of the obstructed plume methodology is not currently considered Page 51 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times to provide a significant benefit. If final model refinements identify locations of value and the necessity exists to require implementation, then a focused scope peer review would be performed and reported.

• Credit for incipient detection provided in NUREG-2180 No very early warning detection systems are installed in fire compartments in which detailed fire modeling was performed. Fire compartments with incipient detection installed are modeled with credit (if any) for only standard fire detection capability.

e. Secondary combustibles identified during the ignition source walkdowns are included in the heat release rate (HRR) of the scenario.

The bounding secondary combustible configurations were identified during visual inspections of plant areas containing secondary combustibles within the ignition source zone of influence (ZOI).

Secondary combustibles are considered targets for the purpose of calculating the time to damage the first target in the assessment of the zone of influence non-suppression probability (NSPZOI). Ignition and propagation of secondary combustibles are considered to supplement the HRR of the ignition source in the assessment of the hot gas layer (HGL) non-suppression probability (NSPHGL).

NSPZOI represents failure to suppress the fire prior to damaging targets within the 98th percentile ZOI. This is calculated for each fire scenario by quantifying the NSP event tree in Figure P-1 of NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, September 2005, using the time to damage of the nearest target, except in specific cases where the suppression system is incapable of preventing target damage beyond the ignition source itself. The specific cases where the NSPZOI are applied are documented in PVNGS internal FPRA studies. Cable tray suppression and CO2 or Halon suppression are not credited for precluding first target damage, thus are not credited in the calculation of NSPZOI.

NSPHGL is the probability of failure to suppress a 98th percentile fire, including secondary combustibles, prior to it causing a HGL. This non suppression probability (NSP) term is determined for each fire scenario by quantifying the NSP event tree in the Figure P-1 of NUREG/CR-6850 using the time to HGL.

The secondary combustibles (cable trays) and the cable targets, for which the HGL temperatures threshold is applied, are assumed to contain all thermoplastic/non-IEEE-383 qualified cables, unless specifically validated otherwise. The vertical propagation within the Page 52 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times secondary combustibles follows the guidance in NUREG/CR-6850, NUREG/CR-6850 Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements, September 2010, and NUREG/CR-7010 Volume 1, Cable Heat Release, Ignition, and Spread in Tray Installations During Fire (CHRISTIFIRE) Phase 1: Horizontal Trays, July 2012. Specifically, the length of cable tray initially ignited equals the characteristic dimension of the ignition source, and the minimum length of subsequently ignited cable trays increases by a factor equal to cttan35°, where ct is the separation distance between the lower and upper cable tray. This means that the initial length of cable tray ignited is defined by an inverted frustum with the sides sloped thirty-five degrees from the vertical per the guidance documented in Appendix R of NUREG/CR-6850. The lateral flame spread is characterized using thermoplastic/non-IEEE-383 qualified flame spread rates as recommended in NUREG/CR-6850 and NUREG/CR-7010.

An analysis of the HGL temperatures in generic enclosures involving ignition sources and secondary combustibles (i.e., cable trays) configurations for PVNGS has been performed and implemented. For compartments analyzed as a HGL scenario, the worst ignition source-secondary combustible combination from the compartment is selected and the corresponding HGL timing is conservatively applied to all the ignition sources in the compartment for quantification of the NSPHGL.

Additionally, vertical cable trays are located in designated riser shaft fire compartments which are quantified as HGL (full compartment burnup) scenarios with severity factor = 1.0, and non-suppression probabilities NSPZOI = 1.0, and NSPHGL = 1.0.

f. The manual suppression probabilities are currently consistent with revised mean suppression rates provided in NUREG/CR-6850 Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements, September 2010, Chapter 14, FAQ 08-0050, Table 14-2 Original and Updated Mean Suppression Rates. There are no fire scenarios where application of a 0.001 floor value would impact the zone of influence or HGL non-suppression probabilities.

APS plans to update the manual suppression rates with the updated mean values provided in NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, January 2015, Table 5-1, Probability distribution for rate of fires suppressed per unit time. A floor value of 0.001 will be hard-coded into the calculations of manual non-suppression probability.

Page 53 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 18 APLA - Planned Modifications and Recovery Actions 3, Table A13-1 includes the following assumption/uncertainty:

Planned plant modifications and recovery actions are assumed in the base case model. These modeled modifications are assumed to correct the fire vulnerability and not introduce any new failure modes.

a. Recovery action is a term used for plants adopting NFPA 805, which PVNGS has not identified as adopting in the LAR. Therefore, please explain the use of the term recovery action.

b. Please describe the process used to identify these recovery actions, the method used to quantify them, and whether these actions have been evaluated for feasibility and reliability. If these recovery actions are necessary to meet RG 1.174 guidelines, please provide them.

APS Response to RAI 18

a. Existing and planned HFEs in the PRA model have been referred to as recovery actions in the APS LAR. The term recovery actions was intended to refer to operator actions to be analyzed as HFEs to recover a failed function, system, or component, as defined in ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, supporting requirement HR-E2. None of the operator actions are repair actions.

Current PVNGS HFEs fall within the guidance of HRA, as provided in ASME/ANS RA-Sa-2009 supporting requirements HR-E through HR-G, and are performed in accordance with referenced procedures (emergency, abnormal, or operating). Planned HFEs are intended to be developed in accordance with supporting requirements HR-E through HR-G and the operator actions proceduralized in, or referenced by, the emergency, abnormal, or operating procedures. Fire HFEs have been derived from the IEPRA model. No unique HFEs have been created for the fire model. The augmented fire HFEs meet requirements found in Table 4-2.10-1 of ASME/ANS RA-Sa-2009.

b. Recovery actions (including fire), as described in Item a. above, have been identified, quantified, and evaluated in accordance with the following guidance and meet the requirements of ASME/ANS RA-Sa-2009:

Page 54 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

• NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications, August 1983

• NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), April 2005

• NUREG-1921, Fire Human Reliability Analysis Guidelines, July 2012 Two operator action HFEs were necessary to meet RG 1.174 guidelines:

• 1AF-FLEX-SGHR-HL, Operator Fails to Align FLEX Mod to Feed SG2 This operator action HFE was developed to credit a planned plant modification to install an additional steam generator makeup pump. The actions could only be credited if/when the additional pump was installed, tested, and operators designated and briefed. This operator action, as modeled in the LAR PRA, reflects credit for specifically analyzed alternate portable equipment. This operator action does not represent deployment and operation of FLEX equipment, which is not credited in the LAR PRA model.

Credit for this specific operator action was obviated by completion of an alternate plant modification to install a set of cross-tie valves between the FP system and the AF system. A new HFE has been developed per the guidance of ASME/ANS RA-Sa-2009 supporting requirements HR-E through HR-G for the proceduralized actions to align and initiate FP water to augment the AF system for steam generator makeup.

• 1CTMT-ISOL---2HL, Operator Fails to Locally Close Containment Isolation Valves This operator action HFE was developed to credit manual local closure of seven containment isolation valves that must close (and ensure four normally-closed isolation valves remain closed) upon failure of automatic and manual initiation of Containment Isolation Actuation Signal, prior to initiation of core damage.

Procedure revisions are planned to detail the specific procedure actions and priorities given to the penetrations potentially contributing to a large early release.

Page 55 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 19 APLA - Fire PRA Modeling

a. The original LAR Attachment 4, List of Regulatory Commitments, included an action to validate that the Unit 1 internal fire PRA model is bounding for Units 2 and 3 to reflect field-routed cabling or create unit-specific internal fire models for Units 2 and 3 prior to use of the RICT program at Units 2 and 3. If separate fire PRAs need to be completed for Units 2 and 3, please discuss your plans to complete the peer reviews and submit F&Os for these fire PRA models as required by ASME/ANS RS-Sa-2009 as clarified by RG 1.200, Revision 2.

b. Equipment relied upon for safe shutdown may or may not be included in the RICT program. Please explain whether or not this equipment is in the Fire PRA and how the fire PRA is capable of evaluating the risk contribution from this equipment when it is out-of-service.

c. Please confirm that there are no fire events in the fire PRA model, which have a conditional core damage probability [CCDP] = 1.0. If there are, this would mask the risk contribution from equipment out-of-service. In such cases, please discuss your plans to resolve this issue prior to implementing the RICT program.

APS Response to RAI 19

a. The commitment regarding the action to validate that the Unit 1 internal FPRA model is bounding for Units 2 and 3 is complete.

Following the original submittal of the LAR Attachment 4, PRA performed a delta assessment for differences between Unit 1 (base model) and Units 2 and 3 and developed a composite PVNGS internal FPRA model that is representative of the as-built condition of Units 2 and 3, and is not overly conservative for the representation of the as-built condition of Unit 1. A discussion of the composite internal FPRA model and quantification results is provided in the response to RAI 22, APLA - Reported Baseline Risk Values.

b. Equipment relied upon for safe shutdown may or may not be included in the RICT program, but it is explicitly or implicitly modeled in the internal FPRA. Explicitly modeled equipment is mapped to the associated component equipment identifications in the CRMP mapping tables. Implicitly modeled equipment in the internal FPRA includes fire detection systems, fire suppression systems, and fire barriers. These are implicitly considered in the evaluation of the scenario NSPs and multi-compartment analysis barrier failure probabilities (BFPs).

Adjusted NSP and BFP values are being developed to represent the unavailability of these implicitly modeled elements. A CRMP mapping table will be developed to associate the fire compartments affected by the detection, suppression, and barrier components to the adjusted Page 56 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times NSP and BFP values. Selecting a mapped component or element out of service in the CRMP directly evaluates the risk contribution.

c. There is one fire scenario in the internal FPRA model which has a CCDP

= 1.0. The main control room abandonment (MCRA) scenario does not credit evacuation and direction of operator actions outside the control room, or transfer of control to the remote shutdown panels. Although no credit is currently given for mitigation of the event from the remote shutdown panels, the risk contribution is reasonable due to the long time available prior to exceeding control room abandonment criteria (limited by optical density). Due to the low ignition frequency and low non-suppression probability of the abandonment scenario, no control room abandonment operator recovery HEP was developed. The contribution of control room abandonment CDF to total fire CDF is approximately 1%. Due to the low risk significance, no actions are currently required to address this issue for core damage.

PVNGS model refinements will be developed to address any significant dominant scenarios that utilize a CCDP or conditional large early release probability value of 1.0 that impact large early release. As necessary, future model refinements may employ the current reviewed scenario and system modeling techniques to capture the risk contributions from the mitigating systems credited by pre-abandonment actuation or automatic actuation. However, PVNGS does not intend to implement any new or unapproved methodology to develop a MCRA HFE.

Page 57 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 20 APLA - Maintenance Rule NEI 06-09, Revision 0-A references NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 3, (ADAMS Accession No. ML031500684) as endorsed by RG 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants (ADAMS Accession No. ML003740117). These references have been updated such that the latest guidance is NUMARC 93-01, Revision 4A (ADAMS Accession No. ML11116A198), as endorsed by RG 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 3 (ADAMS Accession No. ML113610098). Please discuss whether these updated references are being used for the RICT program and if not, please discuss your plans for using them prior to implementation of the RICT program.

APS Response to RAI 20 APS implemented NUMARC 93-01, Revision 4A, for online maintenance rule 10 CFR 50.65(a)(4) risk assessments with procedure 70DP-0RA05, Revision 20, Assessment and Management of Risk When Performing Maintenance in Modes 1 and 2, October 30, 2013. The RICT program will use NUMARC 93-01, Revision 4A, and its references will be updated consistent with the 10 CFR 50.65(a)(4) risk assessment program.

Page 58 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 21 APLA - Total CDF and LERF LAR Attachment 9, Table A9-1 provides the total baseline CDF and LERF.

Completing the actions in the NRC staffs RAIs may impact the CDF and LERF values. After completing the actions in the other RAIs, please identify changes made to the PRA in response to RAIs, and provide the estimated CDF and LERF values that incorporate all changes and modifications. Also, please propose a plan to incorporate those changes that affect total baseline CDF and LERF values prior to implementation of the RICT program.

APS Response to RAI 21 APS will provide the updated PRA model CDF and LERF values after changes described in other RAI responses are incorporated. The estimated CDF and LERF values will include a list of changes made to the baseline PRA model reported in Table A9-1, Total Unit 1/2/3 Baseline Average Annual CDF/LERF, and demonstrate that the total CDF and total LERF are below the limits established in RG 1.174, which are 1E-4/year for CDF and 1E-5/year for LERF. APS has a detailed schedule for incorporating these changes in the PRA models including activities to review results, perform sensitivity and uncertainty analyses, and update the CRMP tool model. APS will resolve this question as described in Attachment 1.

Page 59 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 22 APLA - Reported Baseline Risk Values LAR Attachment 9, Table A9-1, provides the CDF and LERF values for internal events, internal flooding, internal fire, and seismic events for PVNGS, Units 1, 2, and 3. The CDF and LERF values of each hazard presented in LAR are identical for each unit. Typically, differences in CDF and LERF results exist for multiple-unit plants, even if the differences are not significant. Also, the LAR states numerous times that the risk management process ensures the PRA model used in the application reflects the as-built and as-operated plant for Units 1, 2, and 3. It is not clear to the NRC staff whether the risk values reported in LAR Attachment 2 are the results of separate PRAs performed for each unit or whether PRAs were performed only for a given unit and assumed to represent all three units.

a. If the PRAs were performed only for a given unit and assumed to represent all three units, then for each hazard please justify that the PRA model is an adequate representation of all three units. Please include a discussion of SSCs that are shared between units and how these were implicitly or explicitly modeled.

b. If the PRAs were performed for each unit separately, please explain why the risk results are identical.

APS Response to RAI 22

a. The PRAs were developed based on Unit 1 and modified to capture the scenario impacts and system responses to represent all three units.

Delta assessments for differences between Unit 1 (base model) and Units 2 and 3 have been performed for each hazard and their results documented and incorporated as appropriate. The composite PVNGS PRA model for Units 1, 2, and 3 was confirmed to be representative of the as-built condition of Units 2 and 3 and is not overly conservative for the representation of the as-built condition of Unit 1. A discussion of SSCs that are shared between units and how they are modeled is provided in the RAI 25, APLA - Dependencies Between Units response.

As plant modifications and model refinements are developed, the relative impact on the composite PRA model will continue to be assessed. Since plant modifications are usually installed during refueling outages, the three PVNGS units will have different combinations of modifications installed. Significant impacts will be incorporated by updating the composite (backbone) model with the plant modification and implemented for the specific unit(s) in which the modification(s) have been installed. This may require several official model revisions be maintained to accurately represent the status of implemented modifications. Each revision will be maintained under the PRA model control procedure, 70DP-0RA03, Revision 15, Probabilistic Risk Assessment Model Control.

Page 60 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Internal Events PRA The PVNGS units are three physically separate and independent units that are nearly identical in design, construction, maintenance, and operation. Given that the units are nearly identical, one internal events PRA model was developed using Unit 1 as the base case model.

There are some minor electrical differences between Unit 1 and the other two units:

a) Unit 1 has a breaker between the non-Class 1E 13.8 kV intermediate start-up switchgear (NANS05) and the non-Class 1E 13.8 kV onsite switchgear (NANS03), and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not.

b) Unit 1 is unique in supplying normal power from the start-up transformers to the switchyard and to the Water Resources Facility (WRF) via the non-Class 1E 13.8 kV intermediate start-up switchgear.

c) The units connect to three separate startup transformers for normal and backup power. The startup transformers are identical, so the functions are identical, and the only difference is that different startup transformer and switchyard breaker component numbers are mapped to the basic events for the three units.

These differences represent additional failure modes for Unit 1 components and systems but are insignificant in the base case model.

The results for Unit 1 bound Units 2 and 3.

Internal Fire PRA A review of all unit-specific inputs to the internal FPRA model was conducted and documented to identify unit differences that potentially impact the model. The review identified various as-built/as-operated differences between the PVNGS units. Those that impact the internal FPRA modeling are:

• Relocated ignition source target raceways

• Required cable routing through alternate raceways or fire compartments

• Distances from ignition source to first target or first tray

• HGL timing

• Protected raceways (fire wrap)

An equivalency determination was made regarding each difference with respect to the modeling based on Unit 1 input data. Where Unit 2 Page 61 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times and Unit 3 specific input data was not equivalent or bounded by the Unit 1 modeling, revised data was provided to construct a composite internal FPRA model that represents all the fire induced impacts in all units.

An evaluation of the internal FPRA composite model quantification results was conducted to assess any potential over- or non-conservatism in using either the Unit 1 based internal FPRA model or the internal FPRA composite model.

Recently completed plant modifications and model refinements have resulted in the as-built/as-operated units being more closely aligned.

The resulting delta risk between the internal FPRA baseline model (based solely on Unit 1) and the internal FPRA composite model (based on all fire impacts from all 3 units) is less than 0.5% for CDF and 0.1%

for LERF. The internal FPRA composite model most accurately represents Unit 3, but is a very reasonable representation of all three units. The internal FPRA composite modeling is not overly conservative for the representation of the as-built condition of Unit 1.

Comparison of the internal FPRA baseline model to the internal FPRA composite model also concluded:

• The (unit-specific) impacted scenarios do not significantly change in dominance amongst all ignition source scenarios.

• The ignition source relative contributions were not significantly rearranged.

• All dominant scenarios represent ignition sources existing in all three units.

• Total fire compartment risk contributions also did not significantly change.

Consequently, it is concluded that the relative importance of impacted components is not significantly affected. The minor differences between the units are not expected to result in any impact on the importance of individual components as modeled for risk-informed applications.

Internal Flood PRA The IFPRA was developed for Unit 1. Walkdowns have been performed to confirm/verify the applicability of the Unit 1 flooding analysis to the other two units. No significant flooding related differences were noted between the three units for internal flood. Therefore, Unit 1 is an adequate representation of all three units.

Page 62 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times Seismic PRA The SPRA developed for Unit 1 was assessed for applicability to Unit 2 and 3. Non-significant differences were observed in the SPRA hazard evaluations and a limited subset of the equipment was judged to warrant unit-specific fragility evaluations. The unit-specific fragilities were quantified with both the composite hazard and the Unit 1 SPRA model. The differences in CDF and LERF are minimal.

The seismic hazard evaluation was calculated with a composite profile with a single set of amplification factors, with uncertainties representing differences in site profiles among the three units. A sensitivity analysis was then performed to evaluate the difference in seismic hazard between the three units. The conclusion of the sensitivity study was that from the perspective of seismic hazard, the general differences that can be observed between the composite hazard and the unit-specific hazard do not appear to be significant.

Despite the similarity between the three units, dedicated fragility walkdowns have been performed to confirm/verify the applicability of the Unit 1 analysis to the other two units. Following the walkdowns, a limited numbers of deviations between the three units have been observed that were warranting the development of dedicated Unit 2 and Unit 3 fragility estimates. The fragility analyses for Units 2 and 3 were performed with the same composite hazard developed for the base case (i.e., Unit 1). A limited number of unit-specific fragility parameters were developed where Unit 2/Unit 3 were expected to be different from the Unit 1 fragility parameters. The master fault tree file was modified for Units 2 and 3 and the SPRA results of the quantification is summarized below.

The following list of components is a summary of structural/interaction deviations from Unit 1 that required unit-specific fragility parameters.

• Unit 2 Diesel Generator A Air Intake Structure

• Unit 2 Diesel Generator Room Essential Exhaust Fans

• Unit 3 Diesel Generator Room Essential Exhaust Fans

• Unit 2 Essential Cooling Water A and B Heat Exchangers

• Unit 2 Auxiliary Feedwater Pump A

• Unit 3 480 V Motor Control Center M32

• Unit 3 DC Battery C

• Unit 3 DC Battery D

• Unit 3 Essential Cooling Water B Heat Exchanger

• Unit 3 Diesel Generator A and B Fuel Oil Storage Tanks Page 63 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times The resulting delta risk between the SPRA baseline Unit 1 model and the SPRA Unit 2 and Unit 3 models is less than 0.01% for CDF and LERF. Therefore, Unit 1 is an adequate representation of all three units.

b. PRAs were not performed separately for each unit.

RAI 23 APLA - Plant Modifications DELETED Page 64 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 24 APLA - Modeling Assumptions and Uncertainty - Planned Plant Modifications Regulatory Position 2.3.4 of RG 1.174 states that the PRA results used to support an application are derived from a PRA model that represents the as-built and as-operated plant to the extent needed to support the application.

Consistent with this regulatory position, the PRA should realistically reflect the risk associated with the plant at the time of the application.

The discussion for the key assumption/uncertainty identified in LAR Supplement Attachment 13 (page 13-24) implies that the risk results presented in LAR Supplement Attachment 9 reflects a future plant configuration with additional plant modifications to address fire risk, including installation of an additional Steam Generator Makeup Pump. The NRC staff did not find these modifications listed in LAR Attachment 4. Please provide the following:

a. A description of the planned plant modifications along with the status/schedule for implementation of these modifications to reduce fire risk.

b. Results of a sensitivity analysis if these modifications will not be completed before implementation of the RICT program that includes CDF and LERF for each hazard with these modifications removed from the PRA models.

c. Please discuss your plans to complete these modifications prior to implementation of the RICT program.

APS Response to RAI 24

a. Plant modifications credited in the original LAR submittal (ADAMS number ML15218A300) baseline PRA to address fire risk have been physically implemented in all three units. Any model and/or documentation updates as a result of these physical modifications are being tracked via the PRA model impact database.

b. No sensitivity analysis is required since the modifications have been completed and the model and documentation revisions will be incorporated before implementation of the RICT program.

c. Modifications are complete and have been physically implemented in all three units.

Page 65 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 25 APLA - Dependencies Between Units Regulatory Position 2.3.4 of RG 1.174 states that the PRA results used to support an application are derived from a PRA model that represents the as-built and as-operated plant to the extent needed to support the application.

Consistent with this regulatory position, the PRA should realistically reflect the risk associated with the plant at the time of the application.

LAR Supplement Attachment 9 indicates that PRA models were only developed for one unit because each of the plant units are nearly identical.

The degree of dependency between units is unclear, though LAR Supplement 3 (page 13-2) does state that the station blackout generators (SBOGs) is the only plant system modeled in the PRA that is shared between the three units, that simultaneous multiple unit station blackout conditions are screened based on low probability, and that risk management actions (RMAs) for use of Diverse and Flexible Mitigation Capability [FLEX] equipment will be considered when electric power systems to risk significant equipment are unavailable under a RICT. Given that PRAs were only performed for one unit, please explain how the risk associated with a common cause failure event at one unit is addressed for the other units. Please include discussion of the shared systems (e.g., fire water supply, ultimate heat sink, SBOGs, etc.) and resources needed to address events that would trip multiple units.

If consideration of this risk was excluded, then please justify this exclusion.

Also please address whether RMAs, similar to those being considered for station blackout events, should be considered for other common cause events.

APS Response to RAI 25 The PVNGS units are three physically separate and independent units that are nearly identical. The PRAs were performed for Unit 1 (base model).

Comparisons were made to Units 2 and 3 and a composite PVNGS PRA model for Units 1, 2, and 3 was developed. This composite is representative of the as-built condition of Units 2 and 3, and is not overly conservative for the representation of the as-built condition of Unit 1. The composite PRA model is used separately by each unit to calculate a RICT.

The shared systems between the units are as follows:

1. In normal line-up, the three startup transformers each supply one source of off-site power to two units through separate secondary windings. Thus, loss of one start-up transformer would cause a single train of ESF equipment on two units to lose normal off-site power.

Each startup transformer also supplies backup off-site power to both trains in one unit. Class 1E buses would be powered by the emergency diesel generator on loss of power and then manually transferred back to off-site power by the operators. Loss of offsite power to one ESF bus is not an initiating event. If the unit auxiliary transformer is lost, Page 66 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times non-Class 1E power is transferred using a fast bus transfer to the normally aligned start-up transformer (e.g., reactor coolant pumps remain powered). These electrical alignments are included in the RICT model. Unit 1 has a breaker between the non-Class 1E intermediate start-up switchgear (NANS05) and the non-Class 1E onsite switchgear (NANS03) and similarly a breaker between NANS06 to NANS04, whereas Units 2 and 3 do not. Unit 1 is also unique in supplying normal power from the start-up transformers to the switchyard and to the WRF. Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

2. Layout and functional alignment of the main control boards is equivalent between the units with the exception of main control board B01 for switchyard controls. Units 2 and 3 have mimic boards (indication) for the switchyard and startup transformers, but only have control for closing their own units breakers and must coordinate with Unit 1 for operation of the SBOGs. SBOG HFEs were already captured with the Unit 1 modeling. The impact of the Unit 1 control room breaker control circuits on Units 2 and 3 was screened out based on:

the hot-short opening of a breaker due to a fire in Unit 1 impacting Units 2 or 3 being below the quantitative screening criteria (< 1.0E-7/yr for CDF and < 1.0E-8/yr for LERF), lack of impact to any of the mitigating equipment, the rare occurrence of an internal fire initiated LOOP in industry, the inclusion of industry historical data in the PVNGS values for plant-centered LOOP and switchyard-centered LOOP, and the small contribution of LOOP to internal fire CDF and LERF.

Therefore, Unit 1 has the most limiting feature for all three units and is represented in the base model.

3. Another common electrical connection is to the SBOGs. It is not expected that more than one unit would ever be lined up to receive power concurrently from the SBOGs, although procedures exist to provide limited power to Units 1 and 2 or 1 and 3 (not modeled in the PRA). The likelihood of two units experiencing a simultaneous station blackout is screened out due to its low probability. When a LOOP is experienced on one or both ESF buses in any unit, operators are dispatched to manually start the SBOGs within one hour. As indicated above, SBOG HFEs were already captured with the Unit 1 modeling.

4. The PVNGS fire water supply is also shared between the units. There are two separate, reliable fire water supply tanks located near the WRF boundary. Both tanks are interconnected and the fire protection pumps can take suction from either or both. The headers are arranged in a loop system with two headers running from the pump house along the north and south sides of the power plants. A significant leak in one tank or its piping will initiate a low level alarm alerting operators in the Unit 1 control room. Three redundant and diverse (one electrical and Page 67 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times two diesel driven) fire pumps are available to supply pressure for the fire main when it exceeds the capacity of the jockey pump.

A seismic failure of the fire protection water main is a potential source of common cause failure of the fire water suppression system. The fire protection water main consists primarily of a closed 12-inch underground loop encompassing all units, the service and administration buildings, and site construction buildings. The yard main is provided with post-indicator valves for sectional control. Post-indicator valves are also located such that the yard loop for any individual power block can be isolated from the yard loops of the remaining units. Outside hydrants are provided at approximately 250-foot intervals within the power block area and as required near other hazards and near other remote buildings. Hydrants are equipped with 21/2-inch hose connections. According to the Updated Final Safety Analysis Report (UFSAR), in the unlikely event that the plant fire pumps cannot furnish an adequate water supply to the distribution system, the yard main includes pump connections for obtaining water from the circulating water system cooling tower basin by using portable pumping units. Procedure 14OP-0FP05, Revision 5, Isolation of the Fire Water Suppression System, directs the fire protection personnel in the correct operation of isolating specific portions of the fire water suppression system. In doing so, a damaged section of the fire protection water main can be isolated to ensure proper operation elsewhere.

Another mode of failure for the fire water system is seismically induced common cause failure of the fire water pumps. During normal operation, the fire protection water system is kept continuously full and pressurized by the jockey pump. When significant flow (more than 40 gpm) is required to the fire water system, the fire pumps are designed to start sequentially on decreasingly lower pressures in the fire main. Normally, the first fire pump to start would be the motor-driven fire pump when the pressure in the fire main header drops to 95 psig. If the fire main pressure drops below 90 psig and remains below that point for at least 20 seconds, the first diesel-driven fire pump cycles on. The second diesel-driven fire pump will cycle on if the pressure in the fire main header drops below 85 psig and remains below that pressure for at least 30 seconds, according to the UFSAR.

Common cause or correlated seismic failure of all fire pumps is mitigated with the availability of a backup fire pump configuration outlined in procedure 14OP-9FP07, Revision 0, Backup Fire Pump Installation.

Low-pressure carbon dioxide systems are provided for total flooding and local hand hose application in those areas indicated in Table 9.5-1 of the UFSAR. In addition, Halon 1301 fire suppression flooding systems are provided to protect additional areas. Each area has its Page 68 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times own main and auxiliary gas bottles that are anchored. Therefore, given each area has its own localized source and components, common cause failure due to seismically induced failure is not a concern.

Finally, the PVNGS fire department has recently purchased five fire protection apparatus: three pumpers, one 78-foot aerial ladder/pumper, and one nuclear emergency response vehicle (NERV).

The three pumpers are tilt table qualified to 26.5 degrees. The NERV is tilt table qualified to 30 degrees. All of these firefighting vehicles comply with the UFSAR requirement to address fire header decapitation and supply water to the fire protection systems within each unit.

Therefore, common mode failure of the fire water system to more than one unit is screened out.

5. The units are also connected via the auxiliary steam system, which supplies process steam for water processing and turbine gland seals during secondary plant start-up. The normal line-up of this system is one unit supplying auxiliary steam for all three units. This sharing is done primarily to keep the lines warm and the water within them in good condition. Malfunctions of the system are not significant enough perturbators to cause a trip or shutdown; nor is the system credited in the PRA for mitigating any transients or accidents. For these reasons, the auxiliary steam system is not modeled in the PRA. Procedures do exist, however, to transfer condensate from one unit to another, if needed.

6. The tower make-up and blowdown system supplies makeup condenser cooling water to all three units to make up for evaporation and blowdown. Failure would lead to shutdown of all three units due to lowering level in the circulating water intake for each of the units. It has redundant pumps powered from redundant power supplies, making it highly reliable. Should it fail, it would most likely manifest as a normal shutdown for all three units. At worst, it could lead to loss of condenser vacuum and loss of plant cooling water. It is not required for safe shutdown. For these reasons, the tower make-up and blowdown system is not modeled in the PRA.

PVNGS procedures will contain specific guidance for implementing RMAs to address common cause events.

Page 69 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 26 APLA - T.S. 3.8.4 Regulatory Position 1.1.2 of RG 1.177, Revision 1, states that TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective.

In LAR Supplement Attachment 5, Table A5-2, both the high and low estimates of the calculated RICT are reported to be less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for proposed Condition C of Technical Specification LCO 3.8.4 DC Sources -

Operating. While proposed Condition C is for a loss of function and has a proposed backstop of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the Condition is a high risk configuration that would appear to always exceed the acceptance guidelines for incremental CDP [ICDP] and incremental large early release probability [ILERP] in NEI 06-09-A. Please provide technical justification for inclusion of Condition C for LCO 3.8.4 given the reported high risk for this condition.

APS Response to RAI 26 For LCO 3.8.4, DC Sources - Operating, there are two independent and redundant safety related Class 1E DC electrical power subsystems (Train A or Train B) which are subdivided into channels. Train A consists of Channel A and Channel C. Train B consists of Channel B and Channel D. Channel A includes 125 VDC bus PKA-M41, 125 VDC battery bank PKA-F11, and normal battery charger PKA-H11 or backup battery charger PKA-H15. Channel C includes 125 VDC bus PKC-M43, 125 VDC battery bank PKC-F13, and normal battery charger PKC-H13 or backup battery charger PKA-H15. Channel B includes 125 VDC bus PKB-M42, 125 VDC battery bank PKB-F12, and normal battery charger PKB-H12 or backup battery charger PKB-H16. Channel D includes 125 VDC bus PKD-M44, 125 VDC battery bank PKD-F14, and normal battery charger PKD-H14 or backup battery charger PKB-H16.

The calculated RICT values in the LAR Supplement Attachment 5, Table A5-2, for both the high and low estimates for Condition C were overly conservative estimates. The estimates for Condition C considered the inoperability of both Class 1E DC electrical power subsystems (Train A and Train B), which includes all battery chargers (normal and backup) and all battery banks.

The high estimate case for entry into the new Condition C would be a loss of a battery charger on one channel (Channel A or C for Train A or Channel B or D of Train B) for each of the two subsystems (Train A or Train B). provides the new high RICT estimate for the high estimate case for entry into the new Condition C.

Page 70 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 27 APLA - Risk Management Actions

a. LAR Attachment 12 states that PVNGS will use either the EPRI CRMP tool for RICT Program calculations. The EPRI tool provides insights such as the important equipment available during the RICT to help in identifying RMAs. However, other insights (e.g., important fire areas) may also be checked for potential RMAs. Please describe how the RICT program guidance considers insights, other than the CRMP tool-generated list of equipment, to identify RMAs.

b. In addition, given component(s) are PRA functional or not PRA functional, please discuss how the RICT program will ensure appropriate RMAs are established.

APS Response to RAI 27

a. PVNGS will use the EPRI Phoenix Risk Monitor tool for RICT calculations. Phoenix Risk Monitor is the modern successor to the EPRI Equipment Out of Service (EOOS) tool and thus has the same functionality, including the same RMA insights as EOOS. Examples of insights Phoenix Risk Monitor is capable of producing includes equipment importance, human action importance, and initiator contribution.

In addition to considering the insights offered by Phoenix Risk Monitor, PVNGS procedure(s) will dictate required RMAs associated with each LCO under the PVNGS RICT program. These RMAs will be developed to incorporate the guidance from multiple industry documents, including NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NEI 06-09, Risk-Informed Technical Specifications Initiative 4b Risk-Managed Technical Specifications (RMTS) Guidelines, Regulatory Guide 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, INPO 12-008, Excellence in Integrated Risk Management, and INPO 13-001, Protecting Equipment.

PVNGS will also implement RMAs beyond those predetermined by procedure or suggested by the Phoenix Risk Monitor. For example, the current PVNGS process for configuration risk management includes identification of important fire zones in elevated risk conditions. Once identified by PRA staff, PVNGS fire protection develops RMAs for the identified fire zones. PVNGS will continue this practice under the RICT program, as well as consider other unique plant conditions that would warrant additional RMAs.

Page 71 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

b. If the RICT process is entered, PVNGS procedures will direct users to enact pre-defined RMAs and, if warranted, develop configuration-specific RMAs regardless of the functionality of associated equipment (i.e., the RMA process will be implemented regardless of PRA functionality).

Page 72 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 28 APLA - Joint Human Error Probability Floor Guidance in NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), (Table 2-1) April 2005, (ADAMS Accession No. ML051160213) recommends joint human error probability (HEP) values should not be below 1E-05. Table 4-3 of EPRI 1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, provides a lower limiting value of 1E-06 for sequences with a very low level of dependence. The NRC staff notes that underestimation of minimum joint probabilities could result in non-conservative RICTs of varying degrees for different inoperable SSCs.

Given that it is not clear whether or to what extent a dependency analysis was performed as part of the HRA, and whether minimum joint probabilities were applied to combinations of HEPs appearing in the same cutset, please provide the following:

a. Please describe the HRA dependency analysis performed in the PRA and whether it is consistent with NRC accepted guidance. If the approach to performing HRA dependency analysis is not consistent with NRC guidelines, then please justify this departure.

b. Please confirm that each joint HEP value used in the internal events PRA below 1E-06 and each joint HEP used in the fire PRA below 1E-05 includes its own separate justification that demonstrates the inapplicability of the NUREG-1792 lower guideline values. Please provide an estimate of the number of joint HEPs below the guideline values, discuss the range of values, and provide at least two different examples where justification has been developed.

c. If the assessment described in item b) has not been performed or if minimum joint probability floor was not applied or the value of the floor cannot be justified, then please explain how underestimating joint HEPs impacts the RICT estimate.

APS Response to RAI 28

a. PVNGS uses the EPRI HRA calculator to calculate dependencies for combinations of HEPs in the same cutset. The PVNGS internal fire PRA and internal events models use a minimum joint HEP value (floor) of 1E-05 in the dependency analysis, with no exceptions, as documented in PRA Study 13-NS-F010, Post-Fire Human Reliability Analysis [HRA],

Revision 0, and PRA Study 13-NS-B062, At-Power PRA Study for Human Reliability Analysis, Revision 13, respectively. Therefore, they are consistent with the guidance in NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), April 2005, to not use joint HEP values below 1E-05.

Page 73 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

b. The PVNGS internal FPRA and IEPRA models use a minimum joint HEP value (floor) of 1E-05 in the dependency analysis, with no exceptions, so no justifications are required.

c. As the 1E-05 floor is met without exceptions, the joint HEPs are not underestimated for RICT.

Page 74 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times RAI 29 APLA - Modeling Assumptions and Uncertainty - Battery Life Regulatory Position 2.3.4 of RG 1.174 states that the PRA results used to support an application are derived from a PRA model that represents the as-built and as-operated plant to the extent needed to support the application.

Consistent with this regulatory position, the PRA should realistically reflect the risk associated with the plant at the time of the application.

The discussion and disposition for the key assumption/uncertainty identified in LAR Supplement Attachment 13 (page 13-5) states that a battery life of two hours was assumed in the PRA, but implies that procedures are available for load shedding to extend battery life for up to six hours. The disposition further states that this assumption is conservative for the RICT program.

The NRC staff questions that the allowable RICT calculated assuming a two hour battery life is less than (conservative) the allowable RICT calculated assuming a six hour battery life. Please provide the following:

a. Please clarify if plant procedures are available for load shedding and, if so, please describe the conditions under which these procedures would be implemented.

b. If plant procedures are available for load shedding and extending battery life, please provide justification for the conclusion that the PRA assumption of a 2-hour battery life would result in a conservative RICT for a battery removed from service, including providing an example calculation to support this justification.

APS Response to RAI 29

a. Plant guidelines are available for load shedding during an ELAP event to extend Class 1E 125 VDC battery life for as long as possible in order to provide power to a reduced set of loads, allowing control room operation of atmospheric dump valves and the steam-driven Train A auxiliary feedwater pump. The DC load shed actions are in procedure 79IS-9ZZ07, Appendix A, Revision 7, PVNGS Extended Loss of All Site AC Guideline, Modes 1-4. Entry conditions for performance of this guideline are as directed by emergency operating procedure 40EP-9EO08, Revision 25, Blackout, Step 13, Contingency Action 13.2:

If AC power will NOT be available from offsite power, an SBOG, or any Units EDG within one hour of start of the event (ELAP), THEN perform the following: a. Declare an ELAP is in progress, b. Perform 79IS-9ZZ07.

Procedure 79IS-9ZZ07 is the only battery load-shedding strategy employed at the PVNGS units.

Page 75 of 76

Enclosure APS Response to RAI for Risk-Informed Completion Times

b. The ELAP guideline (79IS-9ZZ07) was issued after the development of the PRA model utilized for the LAR. The impact to the PRA model of this new guideline will be evaluated in accordance with procedure 70DP-0RA03, Revision 15, Probabilistic Risk Assessment Model Control. The evaluation will consider, at a minimum, the effects of extending battery life, applicability to specific ELAP scenarios, and the impact of shed loads.

The battery load-shedding strategy for an ELAP results in a safe stable end-state at the 24-hour PRA mission time. Battery capacities in a load-shed scenario were validated to support a minimum of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> of ELAP conditions with the expectation that the 480V FLEX generators are deployed and operational within 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> to restore AC power to the battery chargers. Portable generators (4160V) are also available to restore AC power to the unit.

The PRA model used to support the RICT Program will be controlled by PVNGS procedures to reflect the as-built, as-operated plant condition.

Page 76 of 76

Attachment 1 PVNGS RICT PRA Implementation Items

Enclosure Attachment 1 Attachment 1 PVNGS RICT PRA Implementation Items Table 1-1 below identifies the items that are required to be completed prior to implementation of the RICT program at Palo Verde Nuclear Generating Station (PVNGS), Units 1, 2 and 3. Issues identified below will be addressed and any associated changes made, focused scope peer reviews will be performed on changes that are PRA upgrades, as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and findings will be resolved and reflected in the PRA of record prior to implementation of the RICT program.

Table 1-1 PVNGS RICT PRA Implementation Items Description Resolution

1. The June 2017 F&O Closure Review of peer Conduct an augmented F&O closure review of the review findings did not include: June 2017 F&O Closure Review findings to include:

a. Documentation of the basis for the a. Documentation of the basis for the maintenance versus upgrade maintenance vs upgrade determination for determination for each reviewed F&O each reviewed F&O finding finding b. A review of F&O findings from the other

b. A review of F&O findings from the other external hazards peer review external hazards peer review c. Documentation of the review of supporting

c. Documentation of the review of requirements determined not met to CC-II supporting requirements determined from the self-assessment of the IEPRA model not met to CC-II from the self- against all supporting requirements in assessment of the IEPRA model against ASME/ANS RA-Sa-2009 as endorsed by RG all supporting requirements in 1.200, Revision 2 ASME/ANS RA-Sa-2009 as endorsed by d. Complete required documentation of F&O RG 1.200, Revision 2 closure review per Appendix X to NEI 05-04

d. Required documentation of F&O closure review per Appendix X to NEI 05-04 These actions are indicated in the response to RAIs 10.a, 10.d, 11, and 14, in APS letter dated May 18, This condition is described in response to RAIs 2018.

10.a, 10.d, 11, and 14, in APS letter dated May 18, 2018.

Page 1 of 3

Enclosure Attachment 1 Table 1-1 PVNGS RICT PRA Implementation Items Description Resolution

2. Four PRA model upgrades were identified from Conduct a focused scope peer review for the a review of all PRA model changes not following PRA model upgrades:

reviewed by peer reviews: a. The common cause methodology change

a. The common cause methodology was from the MGL method to the Alpha Factor changed from the MGL method to the method Alpha Factor method b. The HRA methodology change from the

b. The HRA methodology was changed SHARP model to the EPRI HRA Calculator from the SHARP model to the EPRI HRA software Calculator software c. PRA Impact 2003-301 that incorporated new

c. PRA Impact 2003-301 incorporated new modeling for pressure-induced SGTR using modeling for pressure-induced SGTR CE NPSD-1124, Methodology for Modeling using CE NPSD-1124, Methodology for Main Steam Line Breaks, Revision 0 Modeling Main Steam Line Breaks, d. PRA Impact 2013-151 that significantly Revision 0 impacted the results from the IFPRA model

d. PRA Impact 2013-151 updated the IFPRA model resulting in a significant These actions are indicated in response to RAIs 7, impact on the results 10.c, and 10.d, in APS letter dated May 18, 2018.

This condition is described in response to RAIs 7, 10.c, and 10.d, in APS letter dated May 18, 2018.

3. The PRA models are being revised to Revise the PRA models to incorporate resolutions to incorporate resolutions to all open F&O findings all open F&O findings and internal FPRA guidance and internal FPRA guidance more recently more recently endorsed by the NRC as indicated in endorsed by the NRC as indicated in response the license amendment request Supplement for to RAIs 17.c, 17.d, and 21, in APS letter dated Risk-Informed Completion Times dated November May 18, 2018. The PRA model total CDF and 3, 2017.

total LERF after these changes are incorporated must meet RG 1.174 risk limits of This action is indicated in the response to RAIs 1.a, 1E-4/year for CDF and 1E-5/year for LERF as 1.b, 6.d, 8, 9, 17.c, 17.d, and 21 in APS letter indicated in License Amendment Supplement dated May 18, 2018.

for Risk-Informed Completion Times dated November 3, 2017. Ensure after these changes are incorporated as indicated in the response to RAIs 17.c, 17.d, and This condition is described in the response to 21 that the PRA model total CDF and total LERF are RAIs 1.a, 1.b, 6.d, 8, 9, 17.c, 17.d, and 21 in below the limits established in RG 1.174, which are APS letter dated May 18, 2018. 1E-4/year for CDF and 1E-5/year for LERF.

4. Evaluate RCP seal leakage as an initiating Conduct an evaluation of the RCP seal leakage as event and impact on mitigation functions as an initiating event and impact on mitigation described in SRs IE-C6, SY-A15, and SY-B13. functions as described in SRs IE-C6, SY-A15, and Utilize the implementation guidance of WCAP- SY-B13. Utilize the implementation guidance of 15749-P, Revision 1, RCP Seal Failure Models WCAP-15749-P, Revision 1, RCP Seal Failure of WCAP-16175-P-A, and consider the Models of WCAP-16175-P-A, and consider the conditions, limitations, and modifications conditions, limitations, and modifications identified identified in the safety evaluation (ADAMS No. in the safety evaluation (ADAMS No.

ML070240429). ML070240429).

This condition is described in the response to This action is indicated in response to RAI 16 in RAI 16 in APS letter dated May 18, 2018. APS letter dated May 18, 2018.

Page 2 of 3

Enclosure Attachment 1 Attachment 1 Additional Conditions Operating License Nos. NPF-41, NPF-51, and NPF-74 APS proposes the following license conditions, Table 1-2, be added to Appendix D of the PVNGS Units 1, 2, and 3 Renewed Operating Licenses:

Table 1-2 Additional Conditions Amendment Additional Conditions Implementation Number Date Arizona Public Service Company (APS) is approved to implement the risk-informed completion time (RICT) program specified in license amendment [NUMBER] dated

[DATE].

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

[NUMBER] APS will complete the implementation items listed in the Prior to implementation of Enclosure of APS letter 102-07587, dated November 3, RICT program.

2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07691, dated May 18, 2018, prior to implementation of RICTs. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the RICT program.

Page 3 of 3

Attachment 2 Significant Changes to the PVNGS Internal Events, Internal Flooding, Seismic, and Internal Fire PRA Models

Enclosure Attachment 2 ATTACHMENT 2 Significant Changes to the PVNGS Internal Events, Internal Flooding, Seismic, and Internal Fire PRA Models

RAI 10

As discussed in APS Response to RAI 10, changes to the PRA since 1999 have been reviewed against the information provided in ASME/ANS RA-Sa-2009 PRA Standard and RG 1.200, Revision 2, to classify each as either an upgrade or maintenance. The process used for the classification of the changes and the results of the review are documented in engineering evaluation 18-00619-003. This attachment provides the list of significant changes included in the evaluation along with a brief summary of the process used for the classification.

Justification/Basis for an upgrade classification includes any one of the following:

• Methodology change

• Scope change

• Capability change In order to provide the basis or justification for those items determined to be maintenance, the changes were reviewed against Section 1.A.2 and the examples provided in Section 1-A.3 of the ASME/ANS RA-Sa-2009 PRA Standard Non-mandatory Appendix 1-A. These were used to identify that which most closely corresponds to the change being made to the PVNGS PRA model. Consistent with the ASME Standard, maintenance changes have been determined to have no significant change to risk insights and no impact on significant accident sequences.

Table 2-1 provides the significant changes to the IEPRA Model and Table 2-2 provides the significant changes to the internal flooding, fire and seismic PRA models, along with their classification and associated justification/basis.

Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 2/19/2002 1998-35 Address miscalibration of critical sensors. Upgrade Methodology Change -

F&O HR-03 New THERP HRA approach to common New THERP HRA method cause failure of miscalibration of sensors. used 2/4/2003 1998-37 Update ECCS success criteria to be Maintenance Implemented change to the consistent with CE NPSD-1072-P and new PRA model due to new MAAP case entries and update common industry and plant cause modeling conditional upon Line knowledge using processes Break previously applied 2/19/2002 1999-177 Correct modeling of SG downcomer and Maintenance Implemented model bypass flow feed control logic, missing corrections were neither so CCF events for block and bypass valves, numerous nor so large that HRA missing procedure steps, and the significant changes to risk existing common cause event for the insights or accident Page 1 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade control valve(s). The correction results in sequences result a less than 1% change in CDF.

7/13/2001 1999-6 Model DMWOs 746729 and 805235 Maintenance Incorporated model changes installation of digital feedwater control to reflect plant design systems. FWCS will have dual power changes consistent with supplies, NNND11 and NNND12, rather ASME PRA Standard Section than FWCS1 from NNND11 and FWCS2 1-A.2 from NNND12.

2/19/2002 2001-167 Update model to reflect DWG 13-10407 Maintenance Incorporated model changes J104-76-9 which indicates a modification to reflect plant design that changed the power supply to one of changes consistent with the two fans in each BOP-ESFAS cabinet ASME PRA Standard Section and revise loss of cabinet cooling 1-A.2 operator response 2/19/2002 2001-2 Incorporate changes to LERF Model in Maintenance Implemented model order to account for Boundary Conditions corrections were neither so defined in the Level 1 Trees. numerous nor so large that significant changes to risk insights or accident sequences result 2/19/2002 2001-210 Add the alternate off-site power supply to Maintenance Implemented change to the each ESF bus, as well as the GTGs, in the PRA model due to new IE trees for losses of power which splits industry and plant the ESF bus and OSP loss initiators from knowledge using processes the PN IEs. previously applied 2/19/2002 2001-212 Replace Basic Events SYFAULTSXM3-- Maintenance Implemented change to the 2PW and SYFAULTSXM2--2PW with PRA model using processes developed fault trees for switchyard previously applied components to support Maintenance Rule risk evaluations for the switchyard. Also address scheduled maintenance time.

2/4/2003 2002-182 Correct modeling for testing ESF trip Maintenance Implemented model initiation logic to reflect relay test corrections were neither so configuration of trip vs. bypass and numerous nor so large that reflect potential increase in spurious trip, significant changes to risk revise assumption for modeling UV relay insights or accident testing (32ST-9ZZ03), and add sequences result assumption describing modeling for testing that bypasses ESFAS channels.

2/4/2003 2002-218 Change status logic for PKA and PKB Maintenance Implemented model batteries. Correct CM logic for IA corrections were neither so compressors. Add a term to the delete- numerous nor so large that term fault tree to remove LOOP--2PW significant changes to risk with IEDCHVAC; alter logic for setting insights or accident running chillers and air compressors. sequences result 12/30/2010 2002-3 Modify LERF trees to address more recent Maintenance Data update using new PVNGS, industry and regulatory technical industry and plant-specific positions regarding AFW level control, data and Bayesian update AFW PRA success, and probability of process previously Pressure and Thermally induced SG tube employed ruptures.

6/2/2004 2003-1 Change the exchanges in RS with Maintenance Implemented model negated logic to avoid mapping corrections were neither so difficulties in EOOS. Also, delete numerous nor so large that exchange for HJBZ04 OOS in gate significant changes to risk GECB12. insights or accident sequences result Page 2 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 6/2/2004 2003-176 Change SG blowdown pathway from the Maintenance Implemented model Blowdown Flash Tank to the condenser. corrections were neither so Maintenance events may no longer be numerous nor so large that valid for different pathway. significant changes to risk insights or accident sequences result 6/2/2004 2003-301 Incorporate Pressure-Induced SGTR Upgrade Methodology Change -

modeling into SLB event tree. New methodology used for PI-SGTR modeling 1/11/2006 2004-132 Revise model to properly reflect S/U Maintenance Implemented model Transformer SWYD breakers OOS corrections were neither so condition. Currently power to NAN-S05/6 numerous nor so large that is failed even when loads are transferred significant changes to risk to the Alternate S/U Transformer insights or accident sequences result 1/11/2006 2005-122 Incorporate PPS Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-123 Incorporate EC and WC Common Cause Upgrade Methodology Change -

Modeling changes from MGL to Alpha Common Cause Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-124 Incorporate GT Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-125 Incorporate PN Common Cause Modeling Upgrade Methodology Change -

changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-126 SI Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-127 CD (Altfw) Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-163 SG Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-164 CL (Containment Isolation) Common Upgrade Methodology Change -

Cause Modeling Changes from MGL to Common Cause Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-165 EW Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-166 HJ Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor Page 3 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade 1/11/2006 2005-167 IA-GA Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-170 PK System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-171 DG, PB, PE and Off-Site Power Systems Upgrade Methodology Change -

Common Cause Modeling Changes from Common Cause MGL to Alpha Factor. Methodology changed from MGL to Alpha Factor 1/11/2006 2005-172 RC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-173 SP System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/11/2006 2005-174 NC System Common Cause Modeling Upgrade Methodology Change -

Changes from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-2 Modify Small LOCA event tree to reflect Maintenance Implemented change to the testing and analysis done in support of PRA model due to new the sump air entrainment issue under industry and plant CRDR 2726509. knowledge using processes previously applied 1/11/2006 2005-207 Incorporate Alpha Factor Parameters for Upgrade Methodology Change -

Common Cause Modeling Common Cause Methodology changed from MGL to Alpha Factor 1/1/2006 2005-97 AF Common Cause Modeling Changes Upgrade Methodology Change -

from MGL to Alpha Factor. Common Cause Methodology changed from MGL to Alpha Factor 9/28/2007 2006-124 Calculation of control circuit risk based on Maintenance Implemented model individual components may overestimate corrections were neither so its risk contribution. This impact numerous nor so large that consolidates the control circuit failure significant changes to risk contribution back into the start failure insights or accident rate for motor operated pumps and DGs. sequences result 9/28/2007 2006-226 Update MSIV modeling due to DMWO Maintenance Incorporated model changes 2417258, which added redundant closing to reflect plant design solenoid on each train of hydraulics. changes consistent with ASME PRA Standard Section 1-A.2 9/28/2007 2006-294 Correct mission times for DC power Maintenance Implemented model systems to better reflect support needed corrections were neither so for bringing in off-site or GTG power. numerous nor so large that Also, limit battery FTR applicability to significant changes to risk Page 4 of 11

Enclosure Attachment 2 Table 2-1 Significant Changes to the Internal Events PRA Model Change Change Maintenance Change Basis Date ID or Upgrade SBO conditions. insights or accident sequences result 9/28/2007 2007-140 Assumption to not credit MFW for greater Maintenance Implemented model than 30 minutes has resulted in corrections were neither so significant dominant cutsets in latest numerous nor so large that revision (C29 r15 working copy dated significant changes to risk 7/12/07) to be inappropriate. insights or accident sequences result 12/18/2008 2007-207 The Fault Tree that contained 1RCS- Maintenance Implemented model DEPRESS-2HR was deleted by impact corrections were neither so 2007-38. The HRA was inadvertently not numerous nor so large that restored. However, the HRA is called on significant changes to risk by a function event. This Impact restores insights or accident the HRA. sequences result 12/17/2008 2007-209 EDG failures need to be parsed into three Maintenance Implemented change to the categories to conform to NRC data and PRA model due to new MSPI program. industry and plant knowledge using processes previously applied 1/7/2010 2007-67 There is an inconsistency between how Maintenance Implemented model the primary safety fail open event and an corrections were neither so SLOCA are modeled for CS. The primary numerous nor so large that safety failure does not credit CS, but the significant changes to risk SLOCA does and the largest SLOCA is the insights or accident same as the primary safety fail open sequences result event hole size.

1/7/2010 2009-153 Add modeling for fuel oil transfer pumps, Maintenance Implemented change to the DFA(B)P01. MSPI is expected to have PRA model due to new these as separate components. industry and plant knowledge using processes previously applied 2/3/2010 2009-247 Add modeling for the UV relays that Maintenance Implemented change to the cause turbine trip after reactor trip. This PRA model due to new would allow use of the favorable MTC industry and plant fraction on the success branch and knowledge using processes eliminate need of the unfavorable previously applied fraction.

12/30/2010 2010-219 Use of HRA Calculator vs. manual SHARP Upgrade Methodology Change -

HRA worksheets and Dependency SHARP HRA conversion to Analysis changes. HRA Calculator 12/7/2014 2015-836 This impact documents, by reference, the Maintenance PRA Software code change changes to the internal events model from one fault tree linking from Risk Spectrum Rev 20 to CAFTA code to another with new model. code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes Page 5 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 11/16/2013 2013-151 Update internal flood PRA model to address Upgrade Capability Change -

results from associated CRAIs from CRDR Impact to Significant 3590575. Sequences (2 Orders of Magnitude difference) 11/16/2013 2015-868 Incorporate Internal Flood Model Impact Maintenance PRA Software code 2013-151 into CAFTA. change from one fault tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 11/11/2014 2018-2448 Tripping RCP Breaker Locally Maintenance Implemented model DRC R55 40OP-9ZZ19 allows for local RCP breaker trip corrections were neither with AO pre-stationed during fires in specific so numerous nor so fire zones. Internal FPRA allows 45-60 large that significant minutes to stop RCPs which is sufficient time changes to risk insights for AO to respond locally for any fire without or accident sequences pre-staging prior to need. result 3/6/2014 CS-A6-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new cable and results provided in Report 0001-0013- selection methodology 001-002 Revision 0 (Hughes Associates) for regarding fire-induced active tripping of an overcurrent fault to the loss of active tripping internal fire PRA model. capability electrical protection.

12/6/2014 PRM-B2-n/a PVNGS internal FPRA is developed in the Maintenance PRA Software code CAFTA suite of software, which is a different change from one fault fault tree tool than Risk Spectrum. tree linking code to another with new code well documented and accepted by the PRA community, with change documentation including meaningful results comparisons and disposition of differences between the old and new codes 9/27/2014 CS-B1-01 Cable Selection and Circuit Analysis study Upgrade Methodology change -

was revised to incorporate the methodology Implements new breaker and results provided in Report 0001-0013- coordination 001-003 Revision 1 (Hughes Associates) with methodology that also respect to breaker coordination impacted significant sequences.

Page 6 of 11

Enclosure Attachment 2 Table 2-2 Significant Changes to Internal Flooding, Fire and Seismic PRA Models Change Maintenance Impact ID Change Title Basis Date or Upgrade 12/7/2014 QLS-A1-01, Based on the resolution of F&Os QLS-A2-01 Upgrade Methodology Change -

QLS-A2-02, and QLS-A2-02, using the revised qualitative New Qualitative QLS-A2-01 screening criteria Based on the resolution of Screening Methodology F&Os QLS-A2-01 and QLS-A2-02, using the employed revised qualitative screening criteria documented in the Screening and Quantification study section 4.2.1, the study was revised and documents the basis for screening any fire compartments 10/16/2014 FSS-D1-01 Incorporate Report 0001-0014-002-001 Upgrade Methodology Change -

Revision 0 for HGL New Hot Gas Layer methodology applied 10/11/2014 2018-2448 Revised sources to include transitioned Upgrade Methodology Change -

DRC T107 segmented bus duct method New Bus Duct Methodology utilized 12/6/2014 PRM-A3-01 A comprehensive re-evaluation of the Loss of Upgrade Methodology Change -

RCP Seal Cooling accident progression and New Loss of RCP Seal success criteria was conducted to bound the Cooling Modeling scope of failure scenarios Methodology.

8/27/2013 SHA-E1-01 New site specific data was subsequently Upgrade Methodology change -

collected as part of the Near Term Task Implements a different Force (NTTF) 2.1 analysis. Lettis Consultants methodology for seismic International, Inc. Project Report 221-PR-04 hazard evaluation than Revision 4 documents the updated seismic previously applied.

hazard evaluation for PVNGS.

Page 7 of 11

Enclosure Attachment 2 Attachment 2, Table 2-3 below provides those Internal Events PRA changes that were determined to be PRA Upgrades.

Table 2-3 Identified PVNGS Internal Events PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 1998-35, 2/19/02 New HRAs in the area of Methodology New THERP Events F&O HR-03 miscalibration of critical Change approach to sensors common cause failure of miscalibration of sensors 2003-301 6/2/04 Incorporate Pressure-Induced Methodology New PI-SGTR SGTR modeling into SLB event Change Methodology tree.

2005-122 thru - 1/11/06 System Common Cause Methodology Common Cause 127, 2005-163 Modeling Changes: Change Methodology thru, 2005-167, PPS, EC/WC, GT, PN, SI, CD changed from MGL 2005-170 thru - (Altfw), SG, EW, IA-GA, PK, to Alpha Factor 174, 2005-207, DG, PB, PE and Off-Site 2005-97 Power, RC, SP, NC, DC, AF 2010-219 12/30/10 Use of HRA Calculator vs. Methodology SHARP HRA manual HRA worksheets and Change conversion to HRA Dependency Analysis Calculator Methodology changes Page 8 of 11

Enclosure Attachment 2 , Table 2-4 below provides the Internal Events PRA upgrades identified in Part (b).

Table 2-4 Peer Reviews of Internal Events PRA Upgrades Upgrade Change Hazard Description Upgrade Review Review Results Date

/ New Findings Internal 2/19/02 New THERP approach to Finding Level Fact and F&O Closed.

Events common cause failure Observation Closure Review Associated HR TEs of miscalibration of conducted April 19, 2017 (HR-4, HR-5, HR-6, sensors through June 23, 2017. and HR-7) met Report Date: June 23, 2017 6/2/04 New PI-SGTR Focused Scope Peer Review TBD Methodology as described in Attachment 1

1/11/06 Common Cause TBD Methodology changed from MGL to Alpha Factor 12/30/10 SHARP HRA conversion TBD to HRA Calculator Page 9 of 11

Enclosure Attachment 2 Attachment 2, Table 2-5 below provides those changes that were determined to be PRA Upgrades.

Table 2-5 Identified Internal Flood, Internal Fire and Seismic PRA Upgrades Change Upgrade Hazard Change ID Change Description Date Type Internal 2013-151 11/16/13 Update internal flood PRA Capability Impact to Significant Flooding model to address results Change Sequences (2 orders of from associated CRAIs from magnitude difference in CRDR 3590575 results)

Internal CS-A6-01 (F) 3/6/2014 Cable Selection and Circuit Methodology New cable selection Fires Analysis study was revised Change methodology regarding to incorporate the fire-induced loss of methodology and results active tripping capability provided in Report 0001- for electrical protection 0013-001-002 Revision 0 CS-B1-01 (F) 9/27/2014 Cable Selection and Circuit Methodology New breaker Analysis study was revised Change coordination to incorporate the methodology methodology and results provided in Report 0001-0013-001-003 Revision 1 QLS-A1-01 (F) 12/7/2014 Revised qualitative Methodology New Qualitative QLS-A2-01 (F) screening criteria Change Screening Criteria QLS-A2-02 (F) documented in the Screening and Quantification study section 4.2.1 PRM-A3-01 (F) 12/6/2014 A comprehensive re- Methodology New Loss of RCP Seal evaluation of the Loss of Change Cooling modeling RCP Seal Cooling accident methodology progression and success criteria was conducted to bound the scope of failure scenarios FSS-D1-01 (F) 10/16/2014 Incorporate Report 0001- Methodology Methodology Change for 0014-002-001 Revision 0 Change HGL treatment for HGL 2018-2448 10/11/2014 Revised sources to include Methodology New segmented bus DRC T107 transitioned segmented bus Change duct methodology duct method Seismic SHA-E1-01 (F) 8/27/2013 New site specific data was Methodology Different methodology subsequently collected as Change for seismic hazard part of the Near Term Task evaluation Force (NTTF) 2.1 analysis.

Page 10 of 11

Enclosure Attachment 2 Attachment 2, Table 2-6 below provides information regarding the specific peer review evaluating these upgrades, the date the peer review was performed or will be performed, the peer review report date, and the results of the peer review (e.g., additional findings, closure, etc.).

Table 2-6 Peer Reviews of Internal Flooding, Internal Fire, and Seismic PRA Upgrades Upgrade Review Change Hazard Description Upgrade Review Results / New Date Findings Internal 11/16/13 Impact to Significant Focused-scope peer review as TBD Flooding Sequences (2 orders of described in Attachment 1 magnitude difference)

Internal Fire 3/6/2014 New cable selection Focused-scope internal fire SR CS-A6 met methodology regarding PRA peer review conducted *SR CS-C4 to be reviewed fire-induced loss of December 8-12, 2014. Report by augmented F&O closure active tripping Date: January 22, 2015 capability for electrical protection

• Augmented closure review as described in Attachment 1 9/27/2014 New breaker SR CS-B1 met CC II/III coordination methodology 12/7/2014 New Qualitative SR QLS-A1 met Screening Criteria New F&O QLS-A1-01[14FS]

SR QLS-A2 met 12/6/2014 New Loss of RCP Seal SR PRM-A3 met Cooling modeling New F&O PRM-A3-01 method [14FS]

• SR ES-B3 to be reviewed by augmented F&O closure review 10/16/2014 Methodology Change SR FSS-D1, FSS-D4, FSS-for HGL treatment D11, and FSS-E1 all met New F&O FSS-D2-01[14FS]

10/11/2014 New segmented bus SR IGN-A7 met duct methodology Seismic 8/27/2013 Different methodology Finding level fact and F&O Closed for seismic hazard observation closure review SR SHA-E1 meets CC-II/III evaluation conducted April 19, 2017 through June 23, 2017 Report Date: June 23, 2017 Page 11 of 11

Attachment 3 Other External Hazards Screening Peer Review Findings

Enclosure Attachment 3 Attachment 3 Other External Hazards Screening Peer Review Findings

RAI 14

Attachment 3, Table 3-1 documents the other external hazards screening peer review findings and their dispositions.

Table 3-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT- 01 The walkdown 1. Erosion of spoils piles from the excavation of the 45-acre reservoir into D1 resulted in the East Wash drainage path next to the East Wash Embankment has unresolved issues. It negatively impacted the design drainage through this area. (The plant had is assumed these previously identified this issue.) This item applies to all three units.

issues need to be Disposition: APS committed to removing the spoils piles from the vicinity resolved successfully of the East Wash channel in 2013 and subsequently removed those spoils to allow the screening piles. Therefore, this item is resolved.

process to be complete and 2. The safety-related structures roof design (drains and additional verified. Until the scuppers or holes in the parapet walls to limit the water level to 6 in.) did issues are resolved, not appear to provide many holes in the parapet walls to limit water depth the hazards cannot to 6 in. The design of the scuppers should be reviewed with respect to a be considered probable maximum precipitation (PMP) event. This item applies to all screened. The issues three units.

are unanalyzed. The report implies that a Disposition: A Palo Verde Action Request 3952605 concluded that there successful resolution was a nonconformance with respect to the PVNGS Updated Final Safety is forthcoming, but Analysis Report (UFSAR) description. However, a subsequent engineering no commitment date evaluation (3956860) analyzed the scupper drainage capacity and is provided. Based on concluded that the roof loading would not exceed 30 psf (6 in. of water) the information given the design basis 50-y/6-h PMP. Therefore, the as-built roof drainage provided, the issues design met the 1975 SER requirements. This item is resolved.

could remain unresolved for the life 3. The onsite ammonia tanks (1-M-SCN-T03C and D) inside the Turbine of the plant. If this is Building appear to contain NH2OH and Carbohydrazide rather than the case, the current ammonia. This needs to be clarified with the authors of the control room condition should be habitability evaluations and inventory of onsite hazardous materials evaluated and shown calculations. This item applies to all three units.

to be compliant with the screening criteria. Disposition: Follow-on discussion indicated that additional contents within those tanks vary as needed. However, assuming ammonia as described is appropriate in the control room habitability analyses. Therefore, this item is resolved.

Page 1 of 3

Enclosure Attachment 3 Table 3-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT- 01 4. The onsite storage of PolyFloc AE1701 walkdown indicated that the D1 11,000 gal tank at the Water Resources Facility (WRF) is no longer used.

(cont.) Only the 6,000 gal tank is used. This should be discussed with the authors of the control room habitability evaluations and inventory of onsite hazardous materials calculations. This item is conservatively assumed to apply to all three units. (Unit 1 is closest to the WRF storage location.)

Disposition: Assuming the 11,000 gal tank is being used is conservative.

Also, it preserves the option of using it if the 6,000 gal tank system becomes unavailable. Therefore, this item is resolved.

5. The drainage ditch between Building A (Administrative building) and the parking lot south of the switchyard has a cement traffic barrier in it. The reason for this is not apparent. This item applies only to Unit 3.

Disposition: Because of the location of the barrier drainage ditch, any overflow would be routed towards the southeast boundary of the site (based on site drainage design drawings) and would not be expected to impact Unit 3 (nearest to the barrier) or the other units. Therefore, this item is resolved.

EXT- 02 PVNGS is a three unit These issues applied to all three units and were resolved for all three units D1 site. The external as indicated above in F&O EXT-D1-01.

hazards evaluation presumably applies to all three sites equally. The walkdown identifies 3 issues in the YARD

[#1, #4, and #5],

which could be preferentially worse for one unit. Issue #2 and #3 should specify if this occurs at each unit, or one unit applicable to the whole site. There is no discussion of unit dissimilarities, based on orientation.

Page 2 of 3

Enclosure Attachment 3 Table 3-1 Other External Hazards Screening Peer Review Findings SR Number Finding Disposition EXT- 01 For the analysis of The calculations of hazard frequency and CCDP were subsequently added E2 the transportation to Section 6.35 of the final report and the tornado missile impact was accident resulting documented in Section 6.7 of the revised report. After these changes, from the shipment of these events continued to meet the screening criteria.

chlorine gas by railcars and onsite delivery of ammonium hydroxide, the actual calculations of the hazard frequency and CCDP were not presented in Section 6.35 of the report.

The bounding calculation performed for the tornado missile impact was not sufficiently documented in Section 6.7 of the report.

Page 3 of 3

Attachment 4 Guidelines for Determining Barrier Adequacy

Enclosure Attachment 4 Attachment 4 Guidelines for Determining Barrier Adequacy RAI 17 , Table 4-1 provides the criteria used to determine the adequacy of fire zones meeting the fire compartment criteria during the boundary adequacy.

Table 4-1 Guidelines for Determining Barrier Adequacy Fire Zone Barrier 3-hr, 2-hr, or 1-hr rated fire boundaries meets Fire Nonrated interior wall, floor, or ceiling constructed of heavy concrete construction Compartment Nonrated exterior wall constructed of heavy construction definition Missile proof doors or watertight steel equipment hatches Installed fire damper is credited to function in a configuration different than its fire tested configuration (i.e. The fire damper will work in both directions, even though it is tested to protect a particular side from the other. A hot gas layer from either side will trigger the thermal link on the damper)

Guidelines to Openings smaller than three foot by three foot with consideration for lack of ignition sources, combustibles, and cable tray determine configuration in room (Note 1) adequate barrier Nonrated grate with consideration for lack of combustibles near integrity for Fire grate (Note 2)

Compartment Open doorways / open stairwells with consideration of fixed ignition sources and potential combustibles (Note 3)

Nonrated doors / rollup doors (Note 2)

Fire Zone Barrier Partial height walls not up to Fire Openings from floor to ceiling Splash curtains Compartment Openings greater than three foot by three foot integrity Note 1: Small penetrations in walls, floors, or ceilings may still meet the integrity of the fire compartment definition. Do not credit partitioning elements where unprotected cables pass through unsealed cable penetrations. Do not credit openings that involve vertical cable trays. If there are no cable trays, use fire modeling judgment (fire plume development, hot gas layer development, radiant heating and fire spread) and consideration of ignition source profiles to determine if the fire compartment can substantially contain the ignition sources.

Note 2: Similar to Note 3, evaluate combustibles near the boundary and consider ignition source profiles in area.

Note 3: Various walls that otherwise meet the partitioning criteria may have open doorways. An open doorway does not preclude the crediting of the wall in partitioning. During the walkdown, the PRA analyst should evaluate whether or not combustible fuels exist in close proximity to one or both sides of the opening. An example where an open door may not be appropriate is an open doorway with cables directly above both sides of the doorway.

Page 1 of 1

Attachment 5 Internal Fire PRA Methods

Enclosure Attachment 5 Attachment 5 Internal Fire PRA Methods RAI 17.c and 17.d Attachment 5, Table 5-1 below reviews the status of internal FPRA methodologies which form the basis of the PVNGS internal FPRA model.

Table 5-1 Internal Fire PRA Methods Internal Fire PRA Methods NRC ADAMS No. PVNGS Internal PVNGS Internal Approval FPRA FPRA Status Implementation Implementation Status Comments FAQ 06-0016 (NUREG/CR-6850 Supp 1) Approved ML072700475 YES ML070580334 FAQ 06-0017 (NUREG/CR-6850 Supp 1) Approved ML072500300 YES ML071570255 FAQ 06-0018 (NUREG/CR-6850 Supp 1) Approved ML072500273 YES FAQ 07-0031 (NUREG/CR-6850 Supp 1) Approved ML072840658 YES FAQ 07-0035 (NUREG/CR-6850 Supp 1) Approved ML091620572 YES FAQ 08-0042 (NUREG/CR-6850 Supp 1) Approved ML092110537 YES FAQ 08-0043 (NUREG/CR-6850 Supp 1) Approved ML092120448 YES FAQ 08-0044 (NUREG/CR-6850 Supp 1) Approved ML092110516 YES FAQ 08-0046 (NUREG/CR-6850 Supp 1) RETIRED ML093220426 NO Internal fire PRA does (NUREG- ML16167A444 not credit any Very Early 2180) Warning Fire Detection Systems FAQ 08-0047 (NUREG/CR-6850 Supp 1) Approved ML082950750 YES ML082770662 FAQ 08-0048 (NUREG/CR-6850 Supp 1) Superseded ML092190457 YES Internal fire PRA is (NUREG- ML15134A046 currently in alignment 2169) with NUREG/CR-6850 and Supplement 1 FAQ 08-0049 (NUREG/CR-6850 Supp 1) Approved ML092100274 YES FAQ 08-0050 (NUREG/CR-6850 Supp 1) Superseded ML092190555 YES Internal fire PRA is (NUREG- currently in alignment 2169) with NUREG/CR-6850 and Supplement 1 FAQ 08-0051 (NUREG/CR-6850 Supp 1) Superseded ML100900052 NO Internal fire PRA is (NUREG/CR- currently in alignment 7150) with NUREG/CR-7150 FAQ 08-0052 (NUREG/CR-6850 Supp 1) Approved ML092120501 PARTIAL Internal fire PRA main control room (MCR)

Transient fire suppression rate is in alignment with FAQ 08-0052 Impact 2017-1818 to correct fire growth rates (Open)

Page 1 of 5

Enclosure Attachment 5 Table 5-1 Internal Fire PRA Methods Internal Fire PRA Methods NRC ADAMS No. PVNGS Internal PVNGS Internal Approval FPRA FPRA Status Implementation Implementation Status Comments FAQ 08-0053 Approved ML121440155 planned Impact 2017-1819 Kerite-FR Cable Failure Thresholds (Pending Closure)

Kerite cable type has been revised FAQ 12-0064 Approved ML12346A488 planned Impact 2017-1820 Influence Factors for Transient and Hot (Open)

Work Fires Internal fire PRA is currently in alignment with NUREG/CR-6850 and Supplement 1 Ignition source binning is planned to be updated in accordance with implementation of NUREG-2169 No intent or plan to revise influence weighting factors FAQ 13-0004 Approved ML13322A085 planned Impact 2017-1821 Treatment for Sensitive Electronics (Open)

Internal fire PRA is currently in alignment with NUREG/CR-6850 in that adjacent cabinets and cabinets with the thermoset cable damage criteria zone of influence are designated as damaged. All sensitive electronics had been assessed as located internal to the cabinets.

FAQ 13-0005 Approved ML13319B181 YES Revised methodology is Counting and Modeling of Self-Ignited incorporated with Cable Fires, and Cable Fires due to exception; the proposed Welding and Cutting screening is not implemented, all cable trays are individually analyzed.

FAQ 13-0006 Approved ML13331B213 YES Revised methodology is Junction Box Modeling incorporated with exception; the proposed screening is not implemented, all junction boxes are individually analyzed.

Page 2 of 5

Enclosure Attachment 5 Table 5-1 Internal Fire PRA Methods Internal Fire PRA Methods NRC ADAMS No. PVNGS Internal PVNGS Internal Approval FPRA FPRA Status Implementation Implementation Status Comments FAQ 14-0008 Approved ML14190B307 YES FAQ 14-0008 is Clarification on Counting Main Control incorporated. Total MCB Boards frequency is applied to each independent panel as allowed per the FAQ.

Recalculation of 6850 App L ignition frequencies for each MCB panel has not been incorporated; Impact 2017-2234 to update based on NUREG-2169 (Open)

FAQ 14-0009 Approved ML15114A441 NO FAQ 14-0009 provides a Treatment of Fire Propagation from ML15118A810 method to refine Well-Sealed MCCs modeling of fire propagation from MCCs.

PVNGS internal FPRA accounts for fire propagation from all MCCs, including MCCs located in NEMA-4 water tight enclosures, and follows NUREG/CR-6850 as modified by FAQ 08-0042 FAQ 16-0010 Approved ML17258A687 YES FAQ provides guidance Alternate Methodology to NUREG/CR- ML17258A686 to apply the previously 6850 for Maintaining Fire PRA Ignition calculated per-source Frequency Weighting Factors ignition frequencies to any subsequently added ignition source. Update of per-source ignition frequencies should be performed when new generic data becomes available The internal fire PRA ignition frequencies are currently being revised to incorporate updated generic data provided by NUREG-2169 ML12171A583 NRC Position ML12171A583 YES Item 1 Compliant -

Recent Fire PRA Methods Review Panel adopted the revised Decisions and EPRI 1022993 frequencies for cable fires initiated by welding and cutting (Superseded by NUREG-2169)

Page 3 of 5

Enclosure Attachment 5 Table 5-1 Internal Fire PRA Methods Internal Fire PRA Methods NRC ADAMS No. PVNGS Internal PVNGS Internal Approval FPRA FPRA Status Implementation Implementation Status Comments YES Item 2 Compliant -

Currently use 6850 App G Table G-1 95th% HRR for all Transient fires.

Further refinements may be applied to decrease Transient HRR. Larger HRR transients are postulated in the DG building (treated as HGL scenario) and the Turbine building which is treated as an effective HGL failure of very large areas considered to bound the upper limit of likely transient materials planned Item 3 Planned to Adopt

- Currently use FAQ 08-0044, and NUREG/CR-6850 App E.3 for oil fire split fractions. Impact 2017-1822 to update oil scenario split fractions (Pending Closure)

NO Item 4 Compliant - NEI proposed methodology for Treatment of Electrical Cabinets was not incorporated NO Item 5 Compliant - NRC does not endorse EPRI 1022993; guidance was not incorporated NUREG/CR-4527 Issued ML060960351 adopted An Experimental Investigation of ML071690016 Internally Ignited Fires in Nuclear Plant Control Cabinets NUREG/CR-6850 Issued ML052580075 adopted EPRI/NRC-RES Fire PRA Methodology ML052580118 for Nuclear Power facilities ML061630360 NUREG/CR-6931 Vol 3 Issued ML081190261 adopted Cable Response to Live Fire (CAROLFIRE): Thermally-Induced Electrical Failure (THIEF) Model NUREG/CR-7010 Vol 1 Issued ML12213A056 adopted Cable Heat Release, Ignition, and Spread in Tray Installations During Fire (CHRISTIFIRE) Phase 1: Horizontal Trays NUREG/CR-7150 Issued ML12313A105 adopted Joint Assessment of Cable Damage and ML14141A129 Quantification of Effects from Fire (JACQUE-FIRE)

Page 4 of 5

Enclosure Attachment 5 Table 5-1 Internal Fire PRA Methods Internal Fire PRA Methods NRC ADAMS No. PVNGS Internal PVNGS Internal Approval FPRA FPRA Status Implementation Implementation Status Comments NUREG/CR-7197 Issued ML16110A037 adopted Heat Release Rates of Electrical Enclosure Fires (HELEN-FIRE)

NUREG-1805 Issued ML043290075 adopted Fire Dynamics Tools ML13211A097 ML13211A098 NUREG-1824 Issued ML071650546 adopted Verification and Validation of Selected ML071730305 Fire Models for Nuclear Power Plant ML071730493 Applications ML071730499 ML071730527 ML071730504 ML071730543 ML16309A011 NUREG-1855 Issued ML17062A466 planned Impact 2018-2394 Guidance on the Treatment of (Open)

Uncertainties Associated with PRAs in Revised guidance to be Risk-Informed Decisionmaking incorporated in next revision of PRA Uncertainties and Sensitivity Analyses studies NUREG-1921 Issued ML12216A104 adopted EPRI/NRC-RES Fire Human Reliability Analysis Guidelines NUREG-1934 Issued ML12314A165 adopted Nuclear Power Plant Fire Modeling Application Guide (NPP FIRE MAG)

NUREG-2169 Issued ML15016A069 planned Impact 2017-1823 Nuclear Power Plant Fire Ignition (Open)

Frequency and Non-Suppression Update to Ignition Probability Estimation Using the Frequencies and Fire Updated Fire Events Database Suppression Rates NUREG-2178 Issued ML16110A140 planned Impact 2017-1824 Refining and Characterizing Heat (Open)

Release Rates from Electrical Enclosures Update to Electrical during Fire (RACHELLE-FIRE) Cabinet Heat Release Rates (only)

NUREG-2180 Issued ML16343A058 NO Internal fire PRA does Determining the Effectiveness, not credit any incipient Limitations, and Operator Response for fire detection systems Very Early Warning Fire Detection Systems in Nuclear Facilities (DELORES-VEWFIRE)

Page 5 of 5

Attachment 6 High Estimate T.S. 3.8.4 Condition C Scenario

Enclosure Attachment 6 Attachment 6 High Estimate T.S. 3.8.4 Condition C Scenario

RAI 26

Attachment 6, Table 6-1 provides the new high RICT estimate for the high estimate case for entry into the new Condition C.

Table 6-1 High Estimate T.S. 3.8.4 Condition C Scenario Impacted Impacted RICT RICT Loss of Components Components Calculated - Calculated - Function (Generic to All (Generic to All Low High (YES/NO/

Condition Models) Models) Estimate1 Estimate1 MAYBE)

RICT RICT Calculated - Calculated -

Low High Train A & B Subsystem 1PKAF11 1PKAH11 Condition C - Two 1PKAH15 DC electrical 1PKCF13 1PKAH11 Less than 1 hr3 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop YES2 power subsystems 1PKCH13 1PKBH12 inoperable. 1PKBF12 1PKBH12 1PKBH16 1PKDF14 1PKDH14

1. RICTs are based on internal events, internal flood, internal fire and seismic PRA model calculations.

2. This is considered a loss of specified safety function. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered PRA functional as defined in section 2.3.1 of NEI 06-09-A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

3. This was evaluated with both Class 1E DC electrical power subsystems [Train A and Train B - (All four Channels)] being impacted.

Page 1 of 1