GO2-15-128, Response to Request for Additional Information Regarding License Amendment Request for Adopt Technical Specification Task Force (TSTF)-425, Revision 3

Response to Request for Additional Information Regarding License Amendment Request for Adopt Technical Specification Task Force (TSTF)-425, Revision 3

ML15260A570
Person / Time
Site:	Columbia
Issue date:	09/17/2015
From:	Schuetz R E Energy Northwest
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
GO2-15-128, TAC MF6042, TSTF-425, Rev. 3
Download: ML15260A570 (24)

Text

Robert E Schuetz Vice President, Operations P.O. Box 968, Mail Drop PE23 Richland, WA 99352-0968 Ph. 509-377-2425 F. 509-377-4674 reschuetz@energy-northwest.com GO2-15-128 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Docu ment Control Desk Washington, D.C. 20555-0001

References:

1. Letter, GO2-15-007, dat ed March 17, 2015, WG Hettel (Energy Northwest) to NRC, "License Amendment Request for Adoption of Technical Specification Task Force Traveler (TSTF)-425, Revision 3 2.Email, dated August 12, 2015, Balwant Singal (NRC) to Lisa Williams (Energy Northwest), "Request for A dditional Information - License Amendment Request for Adoption of TSTF-425, Revision [3],

Columbia Generating Station - TAC No. MF6042"

Dear Sir or Madam:

By Reference 1, Energy Northwest subm itted for approval the License Amendment Request (LAR) to adopt TSTF-425, Revision 3.

Via Reference 2, the Nuclear Regulatory Commission (NRC) submitted Requests for Additional Information (RAIs) to Energy Northwest for response. Attachment 1 provides the requested information except RAI 3. A response to RAI 3 will be provided by October 31, 2015.

This letter and its attachment c ontain no regulatory commitments.

RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION ON LICENSE AMENDMENT REQUEST FOR ADOPT TECHNICAL SPECIFICATION TASK FORCE (TSTF)-425, REVISION 3 Page 2 of 2 If there are any questions or if additional information is needed, please contact Ms. L. L. Williams, Licensing Supervisor, at 509-377-8148.

I declare under penalty of perjury that the foregoing is true and correct. Executed this -1.fe_ day of , 201 S'. Respectfully, R. E. Schuetz Vice President, Operatio Attachments:

As Stated. cc: NRC Region IV Administrator NRC NRA Project Manager NRC Sr. Resident Inspector

-988C CD Sonoda -BPN1399 (email) WA Horin -Winston & Strawn RR Cowley-WDOH (email) EFSECutc.wa.gov--

EFSEC (email)

Page 1 of 22 The NRC staff's Probabilistic Risk Assessment Licensing Branch (APLA) has completed its initial review of the licensee's proposed technical spec ification changes for its

[Columbia Generating Station] CGS related to adoption of Technical Specification Task Force-425, Revision 3. Based on our review, the NRC staff has identified the following request for additional informati on for completing its review.

Request for Additional Information (RAI) for APLA: 1.The LAR mentions a number of peer reviews and a self-assessment: A peer review had been performed in 2004. A peer review had been performed in 2009 and a report issued in January2010. Findings and Observations (F&Os) included thos e graded as capability category I (CCI) or not met. A self-assessment had been performed.A Fire Probabilistic Risk Assessment (PRA) peer review had been performed.a.Please clarify which peer reviews (inter nal events PRA, Fire PRA, or other PRA) were full scope or focused scope, discu ss the peer review guidance, standards,and regulatory guidance followed, and c onfirm the reviews were conductedconsistent with applicable guidance and standards. Please clarify whether theinternal events PRA was reviewed to the Addenda to American Society of

Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-S-2008 (i.e., ASME-ANS RA-Sa-2009). If reviews were not conducted consistent with applicable guidance and standards, please describe your plans to address any shortcomings in the review. With regar d to the self-assessment, please describe when this was performed and the scope of the self-assessment, and whether itincluded a gap assessment between Regula tory Guide (RG) 1.200, Revision 1,"An Approach for Determining the Tec hnical Adequacy of a Probabilistic RiskAssessment Results for Risk-Informed Activities," (ADAMS Accession No.ML070240001) and RG 1.200, Revision 2 (ADAMS Accession No.

ML090410014), for the internal events PRA.

Please also provide additional information on the Fire PRA peer review describing when it was performed and what the peer review entailed.b.Please provide the internal events PR A (including flooding) F&Os graded as CCI or not met and describe your dispositi on of these F&Os from the 2009 peer review and self assessment.

Page 2 of 22 c.If PRA models other than the internal events PRA model are used for detailedquantitative analysis versus for qualitative or bounding analyses, then please address the technical adequacy gui dance of RG 1.200, Revisi on 2. If the LAR is requesting to use these PRA models as such, provide the F&Os graded as CCI or not met and describe your disposition of these F&Os from the peer reviews. The following discussion clarifies which Co lumbia Generating Station (CGS) peer reviews (internal events PRA, fire PRA, and seismic PRA) were full scope or focused scope and discusses the peer review gui dance, standards, and regulatory guidance followed. All reviews were conducted consistent with applicable guidance and standards.

Internal Events PRA In 2004 the CGS Revision 5.0 internal events PRA received a full scope peer review against the Capability Category II (CC-II) requirements of the ASME/ANS PRA Standard, ASME RA-Sa-2003, as clarified by Regulator y Guide (RG) 1.200 (DRAFT), using the industry peer review process guidelines described in Nuclear Energy Institute (NEI)NEI-00-02, Revision A-3, "Probabilistic Risk Assessment Peer Review Process Guidance." In 2009, the CGS Revision 7.0 internal events PRA received a full scope peer review from the Boiling Water Reactor Owners' Group (BWROG) against the ASME/ANS PRA Standard ASME/ANS RA-Sa-2009, as clarified by Regulatory Guide (RG) 1.200, Revision 2, using the industry peer review pr ocess guidelines in NEI-05-04, Revision 2, "Process for Performing Follow-On PRA Peer Reviews Using the ASME PRA Standard."

CGS Fire PRA The fire PRA has not been upgraded to meet CC-II for the supporting requirements (SRs) of the combined ASME/ANS Standard , ASME/ANS RA-Sa-2009. There are no plans to perform a peer review of t he current version of the fire PRA.

In 2004, the CGS Revision 1 fire PRA (FPRA) received a full scope peer review as part of the internal events peer review. At the time, the fire PRA peer review process had limited industry and regulatory gui dance available. The following is an excerpt from the 2004 Peer Review report on the guidanc e used:

Page 3 of 22 "-a technical checklist for conducting a FPRA Peer Review was developed

based on the available references for use in the PRA Peer Re view of the CGS Fire PRA. In general, the objectives of the checklists are to provide a structured process to confirm:

1.Use of acceptable methodology in comparison with current state of the artand industry practices.2.Appropriateness of methodology and analysis scope given intended application.3.Analysis is free of obvious errors or misapplications4.Acceptable level of detail to support the specific application under review -S/G AOT ExtensionThe Fire PRA Peer Review checklists were developed based in ERIN's standard practices for FPRAs, the guidance provi ded in NEI 00-02, The [Electrical Power Research Institute] EPRI Fire PRA Impl ementation Guide, the industry responses to the NRC Generic RAIs, and Regulatory Guide (RG) 1.200. ERIN's standard project approach for conducting a FPRA formed the basic framework and structure for the checklist. The NEI 00-02 document provided guidance for the depth of review while the RG 1.200 and EPRI documents provided specific issues for review. Based on this Informat ion, the checklists are structured using six topical areas: 1.Fire Areas and Fire Compartments (FC) 2.Cable and Equipment Location Data (CE) 3.Developments of Fire Ignition Frequencies (FI)4.FPRA Model Development - Plant Response (FM) 5.Fire Scenario Development (FS) 6.FPRA Model Quantification (MQ)"CGS Seismic PRA The CGS seismic PRA (SPRA) has not been peer reviewed. The SPRA has not been upgraded to meet CC-II for the supporting requirements of the combined ASME/ANS Standard, ASME/ANS RA-Sa-2009. There are no plans to pe rform a peer review of the current version of the seismic PRA.

Page 4 of 22 PRA Self-Assessment Process No gap assessment between RG 1.200 Revision 1 and Revision 2 has been performed on the CGS PRA. CGS Revision 7.0 inter nal events PRA received a full scope peer review from the BWR Owners' Gr oup against the ASME/ANS PRA Standard, ASME/ANS RA-Sa-2009, as clarified by Regulatory Guide 1.200, Revision 2, using the industry peer review process guidelin es in NEI 05-04, Revision 2. A Self-Assessment as described in the submi ttal refers to the process in which PRA modeling self-identified fact s and observations (F&O) are entered into the CGS F&O database for inclusion in the next modeling update. The 2009 internal events peer review and self-assessment findings assigned to SRs that were graded as CC-I or not met are presented in Table 1. Dispositions of findings are provided in Table 2. Not Met 1-10, 1-14 CC-I2-14Not Met 2-16, 2-17 Not Met 3-11 Not Met 6-10, 6-8, 6-9 Not Met 2-14, 2-16, 2-17 CC-I1-23CC-I1-23Not Met 1-23 CC-I1-3CC-I3-1Not Met 1-3, 1-33, 1-42, 1-43 Not Met 1-10, 1-14, 1-43 Not Met 2-18 Not Met 2-28 Not Met 1-3, SA-IF-E5a-1 Not Met 4-7 Page 5 of 22 F&O 1-10 SRs: IE-C14 LE-D4 High Pressure Core Spray (HPCS) notebook does not include the Surveillance Test for HPCS-V-4. Additionally, the screening for HPCS in the ISLOCA Section of the Initiating Event Notebook (appendix E) does not account for the possibility of ISLOCA during testing of this valve. A possible scenario is, prior to V-4 test, the injection Check Valve V-5 has failed open, and once the test has completed, V-4 does not close and V-24 fails (may be CC). The result is ISLOCA to low pressure piping. OSP-HPCS/IST-Q701 lists V-4 as being tested quarterly. V-23 is open during the test, given reactor is at pressure. Consider the quarterly test of V-4 in the ISLOCA analysis. Update the HPCS notebook to include IST for HPCS valves, including V-4.

Peer Review Resolved: To resolve this finding, an ISLOCA assessment was performed for the HPCS system, including consideration of HPCS-V-23, HPCS-V24, and the inservice testing of HPCS-V-4 and as discussed in the finding. Documentation of this assessment was added to Appendix E, ISLOCA Initiating Event Frequency, of the initiating events notebook.F&O 1-14 SRs: IE-C14 LE-D4 ISLOCA analysis applies a conditional probability of valve closure from NSAC-154, but applies this to NUREG/CR-6928 data. See IE notebook, Table E-1. Application of The NSAC data does not appear appropriate when applied to NUREG/CR-6928. The new valve failure data, such as check valve internal rupture, is not applicable to the older factors for valve re-closes. For example, CV closes following pipe failure (0.01) is based on older data, while the NUREG/CR-6928 data for check valve rupture would typically have screened failures where the check valve stuck open (fails to close), but later reclosed. ISLOCA is risk significant, and the factors affect multiple sequences. ISLOCA analysis should be revised to remove NSAC-154 factors, and apply factors based on the latest valve failures in NUREG/CR-6928.

Peer Review Resolved: The ISLOCA event tree was modified to address this peer review finding. The ISLOCA analysis was revised to replace older valve failure data published by NSAC-154 with the latest valve failure data published in NUREG/CR-6928, wherever newer data was available. A review of NUREG/CR-5124 revealed that the conditional probability of check valve closure (event tree node CV) is applicable only to scenarios in which a testable check valve is held open due to reverse air flow to the controller. The 0.01 credit had minimal impact on the ISLOCA sequence cutsets, as the significant check valve failures are leakage and rupture. Therefore, event tree node CV was removed from the ISLOCA event tree. Event tree node SML (small leak through the high/low pressure interface) is moved to an earlier position in the event tree, as leaks through the high/low pressure boundary are judged to be isolable (the 900-pound MOVs that are present at the boundaries are judged to be capable of closing against a leak). The model retains the assumption that MOVs would not likely close if a piping rupture and interface rupture were to occur, per Page 6 of 22 NUREG/CR-5124 guidelines. Also, the event tree node ISOVAV (early isolation of the ISLOCA) probability has been changed to a 0.1 based on documentation provided with the CGS SPAR model. From the CGS SPAR model documentation: Without doing detailed pressure capacity calculations and detailed modeling of the expected internal pressures and temperatures expected in the connected systems, it is impossible to predict the location of potential ruptures. Even with detailed calculations and modeling, precise rupture locations are impossible to identify. Nevertheless, some general observations can be made based on the GI-105 research. For most situations the RHR heat exchanger, and pump suction pipe are the components with the lowest pressure capacities. Generally, these components are positioned within the systems such that one or more valves are available to isolate a rupture, should an ISLOCA occur at these locations. However, it is possible that if the pressure isolation interface were to fail, that either the available valves would not successfully isolate the rupture, or the rupture could occur in a location that cannot be isolated. To account for these possibilities, a generic 10% probability is assumed that if a rupture were to occur, it cannot be isolated. This 10% probability for the rupture being non-isolable can be considered to be a reasonable estimate for a number of reasons. First, virtually every rupture location examined as part of the GI-105 research program was found to be potentially isolable. The pipe and other components (e.g., pump suction pipe and RHR heat exchangers) that are most susceptible to over-pressure induced rupture, are located "deeper" within the connected system such that a number of valves are typically available for isolating the rupture. Further, the typical failure mode postulated in the ISLOCA analysis for motor operated valves is spurious operation. The few actual instances of this observed in the Page 7 of 22 operating experience were all recoverable from the control room. However, one factor that affects the ability to isolate the rupture is local accessibility. If a rupture were to occur, the resulting local environment would likely preclude access to the immediate vicinity. Therefore, if local access was necessary, and if the potential isolation valves were located close to the rupture then isolation would be unlikely. Again, the research performed to support resolution of GI-105 included an assessment of induced flooding and the resultant environment. That work concluded these effects would not significantly affect the ISLOCA risk. Therefore, the non-isolable ruptures are assumed to compose 10% of the potential ISLOCA ruptures. The accident sequence notebook was updated to reflect all of these changes to the ISLOCA model. F&O 1-23 SRs: HR-D2 HR-D3 HR-D4 The quantification of pre-initiating events using 3 surrogate events to represent all pre-initiating events does not provide an accurate assessment of each HEP, taking into account plant specific or component s pecific attributes. Appendix A.4 for example, provides a "generic" assessment of miscalibration with dependencies, without actually including the specific attributes for the procedure affecting events it is applied. For pre-initiator failure to restore events, the use of the surrogate event does not account for post-maintenance testing, operations walkdowns, and when the system may be operated again. For pre-initiator miscalibration, the surrogate event does not represent the plant specific calibration procedures. In Appendix A.4, the following is provided in the generic analysis "The results of these evaluations indicate that, depending on the methods used to verify the adequacy of the calibration and the assumptions used in the quantitative evaluation, there can be substantial variation in the common cause miscalibration error probability." This statement is true, which is why plant-specific attributes are needed for this analysis. Numerous Pre-Initiating Events in all three categories are risk-significant, based on table E-2 of the QU notebook. Re-Analyze pre-initiating events for all significant HEPs, taking into account the component specific testing, maintenance and operations attributes affecting the HEP. Use of surrogate or generic analysis should be limited to non-significant events, with some justification that the surrogate is representative or bounding for the HEPs it is applied.

Peer Review Resolved: Procedure-specific pre-initiator HEP calculations were developed for the top three pre-initiator human failure events when sorted by RAW and the top three pre-initiator human failure events when sorted by Fussell-Vesely based on the CGS Rev. 7.0 Level 1 PRA model results. This resulted in a total of five pre-initiator human failure event for which to perform procedure-specific HEP calculations. (Note - Five are evaluated, rather than six, because the top pre-initiator human failure event when sorted by RAW was also the top pre-initiator action when sorted by F-V). Section 3.0a and Appendix A.0 were added to the HRA Notebook to document the updated procedure specific pre-initiator HEP calculations. The five revised pre-initiator HEPs were subsequently incorporated into the final HRA Calculator file "CGS 2008 HRA.HRA" Page 8 of 22 Comparison with other PRAs shows that variation between component/action specific HEPs is expected, and the range of differences from one component to the next can be several orders of magnitude. For mis-calibrations, for example, depending on whether the mis-calibration can be quickly recognized or whether there is a second check on the calibration can greatly affect the results. Variation in dependent failures and failure to restore is equally large within a PRA. CGS provides discussion on this F&O suggesting the important pre-initiating events were represented by the "representative" actions, and the procedures for each action were similar. The following procedures were reviewed for this follow-up: Representative Procedures: SOP-CN-FILL (for CN-HUMNTK--1X3XX), ISP-LPCS/RHR-X301 (for LPSHUMNFIS-4XLL) Significant HEP Procedures: Calibration: ISP-RCIC-Q901 (HEP: RCIHUMNPS13AX3LL), 10.27.86 (HEP: RCIHUMNPS--6X3LL) Restoration: OSP-SW/IST-Q702 (HEP: SWB-XHE-RE-RHRSW), OSP-SW/ISP-Q701 (HEP: SWA-XHE-RE-RHRSW), SOP-COLDWEATHER-OPS (HEP: SW-HUMNV218-X3LL), OSP-HPCS/IST-Q701 (HEP: HPC-XHE-RE-MAINT) Based on a review and comparison of the representative procedures versus the procedures for significant HEPs, it is clear the procedures, associated critical steps, and verification steps are significantly different.

Page 9 of 22 F&O 1-3 SRs: HR-G3 LE-C7 IFQU-A6 Analysis for HEPs apply low stress to post-accident situations for almost all HEPs, even though the criteria in NUREG-/CR-1278 recommends High Stress especially when the time window is short. See HPSHUMN-SP-H3LL, OP-SW-PMP, SLC-XHE-FO-LLVCT and others. Supplemental guidance was provided by CGS personnel as a result of this issue. The CGS argument included an argument that there was not extensive use of simulator training prior to the development of NUREG/CR-1278, and that this training affects the application of stress to simple actions where training occurs.

A second set of justification was provided, with discussion that basically justified moderate or low stress would be appropriate, given enough training for the operators. Review of this new guidance does not provide sufficient justification for the revised application of NUREG/Cr-1278 Guidance. Two points are important to this finding: a) stress will affect actions occurring during an accident in comparison to non-accident actions making the actions less reliability, and b) Stress is based on an "overall sense of being pressured and/or threatened in some way with respect to what they are trying to accomplish." Training can not fully remove the treat or pressure during an actual event. Stress factors assumed to be nominal are also in the Level II model and flooding model for short duration HEPs. NUREG/CR-1278 recommends applying optimum stress to activities such as maintenance and calibration activities, reading an annunciator light, or scheduled readings in the control room. On the other hand, Page 17-7 states that 'In general, situations that impose time pressure on the performers are classified as heav y task load situations.' In almost all of the Post-Initiator HEPs where optimal stress is assumed, time is a factor with Core Damage occurring between 30 minutes and an hours. This time stress is typically modeled as high stress in HRA using NUREG/CR-1278. Apply high stress factors per Table 17-1 of NUREG/CR-1278 to HEPs where time pressure is present during an accident situation. Benchmarking against other PRAs performed by alternate vendors to determine how the Stress Factors from 1278 were applied can be useful for this issue.

Peer Review Resolved: After reviewing the peer review F&Os, no changes to the calculated post-initiator HEPs were judged necessary to address the post-initiator stress levels. Section 4.4 of the HRA documentation has been enhanced to further justify the position that the post-initiator stress levels are treated appropriately in the CGS PRA. The use of high stress for the manipulation errors in the post-initiator HEPs is performed on a case-by-case basis. The blanket requirement that all manipulations in the plant for the first hour of an event are high stress does not agree with the intent of NUREG/CR-1278 nor common practice within the industry as confirmed with the developers of the HRA Calculator and the Chairman of the EPRI committee on HRA. Results from the CGS inquiry of the industry and alternative vendors, the time consideration for the stress factor for Internal Events PRA is NOT typically treated as interpreted by the peer review team. HRA leaders in the industry do not agree with the position on time pressure (less than 1 hr = high stress) associated with Finding 1-3. The Columbia upgrade project specifically used the most current methodology from EPRI (HRA Calculator) available. The general consensus is there have been improvements in knowledge and methodology since NUREG/CR-1278 was issued over 30 years ago that support execution error evaluations to be assessed considering current training regimes and the simple nature of such actions.

Page 10 of 22 Numerous HEPs where this is applied are risk-significant. Discussions with CGS staff indicated that the low stress was applied to actions that are relatively simple. However, since this simple actions are already low if failure rate, the stress factor is still applicable in order to differentiate between a simple action performed as a routine action, and a simple action performed in order to avoid core damage. Nominal stress is also applied for level II actions, such as failure to provide injection after the control rods fail (10 minute window) just prior to core damage. The general rules for this as applied by CGS do not appear consistent with NUREG/CR-1278 or other PRAs reviewed for this issue. F&O 1-33 SRs: LE-C7 HEPs are calculated using the HEP calculator, and are realistically treated in most cases consistent to the Applicable procedures. However, documentation on several actions was not found in the HRA notebook: 1)L2-HUMN-MUPHNOWS2)L2-HUMN-RCVR-SYS Note this is just a sampling of the notebook, so others may also be missing. L2-HUMN-MUPHNOWS is mentioned in Section C.16 of the LERF notebook, but not in the HRA notebook. Based on discussion with CGS, this HEP is set to 1.0 based on engineering judgment. L2-HUMN-RCVR-SYS is listed as using the HRA calculator, but is set to 0.9 based on engineering judgment. L2-HUMN-RCVR-SYS is risk-significant. Based on the Internal Events and Flooding HRA review, other HEPs are likely missing in the documentation (HRA notebook) that are credited in the analysis).

Add all missing HEPs from the Level II analysis into the HRA section, including events set to 1.0. Additionally, provide basis for HEP L2-HUMN-RCVR-SYS equal to 0.9 (since it is risk-significant), including information on timing, cues, procedures or other aspects causing little credit for the HEP.

Peer Review Resolved: This finding was resolved by adding Level II human failure events to the HRA Calculator and the summary Table 5.1-2 of the HRA Notebook. Also, as documented in Table C.4.7-2 of the CGS Level 2 notebook, the basis for the screening HEP for L2-HUMN-RCVR-SYS is engineering judgement.

Page 11 of 22 F&O 1-42 SRs: LE-C7 HEP Dependency Analysis included in Appendix D of the HRA notebook does not included in the Level II Analysis. Level II modeling includes new H EPs not in the Level I HRA. LERF may be underestimated if dependent HEPs are not included along with the independent HEPs. Complete a dependency analysis for Level II similar to the Level I analysis in HRA appendix D.

Peer Review Resolved: To resolve this peer review finding, a Level II HEP dependency analysis was performed and documented in Section 5 and Appendix D of the HRA Notebook. F&O 1-43 SRs: LE-C7 LE-D4 HRA events RHRHUMN-V--803XX and 903XX are included in the ISLOCA analysis but do not include dependency considerations. See the top cutset in Appendix D, dependency analysis. Based on discussion with CGS, the cutset with 2 operator failures is not valid, since t he valves are interlocked. Since these are ISLOCA cutsets, and significant for both CDF and LERF, dependency will be significant. Either: a) Add a dependency analysis for these events, or b) Provide justification for deletion of the cutset, and add the combination to the mutually exclusive event file.

Peer Review Resolved: This peer review finding has been resolved. The RHR-V-8 and RHR-V-9 have interlocks that prevent valve opening at normal RPV pressures above about 125 psig. Therefore human failure events RHRHUMN-V--8O3XX and RHRHUMN-V--9O3XX have been removed from the ISLOCA initiating event fault tree (that is, even in operators mistakenly select valve OPEN from the control board for either or both valves, the valves will not open). F&O 2-14 SRs: SY-A4 SY-C2 Interviews with plant system engineers or operators have not been documented and cannot be verified by the peer review team. Original interviews were performed for the original IPE. System and operations change over time, and the system engineers and operators should be consulted with regard to the system models. Perform and document the interviews with the system engineers and/or operators to confirm that the systems analysis correctly reflects the as-built, as-operated plant. It may be reasonable to develop a process that, following an initial interviews, the confirmation the model matches the as-built, as-operated plant is confirmed through review or discussion with the system engineers - typically through a periodic review of the notebook performed in accordance with plant procedures.

Peer Review Resolved: F&O, 2-14, for SR SY-A4 remains open but Is in the process being resolved to meet CC-II for SY-A4. Interviews with the system engineers have been started with a focus on confirming that the PRA systems analyses correctly reflect the asbuilt, asoperated plant, as well as to discuss recent operating history and any problems in system operation. At the time of this transmittal, 6 out of 26, interviews and reviews by System Engineering have been fully completed. The interviews and reviews were documented, and this documentation will be added to the system notebooks in the next PRA update. Discrepancies identified by the system engineer interviews to date had no impact on the PRA modeling, with the exception of one potential modeling conservatism for the reactor feedwater system model which does not have a risk-significant impact on the PRA results. Based upon the interviews and reviews conducted to date it is expected that there will be no risk significant findings. Resolution of this F&O will be provided by October 31, 2015 with the response to RAI 3.

Page 12 of 22

F&O 2-16 SRs: SY-A14 SY-C2 Failure modes have been considered in development of the system models adequately. However, the exclusion of some failure modes were not adequately documented. Some failure modes could be important to system models. A sample review of the system models show that the following failure modes may not have been fully investigated: (d) failure of a closed component to remain closed especially for standby components where the failure would not be identified quickly - say months or greater). (f) failure of an open component to remain open (see above)(g) active component spurious operation (h) plugging of an active or passive component (i) leakage of an active or passive component (j) rupture of an active or passive component (k) internal leakage of a component (l) internal rupture of a component (m) failure to provide signal/operate (e.g., instrumentation) (n) spurious signal/operation For example, in the [Residual Heat Removal] RHR system model, valves RHR-V54A/B could have a failure mode for fail to remain closed, which is not included in the model. The exposure time on these valves would rely on the surveillance tests. Consider adding documentation for both the inclusion and exclusion of the failure modes with justification for components included the system boundary. Consider adding more failure modes into the system models if the exclusion requires additional quantitative evaluations.

Peer Review Resolved: This peer review finding was reso lved. A Tier 3 calculation was prepared to ensure that failure modes have been considered in development of the system models adequately, with evaluation for both the inclusion and exclusion of the failure modes for components within the system boundary, including justification. Failure modes were added or corrected in the system models and system notebooks were updated based on this evaluation.

Page 13 of 22 F&O 2-17 SRs: S Y-A14 SY-C2 The following requirements associated with system modeling are determined to be not adequate: (e) actual operational history (such as [Significant Operating Experience Reports] SOERs) indicating any past problems in the system operation [not documented], (l) the components and failure modes included in the model and justification for any exclusion of components and failure modes [also see F&O 2-16], (q) the sources of the above information (e.g., completed checklist from walkdowns, notes from discussions with plant personnel) [also see F&O 2-14]. The following should be enhanced: (f) system success criteria and relationship to accident sequence models (k) assumptions or simplifications made in development of the system models. The inadequate documentation limits the review of the completeness of the system models. Consider adding the documentation associated with items (e), (l) and (q). Also consider enhancing the documentation for the following two items: (f) system success criteria and relationship to accident sequence models (k) assumptions or simplifications made in development of the system models (i.e., provide a bulleted list of major assumptions in each system notebook).

Peer Review Resolved: This peer review finding was resolved by enhancing system modeling documentation items associated with items (e), (l), (q), (f) and (k). For item (e), significant operating experience has been collected, but this information has not yet been incorporated into the system notebooks. This information will be incorporated into the system notebooks during future PRA update. (e) actual operational history (such as SOERs) indicating any past problems in the system operation was collected, and will be added to the system notebooks in a future PRA update, (f) documentation of system success criteria and relationship to accident sequence models was enhanced in the system notebooks, (k) documentation of assumptions or simplifications made in development of the system models was enhanced in the system notebooks, (l) the components and failure modes included in the model and justification for any exclusion of components and failure modes, and (q) the sources of the above information (e.g., notes from discussions with plant personnel) were documented. F&O 2-18 SR: LE-G6 The quantitative definition used for significant accident progression sequence was not documented. Add the quantitative definition used for significant accident progression sequence in the LE notebooks.

Peer Review Resolved: This peer review finding was resolved. Section 6.3 of the Level 2 Notebook was enhanced to add the quantitative definition used for significant accident progression sequence.

Page 14 of 22

F&O 2-28 SR: IFPP-B3 Sources of model uncertainty and related assumptions for flood plant partitioning were not documented in the flooding notebooks. Neither do the Internal Flooding items included in PSA-2-QU-0001 Tables 5-2 and 5-3. Sources of model uncertainty and related assumptions for flood plant partitioning are not documented. Investigate and document the sources of model uncertainty and related assumptions for flood plant partitioning. Perform sensitivity studies if deemed necessary.

Peer Review Resolved: The PRA Quantification Notebook Table 5-3, documents uncertainties and related assumptions for the overall PRA, including uncertainties and related assumptions for flood plant partitioning. This information was added to the IF notebooks for completeness. Sensitivity studies, other than the standard set of sensitivities, i.e., CCFs set to 5th and 95th percentile and HEPs set to 5th and 95th percentile, are not directed for the base PRA model per the EPRI Uncertainties/Assumptions methodology, 1016737, and were not performed.

Page 15 of 22 F&O 3-1 SRs: DA-D1 The process of developing plant-specific parameter data updates based on plant-specific experience and generic data is described in PSA-2-DA-0002, Bayesian Update of CGS PSA Data.

The process is focused on si gnificant basic events. However, the process used to determine which events are significant and should be Bayesian updated appears to be faulted. A set of screening criteria based on risk achievement worth, F-V, and Birnbaum importance measures is applied, but the criteria for determination of significant (i.e., per PSA-2-DA-0002, "RAW value of 3 is typically used in risk ranking initiatives to identify risk important components.") differs from those applied in risk-informed applications (e.g., Maintenance Rule, where RAW of 2 and F-V of 0.005 are normally used). In the DA screening, a RAW of 3 is used as the criterion, so it is possible that some significant basic event s could be screened from consideration using the process in PSA-2-DA-0002 (i.e., in Table 4 there would be a lower value for the CDF change for which a failure would be a candidate for Bayesian updating).Capability Category 2 for SR DA-D1 requires that realistic parameter estimates be calculated for all significant basic events. The process used to define which events are significant is not adequately objective and uses criteria that are inconsistent with selection criteria used for risk-informed applications (e.g., MR ), and may result in underestimating the set of significant events. After discussion with CGS PRA personnel, they performed a sensitivity evaluation to estima te the impact of using more appropriate screening criteria. This exercise identified one additional component type (RV/SV) for which there were no EPIX failures.

Consider using screening criteria more consistent with criteria used for important plant applications of the base PRA (e.g., Maintenance Rule) to ensure that potentially risk significant failures reflect plant experience.

Peer Review Resolved: This peer review finding has been resolved. Screening criteria consistent with important plant applications of the base PRA are now used, per RG 1.200, Rev. 2 (footnote page 10: Significant basic event/contributor: The basic events (i.e., equipment unavailabilities and human failure events) that have a Fussell-Vesely (FV)importance greater than 0.005 or a risk-achievement worth greater than 2): - The identification of plant-specific parameter data updates now uses a risk-achievement worth (RAW) value greater than 2 as one screening criterion, and - A FV of greater than 5E-3 is typically used in risk ranking initiatives to identify risk-significant components. The identification of plant-specific parameter data updates now uses a FV of 1E-4, because it was practical to do so.

Page 16 of 22 F&O 3-11 SR: SY-A24 The accident sequence model includes top event EAC, recovery of onsite AC power. The text of the AS notebook refers to Appendix D of that notebook for the onsite power recovery calculation. Appendix D is a portion of ERIN letter C1069805-3919 "Completion of CGS PSA Model Modifications to Address PSA Certification Comments (P.O.00303454)", August 3, 1999. titled Emergency AC Power Recovery. That analysis uses as its basis a 1993 regulatory analysis, SECY-93-190. There are 2 issues with this. First, the basis for the onsite AC power recovery is a set of EDG repair data from before 1993, i.e., significantly more than 16 years old, and originally based on relatively few data points. Second, this represents credit for repair of failed equipment without checking against plant-specific experience. Credit should not be taken for repair of failed equipment, particularly EDGs, without sound plant-specific basis.

Significance may be increased if tied to the F&O on consequential LOOP. Provide a sound basis for the present-day validity of the repair probabilities, or remove the credit from the model.

Peer Review Resolved: This peer review finding was resolved by enhancing Appendix D of the accident sequence notebook to further support that the existing EDG non-recovery values based on SECY-93-190 are judged to be appropriate for CGS. Further, the Emergency AC Power recovery values from SECY-93-190 used in the CGS PRA were compared with more recent data from NUREG/CR-6890. The SECY-93-190 data produces non-recovery probabilities that are higher relative to the NUREG/CR-6890 data. The following comparison is made: Recovery Time (hr),SECY-93-190,NUREG/CR-6890 0.5, 0.89, 0.86 2, 0.86, 0.65 3, 0.78, 0.56 4, 0.71, 0.48 6, 0.59, 0.37 10, 0.4, 0.24 15, 0.29, 0.14 24, 0.23, 0.24 The SECY-93-190 data provides higher non-recovery values for the entire range of EDG recovery times. Although the NUREG/CR-6890 diesel non-recovery data development is more recent, there is one prominent concern about the NUREG/CR-6890 data for purposes of the Columbia PSA modeling. The NUREG/CR-6890 non-recovery values assume that the diesel generator that is most straightforward to repair will be chosen for recovery. What is not clear from the NUREG/CR-6890 treatment is Page 17 of 22 how the SPAR models address the possibility that the DG that is easiest to repair actually won't be restored because the associated SW pump or RHR pump is out of service. The Columbia model assumes a 50-50 percent likelihood for recovery of DG-1 or DG-2, unless the SW or RHR pump on one of the diesel generators is out of service. Due to this potential conflict, the NUREG-6890 data was not used. The SECY-93-190 data is judged to be the most applicable and realistic. F&O 4-7 SR: MU-C1 While consideration of pending model changes has occurred for important applications (e.g. DGAOT), there was no identified Columbia process that requires that pending changes be considered for applications. Having such a process is an explicit requirement of the standard. Consider revising SYS-4-34 or other procedure/instruction to address this issue. A industry model process for performing Maintenance and Update is provided in the BWROG document TP-09-012 Living PRA Configuration Control and Model Maintenance, however use of this process is not a requirement of the ASME Standard.

Peer Review Resolved: The peer review finding was resolved. A new Section 4.4 was added to the model maintenance and update procedure, SYS-4-34, that documents the Columbia process that requires pending model changes to be considered for applications. Also, a list of current applications that require a consideration of pending model changes in applications was added in SYS-4-34, Attachment 8.2. F&O 6-10 SR: SY-B1 A variety of common cause basic events exist in the model without documentation provided to substantiate their basis. For example, Table 1 of PSA-2-DA-0004 lists 13 CCF events with probabilities of zero related to relays, vacuum breakers, and nitrogen bottles. Table 1 also lists two events that are termed CCF place keepers but not true CCF events. These are not further discussed. Table 1 lists CCF events with apparently generic values (1E-6), but no discussion or justification is provided to substantiate the value. Table 1 lists CCF events for 5 of 7 ADS valves and 5 of 11 SRVs, with values of 1.24E-6, but no discussion / justification is provided. Table 2 lists an event (CRDSV--24567C8LL) for "8 of 8", but uses the NRC data for "2 of 2" instead of the closer "6 of 6" value. Upon review, CGS noted that this event is not needed in the model and will be removed in the next update.

Provide a basis for all CCF values, including events set to 0.0, based on the CCF analysis process.

Peer Review Resolved: This peer review finding has been resolved. The documentation of CCF events has been refined and improved. The bases for all CCF values are provided, based on the CCF analysis process.

Page 18 of 22 F&O 6-8 SR: SY-B1 Several issues were identified in the review of CCF: 1)The process to develop common cause groups is notdocumented in the CCF NB and therefore justification is not provided for the grouping scheme. Per CGS, selection of CCF groups was performed following the guidance of NUREG/CR-5485 based on similarities in service conditions, environment, design or manufacturer, and maintenance. NUREG/CR-5485 is not currently referenced in PSA-2-DA-0004. 2)There are limited formulae documented in the CCF datapackage PSA-2-DA-0004. As a result, the bases for the calculations embedded in the spreadsheets are not fully documented. Discussions with CGS staff indicates the Alpha CCF calculations were performed incorrectly. Moreover, based on the formulae in NUREG/CR-5485, the CCF basic event probabilities may be slightly more conservative. 3)As a result of the above, CCF basic events are incorrectly calculated. Add CCF grouping methodology to PSA-2-DA-0004, and add formulae for the CCF basic event probability calculations. Add reference in the data notebook to NUREG/CR-5485. Re-evaluated CCF values, based on the revised methods.

Peer Review Resolved: This peer review finding has been resolved. The process to develop common cause groups is now documented in PSA-2-DA-004. CGS employs staggered testing of redundant trains modeled in the PRA. Therefore, CCF probabilities were recalculated using the CCF equations for staggered testing, and these equations are documented in PSA-2-DA-004, and the PRA was updated. F&O 6-9 SR: SY-B1 Per Section 2 of PSA-2-DA-0004, the common cause calculations are based on a non-staggered testing scheme based on the prior use of this scheme for the original PRA and the fact that current CGS test intervals / test information has not been developed for the current data update. PSA-2-DA-0004 notes that the non-staggered approach is conservative. The staggered approach should be utilized where appropriate to reflect plant practices. Redevelop CCF approach using staggered approach where appropriate.

Peer Review Resolved: This peer review finding has been resolved. CGS employs staggered testing of redundant trains modeled in the PRA. Therefore, CCF probabilities were recalculated using the CCF equations for staggered testing, and these equations are documented in PSA-2-DA-004, and the PRA was updated.

Page 19 of 22 SA-IF-E5a-1 SR: IFQU-A6 No documentation was found of how scenario-specific impacts were addressed for operator actions taken in response to an internal flooding event. Supporting requirement IFQU-A6 requires the following: For all human failure events in the internal flood scenarios, INCLUDE the following scenario-specific impacts on PSFs for control room and ex-control room actions as appropriate to the HRA methodology being used: (a) additional workload and stress (above that for similar sequences not caused by internal floods) (b) cue availability (c) effect of flood on mitigation, required response, timing, and recovery activities (e.g., accessibility restrictions, possibility of physical harm) (d) flooding-specific job aids and training (e.g., procedures, training exercises) Review all HEPs for actions that could be taken following an internal flood and address how they would be impacted by the flood. Document this review and modify the analysis accordingly.

Self-Assessme nt Resolved: This self-assessment finding has been resolved. The internal flooding HRA assesses scenario-specific impacts on PSFs, including additional workload and stress, cue availability, effect of flood on mitigation, required response, timing, and recovery activities flooding-specific procedures and training. These enhancements to the HRA are documented in the HRA Calculator and in the HRA Notebook.

Page 20 of 22 No PRA models other than the internal even ts PRA will be used for detailed quantitative analys is. 2.The LAR indicates that PR A models other than the in ternal events PRA model maybe used. Please confirm that these PR A models reflect the current plant configuration and operation.

If this is not the case, please explain how the PRAmodels support the application, using Nucl ear Energy Institute (NEI) 04-10, Revision 1, "Risk-Informed Technical Specifications Initiative 5b, Risk-Informed method forControl of Surveillance Frequencies," April 2007 (ADAMS Accession No.

ML071360456) guidance, and whet her current plant confi guration and operation is considered in their use. No PRA models other than the internal even ts PRA will be used for detailed quantitative

analys is. The qualitative assessment of fi re risk and other external ev ent risk will include a review of applicability to the current plant configuration and operati on. For example, some STI change evaluations, per Step 10b qualitative reasoning and very low CDF and LERF results from the internal events analysis may be sufficient to support the STI change evaluation where Step 10b reads in part:

"Alternative evaluations for the impact from external events and shutdown events are also deemed acceptable at this point. For example, if the CDF and LERF values have been demonstrated to be very small from an internal events perspective based on detailed analysis of the impact of the SSC being evaluated for the STI change, and if it is known that the CDF or LERF impact from external events (or shutdown events as applicable) is not specifically sensitive to the SSC being evaluated (by qualitative reasoning), then the detailed internal events evaluations and associated required sensit ivity cases (as described in Step 14) can be used to bound the potential impact from external events and shutdown

PRA model contributors."

Therefore, by following the NEI 04-10, Rev. 1 guidance, the evaluation of fire risk and other external events supporting this applicat ion will qualitatively reflect and consider the current plant config uration and operation.

Page 21 of 22 3.The impact of the open F&O for supporting requirement (SR) SY-A4 states thatsensitivity analysis will be perfo rmed. It is not clear how a sensitivity analys is could be defined to address the lack of documented interviews that confirm that system analyses represent the as-built, as-operated plant. The TSTF-425 program considers capability category II for the internal events PR A model; therefore, please address this F&O to meet capability categor y II and provide the disposition of the F&O. Based on discussions with the Columbia NRC Project Manager, this RAI response will be submitted by October 31.

4.The peer review F&O on SR DA-C6 is related to meeting the data requirement s forstandby components (SR DA-C6) as well as for surveillance requirements (SR DA-C7). The F&O states: "E stimates based on the surveillance tests and maintenanceacts as described in DA-C6 and DA-C7 should be performed for significantcomponents whose data are not tracked in the MSPI data." SR DA-C6 and SR DA-C7 include consideration of plant-specific data. Please explain the basis for concluding that the proposed sensitivity analyses, which are based on generic data, are considered bounding if these two SRs are graded at not met or capabilitycategory I. If use of plant-specific dat a consistent with SR DA-C6 and SR DA-C7

cannot be demonstrated to be bounding with re spect to the proposed method to perform sensitivity analyses for relevant components, then please complete the workto meet SR DA-C6 and SR DA-C7 provide the disposition of the F&O. The 2009 peer review graded supporting requi rements DA-C6 and DA-C7 as met for CC-II: DA-C6 Assessment: MET fo r Capability Categories I-III DA-C7 Assessment: MET fo r Capability Categories I-III The SRs were met because the major components' maintenance activities were based mainly on MSPI data. Finding 2-2 applies to non-MSPI components that were based on estimates.

Page 22 of 22 A sensitivity study was performed by replacing the base data for these failure modes with generic data from NUREG/CR-6928. It was determined that the finding is unlikely to change the conclusions of risk-informed decisions. Although Finding 2-2 is open, the SRs are graded at met fo r CC-II and the impact is unlikely to affect the results. 5.Do the failure probabilities of struct ures, systems, and components modeled in the CGS internal events PRA include a standby time-related contribution and a cyclic demand-related contribution? If not, please describe how standby time-relatedcontribution is addressed for extended intervals. The failure probabilities of structures, system s, and components modeled in the CGS internal events PRA include either a st andby time-related contribution or a demand-related contribution.

The standby time-related failures will be ev aluated in accordance with NEI-04-10, Revision 1 by direct change in the test inte rval for those SSCs t hat include a standby periodically tested failure mode along with the appropriate adjustments to common cause failure events. For demand-related events an appropriate time-related failure contribution will be determined for each component that is uniquely impacted by the proposed STI change to obtain the maximu m test-limited risk contribution.