RA-18-0178, Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for ...

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for ...

ML18306A523
Person / Time
Site:	Brunswick
Issue date:	11/02/2018
From:	Donahue J Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RA-18-0178
Download: ML18306A523 (119)

Text

Joseph Donahue Vice President Nuclear Engineering 526 South Church Street, EC

-07H Charlotte, NC 28202 980-373-1758 Joseph.Donahue@duke

-energy.com 10 CFR 50.90 November 2, 2018 Serial: RA 0178 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

-0001 Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Renewed Facility Operating License Nos. DPR

-71 and DPR

-62 Docket Nos. 50

-325 and 50

-324

Subject:

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors"

References:

1. Duke Energy letter, Application to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors", dated January 10, 2018 (ADAMS Accession No.

ML18010A344). 2. NRC letter, Requests for Additional Information Related to License Amendment Request to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors", dated October 9, 2018 (ADAMS Accession No. ML18282A149).

Ladies and Gentlemen:

By letter dated January 10, 2018 (Reference 1), Duke Energy Progress, LLC (Duke Energy) submitted a license amendment request (LAR) for Brunswick Steam Electric Plant (BSEP), Unit No s. 1 and 2. The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 50.69, "Risk

-informed categorization and treatment of structures, systems, and components for nuclear power reactors."

By letter dated October 9, 2018 (Reference 2), the Nuclear Regulatory Commission (NRC) staff requested additional information from Duke Energy that is needed to complete the LAR review.

The enclosure to this letter provides Duke Energy's response to the NRC RAI.

Attachment 1 contains a PRA implementation item which must be completed prior to implementation of 10 CFR 50.69 at BSEP. Attachment 2 contains proposed markups of the BSEP Renewed Facility Operating License for both Units 1 and 2. Attachment 3 contains a supplement to Reference 1 with updated BSEP high winds PRA core damage frequency (CDF) and large early release frequency (LERF) values.

Serial: RA 0178 Brunswick Steam Electric Plant , Unit s 1 and 2 Docket No s. 50-325 and 50

-324 / Renewed License No

s. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" Enclosure Response to NRC Request for Additional Information

U.S. Nuclear Regulatory Commission Page 2 of 108 Serial RA-18-0178 Enclosure NRC Request for Additional Information By letter dated January 10, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18010A344), Duke Energy Progress, LLC, (Duke Energy, the licensee), submitted a license amendment request (LAR) for Brunswick Steam Electric Plant (BSEP), Units 1 and 2. The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 50.69, "Risk

-informed categorization and treatment of structures, systems, and components for nuclear power plants," and provide the ability to use probabilistic risk assessment (PRA) models, namely the internal events PRA, internal flooding PRA (IFPRA), internal fire PRA (FPRA), high winds PRA (HW PRA), and external flooding PRA (XF PRA) for the proposed 10 CFR 50.69 categorization process.

Regulatory Guide (RG) 1.201, Revision 1, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance," May 2006 (ADAMS Accession No.

ML061090627), endorses, with regulatory positions and clarifications, the Nuclear Energy Institute (NEI) guidance document NEI 00-04, Revision 0, "10 CFR 50.69 SSC [Structure, System, and Component] Categorization Guideline," July 2005 (ADAMS accession No.

ML052910035), as one acceptable method for use in complying with the requirements in 10 CFR 50.69. Both RG 1.201 and NEI 00-04 cite RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," February 2004 (ADAMS Accession No.

ML040630078), which endorses industry consensus PRA standards, as the basis against which peer reviews evaluate the technical acceptability of a PRA. Revision 2 of RG 1.200 issued March 2009 is available at ADAMS Accession No.

ML090410014.

Section 3.1.1 of the LAR states that Duke Energy will implement the risk categorization process of 10 CFR 50.69 in accordance with NEI 00-04, Revision 0, as endorsed by RG 1.201. However, the licensee's LAR does not contain enough information for the U.S. Nuclear Regulatory Commission (NRC) staff to determine if the licensee has implemented the guidance appropriately in NEI 00-04, as endorsed by RG 1.201, as a means to demonstrate compliance with all of the requirements in 10 CFR 50.69, including technical adequacy of the PRA models. The NRC staff requests additional information (RAI) for the following areas in order to complete its assessment.

U.S. Nuclear Regulatory Commission Page 3 of 108 Serial RA-18-0178 Enclosure PRA RAI 1 - Open/Partially Open Findings in the Process of Being Resolved: Section 4.2 of RG 1.200 states, in part, that the LAR should include:

A discussion of the resolution of the peer review facts and observations (F&Os) that are applicable to the parts of the PRA required for the application. This discussion should take the following forms:

A discussion of how the PRA model has been changed, and A justification in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application decision were not adversely impacted (remained the same) by the particular issue.

of the LAR, "Disposition and Resolution of Open Peer Review Finding and Self

-Assessment Open Items," provides F&Os and self

-assessment findings that are still open or partially resolved following the August 2017 F&O closure review. Also, F&O descriptions and their dispositions were previously provided to the NRC in the LAR dated December 21, 2015 (ADAMS Accession No. ML16004A249) to adopt Technical Specification Task Force (TSTF)

-425, "Relocate Surveillance Frequencies to Licensee Control - Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b" (ADAMS Accession No. ML12285A428) to adopt National Fire Protection Association Standard 805. For a number of F&O dispositions, there is insufficient information for NRC staff to conclude that the F&O is sufficiently resolved for this application.

a. Internal events F&O 1

-19 pertaining to component failure data. This F&O description states that the component failure data values documented in BNP

-PSA-049 were developed during a previous PRA update and that some values may need to be updated to be consistent with changes in the Level 1 PRA data. The licensee's disposition states that "[o]nly 4 events were found and all of them had either a [Fussell

-Vesely (FV)] in the x10

-3 range or a [Risk Achievement Worth (RAW)] of 1. Because of the small number of events that could have a

need to be updated but were not, the relatively low value of FV for three of the retained events, and the relatively low RAW value on the remaining event, the effect on 50.69 applications is negligible." The response does not clarify how it was determined what events might need to be updated, only that there were four events identified. Furthermore, the SSC will be low safety significant (LSS) if the RAW<2 AND the FV<0.005, but the conclusion that updates were not needed seems to be based on the argument the RAW OR the FV is low.

1. Clarify how the check was performed to determine if any data needed to be updated including how the conclusion was reached that "only 4 events were found."

2. Provide the RAW and FV of the four events, and some indication of the change in the failure likelihood expected from a data update. Based on the data provided, indicate the expected changes to the RAW and FV values.

3. Alternatively, propose a mechanism that ensures F&O 1

-19 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should U.S. Nuclear Regulatory Commission Page 4 of 108 Serial RA-18-0178 Enclosure also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

Duke Energy Response to PRA RAI 1.a.: Importance measure reports were generated from the Unit 1 and Unit 2 LERF cutsets. Basic events representing component failures in the LERF model were identified. Basic events that were quantified based on component failure rates were retained. This left the following four events. Unit Event Description Probability FV RAW 1 CZN1PHE-NO-ILOCA INDUCED INTERFACING SYSTEM LOCA 2.16E-04 4.61E-03 22.3 HSS 1 SPN1VBV-CO-SRV-- SRV DISCHARGE VACUUM BREAKERS FAIL OPEN 0.1 5.60E-03 HSS 1.05 2 CZN2PHE-NO-ILOCA INDUCED INTERFACING SYSTEM LOCA 2.16E-04 4.51E-03 21.9 HSS 2 SPN2VBV-CO-SRV-- SRV DISCHARGE VACUUM BREAKERS FAIL OPEN 0.1 5.45E-03 HSS 1.05 Expected change in failure probabilities and importance values given a data update.

Unit Event Updated Probability Data Source Updated FV Updated RAW 1 CZN1PHE-NO-ILOCA 6.28E-05 Calculation of undeveloped event probability updated to use latest generic value for check valve fails to close from NUREG 6928, 2015 data update. (See Table C.6.7

-2, Note 2 of BNP-PSA-049 for applicable equation.)

8.78E-04 22.4 HSS 1 SPN1VBV-CO-SRV-- 0.1 NUREG-1150 value retained due to uncertainty in the number of times the SRV tailpipe vacuum breakers would cycle during modeled accidents.

5.62E-03 HSS 1.05 U.S. Nuclear Regulatory Commission Page 5 of 108 Serial RA-18-0178 Enclosure 2 CZN2PHE-NO-ILOCA 6.28E-05 Same as for CZN1PHE

-NO-ILOCA. 8.59E-04 21.9 HSS 2 SPN2VBV-CO-SRV-- 0.1 Same as for SPN1VBV

-CO-SRV--. 5.47E-03 HSS 1.05 Thus, after updating the component failure rate data, there is no change in the categorization results. b. Internal events F&O 3-6 pertaining to human reliability analysis (HRA). This F&O description notes a specific issue related to the HRA calculation for event OPER

-DCDG, specifically, no execution failure probabilities were assigned to the tasks of starting and connecting the diesel generator (DG). Additionally, the calculation may not have considered all of the necessary breaker manipulations. The licensee's resolution states that the standard is met and this is an opportunity for enhancement to the documentation and does not affect the core damage frequency (CDF) or the risk metrics. However, the licensee's resolution did not directly address this specific issue, which does not appear to be just a documentation issue. Explain how the finding concerning OPER

-DCDG was resolved and clarify if the model of record (MOR) has been updated to incorporate this resolution.

Duke Energy Response to PRA RAI 1.b.: The plant no longer relies on the SAMA DG to supply power to the battery chargers. Basic event OPER-DCDG has been deleted from the internal events model.

c. Internal flooding F&O IFSN

-A8 pertaining to the effects of expansion joint failures. The F&O description notes that no propagation from gaskets or expansion joints was modeled in the IFPRA. The licensee's disposition states that the circulating expansion joints are not risk significant to the BSEP IFPRA risk as circulating water piping does not contribute a significant amount to CDF/large early release frequency (LERF) and circulating water expansion joint ruptures represent a small portion of the total rupture frequency for IFPRA. Although this modeling exclusion may have a small impact on the total risk, its inclusion could potentially increase the risk importance values for certain system components above the threshold criteria for determining high safety significance (HSS).

1. Justify that the circulating expansion joint modeling exclusion above does not impact the results of the 10 CFR 50.69 categorization process.

2. Alternatively, propose a mechanism that ensures F&O IFSN

-A8 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

U.S. Nuclear Regulatory Commission Page 6 of 108 Serial RA-18-0178 Enclosure Duke Energy Response to PRA RAI 1.c.: The lack of expansion joint modeling will not impact the importance values generated for components. The expansion joints are located in pits in the Turbine Building. If an expansion joint were to rupture, the level in the corresponding pit would rapidly increase.

Level sensors in these pits would then trip the CWIPs, which would cause a plant trip. Floor drains within these pits are sealed. Plant design features would prevent gravity flow of water into the Turbine Building once the plant and the pumps trip. Based on this the rupture of the expansion joints would be a self

-extinguishing event that is contained within the condenser pits. As there is no additional consequence from the expansion joint rupture, this event is already represented by the internal events model and additional consideration in the IFPRA is not needed.

In addition the probability of flooding from expansion joint failure and subsequent failure of the level switches to trip the CW pumps has been evaluated and found to be a sufficiently low probability of occurrence that it can be screened out per the criteria of IE

-C6. Each unit has twelve circulating water expansion joints. This represents a probability of 1.46E

-04 (from EPRI TR 3002000079) per year risk of rupture. Assuming a conservative failure probability of 0.01 for the hardware failure of the level switches and an additional 0.1 for the failure of the operators to isolate the flood or trip the unit in a timely manner, the initiating event probability for this scenario is 1.46E

-07. This initiating event would not impact safety systems or mitigating systems within the Auxiliary Building. Flooding would be contained to only the Turbine Building.

As no mitigating systems would be impacted by the flood, BNP would have the entire complement of mitigating systems (two or more) for initiating event or accident mitigation. This initiating event probability meets the criteria for exclusion from the IFPRA model per supporting requirement IE

-C6 part b of the AMSE/ANS PRA Standard and therefore does not need to be further considered.

U.S. Nuclear Regulatory Commission Page 7 of 108 Serial RA-18-0178 Enclosure

d. Internal events F&O QU

-C2-1 pertaining to human reliability analysis. The F&O description indicates that some joint human failure events (JHFEs) may be assigned a floor value of 1E

-6, and suggested that these cutsets be evaluated to determine the appropriateness of this value. In contrast, the reported disposition states "in examining the top 95% cutsets, there were some cutsets with 5 and 6 human error probabilities (HEP) events that were not explicitly analyzed for dependencies." It is not clear whether "not explicitly analyzed" means the floor value was assigned, or there was no justification of a result that was less than a floor value.

For performing HRA dependency analysis, NUREG

-1921, "EPRI [Electric Power Research Institute]/NRC

-RES Fire Human Reliability Analysis Guidelines - Final Report," July 2012 (ADAMS Accession No. ML12216A104), discusses the need to consider a minimum value for the joint probability of multiple HFEs, and refers to NUREG

-1792, "Good Practices for Implementing Human Reliability Analysis (HRA)," April 2005 (ADAMS Accession No.

ML051160213) (Table 2

-1), which recommends joint human error probability (JHEP) values should not be below 1E

-5. Table 4

-3 of EPRI Technical Report 1021081, "Establishin g Minimum Acceptable Values for Probabilities of Human Failure Events," October 2010, provides a lower limiting value of 1E

-6 for sequences with a very low level of dependence. Therefore, the available guidance provides for assigning joint HEPs that are less than a minimum value but only through assigning proper levels of dependency. Cutsets with JHEP values less than the minimum value should be individually reviewed for timing, cues, etc. to check the dependency between all the operator actions in the cutset. Consistent with the guidance, please confirm that, for JHEP values below 1E

-5 in the FPRA models, and for JHEP values below 1E

-6 in the internal events PRA, the justification for these values have been documented.

Duke Energy Response to PRA RAI 1.d.: The probability associated with J HFEs is determined by examining the context of the cutsets in which they occur. This is done in each case by laying out a time line for the sequence of events of interest, and by qualitatively considering the factors that imply dependence or independence for the combined events. For cases in which there are more than two events, this entails considering the level of dependence between the first two events, and then the conditional level of dependence for successive events given failure of the preceding events.

In the Fire PRA, there are 35 JHEP values below 1E

-5; 25 are set at the floor value of 1E

-6 and the other 10 range in value between 1E

-6 and 1E-5. For JHEP values below 1E

-5, the justification for these values have been documented. The degree of dependence is evaluated by considering:

whether the same actions are performed relative timing between actions similarity of cues whether the accident sequence includes an intervening success.

In the internal events PRA, there are no JHEP values below the floor of 1E

-6.

U.S. Nuclear Regulatory Commission Page 8 of 108 Serial RA-18-0178 Enclosure

e. Internal flooding F&O IFEV

-A5 pertaining to internal flood pipe break frequencies.

The F&O description states that a new methodology was applied to use pipe length, and flood and major flood frequency based on diameter and flow rate and that the analysis only applied major flood frequencies to large pipe, omitting flood frequency from large pipe which is the dominant frequency. In addition, the description notes that the break frequencies used in the calculation are applied incorrectly in the analysis. The licensee's disposition states that since the flooding frequency data in the calculation and the EPRI data have different pipe size breakpoints, the pipe size intervals were adjusted to match. The corresponding frequencies were then adjusted by the ratio of new EPRI flood and major flood frequency to existing major flood frequency. The appropriate multiplier was then applied to each scenario based on pipe size and fluid system type. The licensee disposition does not address the use of a new method or the incorrect application of the break frequencies.

The ASME/ANS RA

-Sa-2009 Standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA

-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard. Provide the following:

1. A description of the proposed methodology and basis for determining the internal flood scenario initiating event frequencies. Include in this discussion the reference(s) for the methodology. If the methodology is modified from that described in the reference(s), include a summary of how the information and values in the reference is modified into the values used in the PRA.

2. A discussion about how the new method is expected to affect the repair and replacement categorization methodology (passive categorization) summarized in the LAR. 3. A discussion on whether the methodology used constitutes a "PRA upgrade" as defined in the PRA Standard (i.e., ANSME/ANS RA

-Sa-2009), as endorsed by RG 1.200. If the new method is expected to affect the passive categorization methodology and the use of the methodology is considered a PRA "upgrade," then propose a mechanism to ensure that a focused

-scope peer review of the upgrade and the disposition of any resulting F&Os to meet Capability Category II will be completed prior to implementing the 10 CFR 50.69 categorization process.

Duke Energy Response to PRA RAI 1.e.:

The updated pipe rupture frequencies are not based on a new methodology. The original frequencies were from an older revision of the EPRI Pipe Rupture Frequencies technical report.

These were updated to the (at the time) newest revision of the EPRI pipe rupture frequencies (TR 3002000079). They were updated by taking the ratio of the old and new EPRI frequencies. This ratio was then applied to the original BNP IFPRA rupture frequencies for a given scenario.

This does not represent a change in methodology, scope, or capability or impact the significant accident sequences or the significant accident progression sequences as defined in Appendix 1-A of the ASME/ANS PRA Standard as it is a generic data update from an updated version of the original source.

U.S. Nuclear Regulatory Commission Page 9 of 108 Serial RA-18-0178 Enclosure Implementation of this method will not affect the passive categorization methodology summarized in the LAR. The passive categorization methodology assumes postulated pressure boundary failures have a failure probability of 1.0, thus the pipe rupture frequency is not used in the analysis.

f. Fire F&O 1

-34 pertaining to fire barrier failure probabilities. The F&O description notes that a screening value for rated barrier probability of 1E

-2 was applied in the PRA and that this value may not be bounding depending on the features of the barrier. The licensee's disposition states that the 0.1 barrier failure probability was inappropriately applied for certain fire compartment combinations where the partitioning element was open and that it is expected to have no more than a minimal impact on the 50.69 application. Although thi s incorrect modeling may have a small impact on the total risk, it could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS. Provide the following:

1. A justification that use of the incorrect fire barrier failure probability exclusion cited above does not impact the results of the 10 CFR 50.69 categorization process.

2. Alternatively, propose a mechanism that ensures F&O 1

-34 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

Duke Energy Response to PRA RAI 1.f.:

F&O 1-34 has been resolved in the BNP Fire model. To correct this issue, the appropriate fire barrier failure probabilities have been applied. Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05-04, NEI 07

-12 and NEI 12

-13, "Close

-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No.

ML17079A427).

The results of this review have been documented and are available for NRC audit. g. Internal fire F&O 4-1 pertaining to fire severity factors. The licensee's disposition states that the treatment of motor control centers (MCCs) is not in accordance with FAQ 14

-0009, "Treatment of Well Sealed MCC Electrical Panels Greater than 440V," October 2014 (ADAMS Accession No. ML15118A810), and that in lieu of an accepted generic method, BSEP used the analysis method piloted at HNP [Harris Nuclear Plant], but that the impact on the 50.69 application is expected to be small. However, though this modeling may have a small impact on the total risk, its inclusion could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS.

1. Justify that the modeling of MCCs cited above as opposed to using the accepted FAQ 14-0009 modeling does not impact the results of the 10 CFR 50.69 categorization process. 2. Alternatively, propose a mechanism that ensures F&O 4

-1 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should U.S. Nuclear Regulatory Commission Page 10 of 108 Serial RA-18-0178 Enclosure also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 1.g.: F&O 4-1 has been resolved in the BNP Fire model. To correct this issue, the cabinet breaching factor was updated to 0.23 to comply with FAQ 0009. Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05

-04, NEI 07

-12 and NEI 12-13, "Close

-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427).

The results of this review have been documented and are available for NRC audit.

h. Internal fire F&O 6-4 pertaining to fire barrier failure for multi

-compartment analysis.

The F&O description describes issues with calculating failure probability of passive fire barriers in the multi-compartment analysis. The disposition is incomplete and, as a result, the NRC staff is unable to assess the disposition to this F&O and the licensee's conclusion that is has "no more than a minimal impact."

1. Clarify the disposition of this F&O.

2. If the disposition does not update the FPRA to resolve the F&O and meet Capability Category II for Supporting Requirement FSS

-G4, provide justification that the resolution does not impact the results of the 10 CFR 50.69 categorization process. [The NRC staff notes that a small impact on the total risk could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS.]

3. Alternatively, propose a mechanism that ensures F&O 6

-4 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should

also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 1.h.: F&O 6-4 has been resolved in the BNP Fire model. As described in the LAR, the finding was that the fire barrier failure rates used in the BNP Fire model are those prescribed in NUREG

-6850, however, the worst-case value for failure probability of the barrier was used.

To correct this issue, the summed fire barrier failure probabilities are applied, rather than the worst case (as was previously in the model). Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05-04, NEI 07

-12 and NEI 12

-13, "Close-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The results of this review have been documented and are available for NRC audit.

PRA RAI 2 - Qualitative Function Categorization: Table 3-1 of the LAR indicates that the evaluation of the seven qualitative criteria defined in Section 9.2 of NEI 00

-04 is performed at the function level and prior to the Integrated Decision

-making Panel (IDP). The LAR states that NEI 00

-04 only requires the seven qualitative criteria U.S. Nuclear Regulatory Commission Page 11 of 108 Serial RA-18-0178 Enclosure to be completed for components/functions categorized as LSS. Table 3

-1 of the LAR contains the entry "Allowable" at the intersection of the "IDP change HSS to LSS" column and "Qualitative Criteria" row, which appears to contradict the premise that the seven criteria are only applied to LSS functions. The guidance in NEI 00

-04 states that the IDP should consider the impact of loss of function/SSC against the remaining capability to perform the basic safety functions.

Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS including a clarification of the "Allowed" entry in LAR Table 3-1and confirm that a negative answer to any of the seven questions would result in the function/SSC to be categorized as HSS.

Duke Energy Response to PRA RAI 2: The assessments of the qualitative considerations are agreed upon by the Integrated Decision

-making Panel (IDP) in accordance with NEI 00

-04 Section 9.2.

It is generally expected that a 50.69 categorization team will provide preliminary assessments of the seven considerations for the IDP's consideration, however this is not a requirement and the final assessments of the seven considerations are the direct responsibility of the IDP.

In cases where the 50.69 categorization team provides a preliminary assessment of the seven qualitative considerations to the IDP, the seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS. Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e. all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

PRA RAI 3 - Passive Component Categorization Process:

Section 3.1.2 of the LAR states that passive components and the passive function of active components will be evaluated using the method for risk-informed repair/replacement activities consistent with the safety evaluation issued by the Office of Nuclear Reactor Regulation, "Request for Alternative ANO2

-R&R-004, Revision 1, Request to Use Risk

-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10

-Year In-service Inspection Intervals," for Arkansas Nuclear One, Unit 2 (ANO

-2), dated April 22, 2009 (ADAMS Accession No. ML090930246). The LAR further states that this methodology will be applied to determine the safety significance of Class 1 SSCs.

U.S. Nuclear Regulatory Commission Page 12 of 108 Serial RA-18-0178 Enclosure This methodology has only been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequences of pressure boundary failure for Class 1 SSCs may be different from Class 2 and Class 3 SSCs and, therefore, the criteria in the ANO

-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

The LAR does not justify how the ANO

-2 methodology can be applied to Class 1 SSCs and how sufficient defense

-in-depth and safety margins are maintained. A technical justification for Class 1 SSCs should address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: (1) justification of the appropriateness of the numerical criteria for conditional core damage probability (CCDP) and conditional large early release probability (CLERP), used to assign 'High', 'Medium', and 'Low' safety significance to these loss

-of-coolant initiating events; (2) identification and justification of the adequacy of the additional qualitative considerations to assign 'Medium' safety significance (based on the CCDP and CLERP) to 'High' safety significance; (3) justification for crediting operator actions for success and failure of pressure boundary; (4) guidelines and justification for selecting the appropriate break size (e.g., double-ended guillotine break or smaller break); and (5) include supporting examples of types of Class 1 SSCs that would be assigned low safety significance, etc.

As mentioned in the March 13, 2018, meeting summary for the February 20, 2018, Risk

-Informed Steering Committee (RISC) meeting (ADAMS Accession No. ML18072A301), the NRC staff understands that the industry is planning to limit the scope to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle Electric Generating Plant, Units 1 and 2, license amendment dated December 17, 2014 (ADAMS Accession No. ML14237A034).

Provide the requested technical justification or confirm the intent to apply the ANO

-2 passive categorization methodology only to Class 2 and Class 3 equipment.

Duke Energy Response to PRA RAI 3:

The passive categorization process is intended to apply the same risk

-informed process accepted by the NRC in the ANO2

-R&R-004 for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N

-660 and N-662 as published in Regulatory Guide 1.147, Revision 15. Both code cases employ a similar risk

-informed safety classification of SSCs in order to change the repair/ replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned high safety

-significant, HSS, for passive categorization which will result in HSS for its risk-informed safety classification. This classification cannot be changed by the IDP.

U.S. Nuclear Regulatory Commission Page 13 of 108 Serial RA-18-0178 Enclosure PRA RAI 4 - Identifying Key Assumptions and Uncertainties that could impact the Application: Section 3.2.7 of the LAR states that the detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG

-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk

-Informed Decision Making," March 2009 (Revision 0) (ADAMS Accession No. ML090970525), and Section 3.1.1 of EPRI Technical Report (TR)

-1016737. The NRC staff notes that one of these sources has been superseded by a revision (Revision 1 of NUREG

-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk

-Informed Decisionmaking," March 2017 (ADAMS Accession No. ML17062A466), which references the updated EPRI guidance TR

-1026511, "Practical Guidance on the Use of PRA in Risk

-Informed Applications with a Focus on the Treatment of Uncertainty" (2012)).

of the LAR, "Disposition of Key Assumptions/Sources of Uncertainty," contains nine assumptions/uncertainties from five PRA models, whereas industry guidance documents such as NUREG

-1855, Revision 1, and EPRI TR

-1026511 address a large number of potential assumptions and uncertainties. For example, one fire modeling assumption/uncertainty (page 56) in the LAR is provided as a source of uncertainty, compared to the 2012 EPRI document, which identifies 71 potential sources of uncertainty. There appear to be no uncertainties or assumptions associated with LERF and internal flooding, and one source that relates to both high winds and external flooding.

The LAR continues, "[t]he list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application."

The NRC staff notes that Stage F of NUREG-1855 (Revision 1) provides guidance on how to identify key sources of uncertainty relevant to the application.

Provide the following:

a. A summary of the process used to determine the nine sources of uncertainties and assumptions presented in Attachment 6 of the LAR. Include in this discussion an explanation of how the process is in accordance with NUREG

-1855, Revision 1, or other NRC-accepted method. Also, include in the discussion a detailed description of how the final set of nine uncertainties and assumptions were developed from the initial comprehensive list of PRA model(s) uncertainties and assumptions.

Duke Energy Response to PRA RAI 4.a.:

Step E-1 (section 7.2) of NUREG 1855, Revision 1 provides guidance for identifying and characterizing those sources of model uncertainty and related assumptions in the PRA required for the application.

Substep E-1.1 of the NUREG recommends using the detailed guidance and a generic list of sources of model uncertainty and related assumptions in EPRI 1016737 for the internal event hazard group (including LERF), and using the examples of sources of model uncertainty for the U.S. Nuclear Regulatory Commission Page 14 of 108 Serial RA-18-0178 Enclosure internal fires, seismic, Low Power Shutdown and Level 2 hazard groups in EPRI 1026511. For BNP, this process was performed by reviewing PRA documentation for generic issues identified in Table A.1 of EPRI 1016737, as well as identifying plant

-specific assumptions and uncertainties, and is therefore consistent with step E

-1.1 of the NUREG. EPRI 1026511 was not explicitly used to identify generic uncertainties in models other than the internal events model. However, of the models addressed by EPRI 1026511, only the BNP fire PRA is being used to support the current application. See the response to RAI 17 for treatment of uncertainties/assumptions related to the external flood and high winds PRA models.

Substep E-1.2 of NUREG 1855, Revision 1 involves identifying those sources of model uncertainty and related assumptions in the base PRA that are relevant to an application. Those that are irrelevant can be screened from further discussion.

However, since this application uses the internal events, internal flood, and fire PRA models for both CDF and LERF, all model uncertainties and related assumptions identified for these models are considered relevant. The original process screened some based on other factors, which is not consistent with the latest version of the NUREG.

Substep E-1.3 of NUREG 1855, Revision 1 involves characterizing the identified sources of model uncertainty and related assumptions. This characterization involves understanding how the identified sources of model uncertainty and related assumptions can affect the PRA. For the BNP uncertainty analysis, this was performed for all identified uncertainties/assumptions.

Substep E-1.4 is a qualitative screening process that involves identifying and validating whether consensus models have been used in the PRA to evaluate identified model uncertainties. As stated in NUREG 1855, Rev. 1, the use of a consensus model eliminates the need to explore an alternative hypothesis. For the BNP uncertainty analysis, some uncertainties/assumptions were screened based on their use of a consensus method, however, others were screened based on additional criteria, which again is not entirely consistent with the NUREG.

Once all relevant uncertainties/assumptions are identified in Step E

-1, Step E-2 (section 7.

3) of NUREG 1855, Rev. 1 provides guidance for identifying those sources of model uncertainty and related assumptions that are key to the application. The input to this step is the list of the relevant sources of model uncertainty identified in Step E

-1. These sources of model uncertainty and related assumptions are then quantitatively assessed to identify those with the potential to impact the results of the PRA such that the application's acceptance guidelines are challenged. This assessment is made by performing sensitivity analyses to determine the importance of the source of model uncertainty or related assumption to the acceptance criteria or guidelines. In the BNP uncertainty analysis, this step was performed qualitatively to arrive at the list of uncertainties, not quantitatively, and therefore is not entirely consistent with the NUREG.

For those uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria), Stage F (section 8) of NUREG 1855, Rev. 1, provides guidance on justifying the strategy used to address the key uncertainties that contribute to risk metric calculations that challenge application

-specific acceptance guidelines. This portion of the NUREG was not addressed in the original BNP uncertainty analysis.

U.S. Nuclear Regulatory Commission Page 15 of 108 Serial RA-18-0178 Enclosure

b. If the process of identifying key sources of uncertainty or assumptions for these PRA models was not done in accordance with NUREG

-1855, provide the results of an updated assessment of key sources of uncertainty or assumptions.

Duke Energy Response to PRA RAI 4.b.:

The process for identifying sources of uncertainty and assumptions is described, and compared to the process outlined in NUREG

-1855 rev. 1, in the response to item a. This comparison shows that the initial BNP identification of sources of model uncertainties and related assumptions was consistent with Substep E

-1.1 of the NUREG, with the exception that generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were not explicitly reviewed. However, the process to assess the identified uncertainties/assumptions was not entirely consistent with all portions the latest revision of the NUREG. As such, an updated assessment was performed, as described below.

Since the ultimate goal in assessing model uncertainty is to determine whether (and the degree to which) the risk metric results challenge or exceed the quantitative acceptance guidelines for the application, due to sources of model uncertainty and related assumptions, the first step in the updated evaluation was to identify the risk metrics used as acceptance guidelines for the 10 CFR 50.69 categorization process. For 10 CFR 50.69 categorization, the acceptance guidelines are actually threshold values for Fussell

-Vesely (F-V) and Risk Achievement Worth (RAW) for each SSC being categorized, above which the SSC is categorized as high safety significant (HSS), and below which the SSC is categorized as low safety significant (LSS). As described in Step E

-2 of the NUREG, each relevant uncertainty/assumption requires some sort of sensitivity analysis, and each sensitivity performed to evaluate an uncertainty/assumption involves some change to the PRA results. Since any change to the PRA results has the potential to change the F

-V and RAW importance measures for all components (SSC), every relevant uncertainty/assumption has the potential to challenge the acceptance guidelines. That is, since RAW and F

-V are relative importance measures, any change to any part of the model will generate a new set of cutsets and potentially impact the RAW and F

-V for every SSC. Thus, the only way to evaluate the impact of a sensitivity is to quantify the sensitivity case and compare the F

-V and RAW values for all SSCs against the base case F

-V and RAW values to determine if any exceed the HSS threshold in the sensitivity case that did not previously do so.

However, as stated in Stage F of NUR EG-1855 rev. 1 (section 8.1), an appropriate method for dealing with uncertainties and related assumptions that challenge or exceed the acceptance guidelines is to use compensatory measures or performance monitoring requirements. Section 8.5 of the NUREG states that performance monitoring can be used to demonstrate that, "following a change to the design of the plant or operational practices, there has been no degradation in specified aspects of plant performance that are expected to be affected by the change. This monitoring is an effective strategy when no predictive model has been developed for plant performance in response to a change". Since no predictive model of the increase in unreliability following alternative treatment of LSS SSCs exists, this option is appropriate for 10CFR 50.69. In fact, the example of a performance monitoring approach to address key uncertainties/assumptions given in section 8.5 is the factor of increase sensitivity combined with the performance monitoring process described for 10CFR 50.69 in NEI 00

-04. The NUREG states:

U.S. Nuclear Regulatory Commission Page 16 of 108 Serial RA-18-0178 Enclosure One example of such an instance is the impact of the relaxation of special treatment requirements (in accordance with 10 CFR 50.69) on equipment unreliability. No consensus approach to model this cause

-effect relationship has been developed. Therefore, the approach adopted in NEI 00

-04 as endorsed in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance," [NRC, 2006a] is to:

• Assume a multiplicative factor on the SSC unreliability that represents the effect of the relaxation of special treatment requirements.

• Demonstrate that this degradation in unreliability would have a small impact on risk.

Following acceptance of an application which calls for implementation of a performance monitoring program, such a program would have to be established to demonstrate that the assumed factor of degradation is not exceeded.

The use of the sensitivity study required by section 8.1 of NEI 00

-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. The impact of any key uncertainty or assumption sensitivity would be to potentially cause an SSC to be categorized as HSS when the base PRA analysis showed it to be LSS. The potential impact of categorizing an SSC as LSS rather than HSS is that the SSC could have alternative treatments applied to it and as such, the possibility exists that the reliability of SSC could be reduced (i.e., the specified aspect of plant performance that is expected to be affected by the change is the reliability of the SSC). Per section 8.1 of NEI 00

-04, a sensitivity is performed which assumes the unreliability of all LSS components is increased by a factor of 3 to 5. Since, as discussed in NEI 00

-04, no significant decrease in reliability is expected, this is very conservative. Additionally, since the failure probability of all LSS SSCs are increased at the same time in the sensitivity, this approach addresses all uncertainties/assumptions which could potentially impact the LSS/HSS categorization. The LSS sensitivity then must be shown to demonstrate that even assuming this factor increase, the quantitative guidelines of Reg. Guide 1.174 are not exceeded. Thus, the LSS sensitivity demonstrates that the potential impact of all uncertainties/assumptions is acceptable.

Additionally, a performance monitoring program must be established as part of the 10 CFR 50.69 process (per NEI 00-04 section 12) which will monitor the reliability of all LSS SSCs to ensure that the factor of increase assumed in the sensitivity is not exceeded. This ensures the validity of the sensitivity study following implementation.

It is noted that uncertainties/assumptions which are related to SSCs being excluded from the PRA model, either because they are not believed to be required for accident mitigation or because they perform a backup function to other equipment but were conservatively not credited in the model, may not be adequately addressed by the above sensitivity and performance monitoring program. If an SSC is not in the PRA model, but actually performs (or could perform) an accident mitigation function, and that SSC is categorized as LSS (based on non-PRA criteria) the factor increase sensitivity would not appropriately address the uncertainty associated with this assumption/uncertainty. This is because if there are no failure events in the PRA model for the SSC, the LSS sensitivity study has no events to which to apply the factor of increase. If, contrary to the assumption, the SSC is actually required for accident mitigation and had been included in the model, increasing its failure rate by the factor of increase could have an impact on the sensitivity results with respect to the RG 1.174 limits.

U.S. Nuclear Regulatory Commission Page 17 of 108 Serial RA-18-0178 Enclosure Based on the above discussion, an updated assessment of sources of uncertainty and assumptions was performed. All uncertainties and assumptions identified in the original BNP process consistent with Substep E

-1.1 of NUREG

-1855 rev. 1 (i.e., all identified internal events, internal flood, fire, high wind and external flood uncertainties/assumptions), and the generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were reviewed to identify any that are not adequately addressed by the factor increase sensitivity study required by Section 8.1 of NEI 00

-04 and the performance monitoring program required by Section 12 of NEI 00-04. The table below provides details of these uncertainties and their disposition for the 10 CFR 50.69 categorization process. Due to the large number of uncertainties/assumptions that are adequately addressed by the factor increase sensitivity study and performance monitoring program, these are not liste

d.

U.S. Nuclear Regulatory Commission Page 18 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 1 The potential for the test return line to the CST to be left open following testing of the HPCI systems and failure of MOVs E41

-F008 and E41-F011 to close upon actuation is considered of very low probability and is not modeled.

BNP-PSA-062, High Pressure Coolant Injection System Notebook, Section 5.1 In the BNP PRA, the probability of an MOV failing to close is 6.25E

-04/demand. Assuming a CCF factor of 0.1, the probability of both MOVs failing to close on a signal is 6.25E-05/demand. A conservative screening value of 8E

-03 was applied for pre-initiator errors with some level of follow

-up (e.g., an independent verification, post

-maintenance test, etc.). Thus, the likelihood of failure of the HPCI system due to flow diversion is approximately 5E

-07. This failure is equivalent to a failure of the HPCI pump. The probability of failure of the HPCI pump is approximately 4E-02. Thus, this failure mode of the HPCI pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 19 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 2 While the HPCI system is in standby, the drain valves E41-F028 and E41

-F029 are maintained open. Their air operators have been replaced with manual latch handles to preclude spurious operation. The drain valves are normally open to prevent condensate buildup in drain pot "A" while the HPCI system is in standby. If this drain line is isolated for a significant time prior to the HPCI actuation signal, a water slug could be sent to the turbine upon system actuation. The drain pot level is annunciated in the control room and the valves positions are checked once each shift in the control room. Therefore, for this drain line to create a problem for the startup of the HPCI system: 1) the normally open drain line would have to be manually isolated, 2) an operator would have to fail to respond to the annunciation of high drain pot level or have a failure of the level instrumentation, and 3) a shift would have to fail to check the drain line valve positions. Therefore, the effect of drain line isolation, or the loss of instrument air, on the initiation and operation of the HPCI system is insignificant and not modeled.

BNP-PSA-062, High Pressure Coolant Injection System Notebook, Section 5.7 Since these two AOVs have had their air operators removed, the spurious closure probability is that of a manual valve. The probability of a manual valve transferring closed is 8.42E

-08/hr. Since the position of these valves is checked every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, it is conservatively assumed that the exposure time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e., assume one shift fails to identify the mis

-aligned valve). The failure probability with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> exposure is then 2E

-06. Since filling of the drain pot is a slow process (likely to be weeks based on low steam leakage into the turbine), operators would have a significant amount of time to address the annunciator. Thus, the probability of them failing to do so prior putting water into the HPCI pump casing is very low. Even assuming a very conservative failure probability of 1.0E

-02 for the operator action, the overall probability of this failure mode is 2E-08. This failure is equivalent to a failure of the HPCI pump. The probability of failure of the HPCI pump is approximately 4E

-02. Thus, this failure mode of the HPCI pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 20 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 3 Flow diversion through the RWCU system discharge line is not considered. The failure of check valve G31

-F039 to close would be required for diversion to occur and would only be possible if the RWCU system is failed.

BNP-PSA-062, Reactor Core Isolation Cooling System Notebook, Section 5.1 In the BNP PRA, the probability of a check valve failing to close is 2.38E-04/demand. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, even ignoring the fact that a failure within the RWCU system would have to occur to cause a flow diversion, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 21 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 4 The potential for the test return line to the CST to be left open following testing of the RCIC systems and MOVs E41-F0228 and E41

-F011 failing to close upon actuation is considered of very low probability and is not modeled.

BNP-PSA-062, High Pressure Coolant Injection System Notebook, Section 5.1 In the BNP PRA, the probability of an MOV failing to close is 6.25E

-04/demand. Assuming a CCF factor of 0.1, the probability of both MOVs failing to close on a signal is 6.25E-05/demand. A conservative screening value of 8E

-03 was applied for pre

-initiator errors with some level of follow

-up (e.g., an independent verification, post

-maintenance test, etc.). Thus, the likelihood of failure of the RCIC system due to flow diversion is approximately 5E

-07. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 22 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 5 The effect of RCIC drain line isolation or the loss of instrument air, on the initiation and operation of the RCIC system is insignificant and not modeled. For the RCIC drain line to create a problem for the startup of the RCIC system: 1) the normally open drain line would have to be isolated,

2) an operator would have to fail to respond to the annunciation of high drain pot level or have a failure of the level instrumentation, and 3) a shift would have to fail to check the drain line valve positions.

BNP-PSA-062, Reactor Core Isolation Cooling System Notebook, Section 5.7 The probability of an AOV valve transferring closed is 1.31E

-07/hr. Since the position of these valves is checked every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, it is conservatively assumed that the exposure time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e., assume one shift fails to identify the mis-aligned valve).

The failure probability with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> exposure is then 3.1E

-06. Since failure of either of these two valves will isolate the drain line, this probability is doubled to 6.2E

-06. Since filling of the drain pot is a slow process (likely to be weeks based on low steam leakage into the turbine), operators would have a significant amount of time to address the annunciator. Thus, the probability of them failing to do so prior putting water into the RCIC pump casing is very low. Even assuming a very conservative failure probability of 1.0E-02 for the operator action, the overall probability of this failure mode is 6.2E

-08. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 23 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 6 The spurious group 5 isolation due to a spurious failure of the manual switch combined with a concurrent LL#2 signal is excluded from the model.

BNP-PSA-062, Reactor Core Isolation Cooling System Notebook, Section 5.1 The probability of a spurious failure of a manual switch (i.e., switch transferring position) is 2.30E

-06/hr. The failure probability with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> exposure time is then 5.5E

-05. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E

-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further. 7 A rupture of the recirculation suction line was considered but excluded from further modeling. This would require the additional failure to close upon RHR initiation of motor-operated valves B32-F031 or B32

-F032. BNP-PSA-062, Residual Heat Removal System Notebook, Section 5.7 Rupture of the recirculation suction line has a probability of approximately 4.7E

-06 (1 - X-RCRLOOPA)*

%1A. Failure of B32-F031 or B32

-F032 to close has a probability of 1.25E

-03. Therefore, this failure mode has a probability of 5.9E

-09. This failure is equivalent to a failure of one RHR pump. The probability of failure of an RHR pump is approximately 8.0E-04. Thus, this failure mode of an RHR pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 24 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 8 The use of high

-pressure FWH inlet valves FW

-V118 or FW-V119 or bypass valve FW-V120 is not credited in the CDS/FWS fault tree model for makeup flow control. If CDS/FWS makeup flow control is lost using the SULCV, flow control could be achieved using the high

-pressure FWH inlet valves or the bypass valve. However, these valves are very large, making flow control gross and more difficult.

BNP-PSA-062, Condensate and Feedwater Systems Notebook, Section 5.1 Although the PRA model will not generate importance measures for these valves, if the system containing the valves is categorized, appropriate surrogate PRA events will be used to generate importance measures for these valves, or the valves will be added to the model. Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

9 The use of the CDS pumps and CDS booster pumps following the recovery of offsite power requires all pumps to be restarted and this recovery action is not included in the CDS/FWS fault tree model. The recovery action is considered during the assessment of sequence

-specific recovery actions (OPER-MANCOND-60 & OPER-MANCOND-120 are included in the human reliability analysis).

BNP-PSA-062, Condensate and Feedwater Systems Notebook, Section 5.1 Although the PRA model will not generate importance measures for the CDS pumps and CDS booster pumps, if the condensate system is categorized, appropriate surrogate PRA events will be used to generate importance measures for these components (since they are implicitly modeled), or the system will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 25 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 10 There are potential divergence paths through the primary SLC line to the SLC tank, which is isolated by two manual valves, and the test line to the tank, which is also isolated by two manual valves. These paths are not modeled as potential SLC divergence paths. BNP-PSA-062, Standby Liquid Control System Notebook, Section 5.1 The probability of a manual valve transferring position is 8.42E-08 per hour. Conservatively assuming both valves could transfer open any time during the year without being detected, the probability of both valves transferring open is 5.4E

-07. Since common cause failures are typically only applied to active failure modes, no common cause is included. This failure is equivalent to a failure of both SLC pumps.

The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E

-05 . Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 26 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 1 1 The line from the SLC pump discharge drain line is double isolated by two manual valves. This line is not modeled as a divergence path.

BNP-PSA-062, Standby Liquid Control System Notebook, Section 5.1 The probability of a manual valve transferring position is 8.42E

-08 per hour. Conservatively assuming both valves could transfer open any time during the year without being detected, the probability of both valves transferring open is 5.4E

-07. Since common cause failures are typically only applied to activ e failure modes, no common cause is included. This failure is equivalent to a failure of both SLC pumps. The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E

-05 . Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded.

This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further. 12 The SLC pump suction drain line which is normally isolated by manual valve C41-F015 is not modeled as a divergence path.

BNP-PSA-062, Standby Liquid Control System Notebook, Section 5.1 Although the PRA model will not generate importance measures for valve C41-F015, if the SLC system is categorized, an appropriate surrogate PRA event will be used to generate importance measures for this valve, or the valve will be added to the model.

Any impact of the simplified modeling on acceptance criteria fo r categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 27 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 13 Potential divergence paths through the check valve test line connection downstream of check valve C41

-F006 is isolated by two manua l

valves and capped. The line downstream of the explosive valves is isolated by valve C41

-V5001 and capped. These paths are not modeled as potential divergence paths.

BNP-PSA-062, Standby Liquid Control System Notebook, Section 5.1 The probability of a manual valve transferring position is 8.42E

-08 per hour. Conservatively assuming both valves could transfer open any time during the year without being detected, the probability of both valves transferring open is 5.4E

-07. Since common cause failures are typically only applied to active failure modes, no common cause is included. A very conservative value of 0.1 is then assumed for failure of the threaded cap. Thus, the probability of this failure mode is 5.4E-08. This failure is conservatively assumed to be equivalent to a failure of both SLC pumps. The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E

-05. Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 28 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 14 Actuation of SRVs B, E, and G from the remote panel i s not modeled. This is a remote local action and will be assessed, if necessary, during the recovery assessment in the context of the accident sequence.

BNP-PSA-062, Safety Relief Valve System Notebook, Section 5.1 Although the PRA model will not generate importance measures for these valves, if the SRV system is categorized, appropriate surrogate PRA events will be used to generate importance measures for these valves, or the valves will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 29 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 15 The MSIV AC

-powered solenoids are normally supplied power from 120V AC RPS bus 1(2)A or 1(2)B, through RPS MMG 1(2)A or 1(2)B, respectively. The RPS MMGs receive power from 480V AC MCC 1(2)CA or 1(2)CB. An alternate power source is available to supply power to the 120V AC RPS buses. Power can be manually aligned to the 480V AC power distribution panels 1E5(2E7) or 1E6(2E8). However, only one RPS bus can receive power from this source at any one time. The current MSIV model does not consider this alternate power supply. This alternate power source may be considered as a possible recovery action during the accident sequence review process. BNP-PSA-062, Main Steam System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the alternate power supply components, if the system containing these component is categorized, appropriate surrogate PRA events will be used to generate importance measures for these components, or the components will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 30 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 16 Consideration was made to model turbine building flooding level switches which trip the CW pumps. The logic requires two separate level switches to fail to cause the CW pumps to trip; these switches are not modeled.

BNP-PSA-062, Circulating Water System Notebook, Section 5.1 Since the level switches are credited for preventing significant turbine building floods, and no importance measures will be generated by the PRA, if the system containing these switches (circulating water system) is categorized, the switches will be categorized as high safety significant (HSS), or the components will be added to the model. Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

17 There are four pairs of solenoid valves in the Alternate Rod Insertion (ARI) system. Any single pair will depressurize the scram header and insert control rods; the model reflects this. To simplify the model, only one pair of solenoid valves is considered, effectively meaning any single valve failure will result in common cause failure of the remaining valves.

BNP-PSA-062, RPT/ARI System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the valves that are not modeled, if the ARI system is categorized, appropriate surrogate PRA events will be used to generate importance measures for the other valves since they are implicitly modeled (i.e., they support the function), or the valves will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 31 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 18 Each TCS valve is modeled as a hydraulic valve and the sub-components of the valve are not explicitly modeled, but are considered integral to the valve. BNP-PSA-062, Turbine Control System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the subcomponents, if the TCS system is categorized, an appropriate surrogate PRA event will be used for the subcomponents since they are implicitly modeled (i.e., they support the function of the valve). 1 9 Plugging of pressure reducers located after the turbine bypass valves is not modeled. BNP-PSA-062, Turbine Control System Notebook, Section 5.1 Although no calculation has been performed, the likelihood of plugging of the pressure reducers, which are essentially pipe expanders in a 10" steam pipe to an 18" pipe, during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is considered to be at least two orders of magnitude below the failure rate of the turbine bypass valves opening (1.2E

-03). Therefore, this failure mode has been excluded. This is a consensus method per supporting requirement SY

-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 32 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 20 A group 1 containment isolation signal can be generated from a number of different signals; only the reactor vessel low water level signal (LL#3) is modeled. Not modeling other signals are considered insignificant. This simplification is conservative since other signals could also provide an isolation signal, however the LL#3 signal is chosen since it should be actuated for every accident sequence that progresses to core damage. BNP-PSA-062, Instrumentation and Control Circuitry System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the components which generate other signals, if the system is categorized, appropriate surrogate PRA events will be used for the other components since they are implicitly modeled (i.e., they support the function).

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

21 The undervoltage relays in the ECCS are considered as a single relay for each individual emergency bus and are assumed to be totally codependent for a specific emergency bus.

BNP-PSA-062, Instrumentation and Control Circuitry System Notebook, Section 5.1 Although the PRA model will not generate importance measures for all of the sub

-relays which generate undervoltage signals, if the system is categorized, appropriate surrogate PRA events will be used for the sub

-relays since they are implicitly modeled (i.e., they support the function).

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 33 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 22 The electric motor

-driven fuel oil pump which is a standby pump that is started if the engine

-driven pump fails is not included in the model. Data collection rules associated with the diesel generator boundary supports the inclusion of the engine-driven pump into the EDG failure.

BNP-PSA-062, Emergency Diesel Generator System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the electric pump, if the system is categorized, an appropriate surrogate PRA event will be used for the pump.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

23 The electric motor

-driven lube oil pump which is only needed to raise lube oil pressure if the engine

-driven pump fails to run is not included in the model.

Since the engine

-driven pump is included in the EDG failure rate, a failure is considered a failure of the EDG as modeled.

BNP-PSA-062, Emergency Diesel Generator System Notebook, Section 5.7 Although the PRA model will not generate importance measures for the electric pump, if the system is categorized, an appropriate surrogate PRA event will be used for the pump.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

24 The electric motor-driven auxiliary jacket water pump which is a standby pump initiated upon failure of the engine-driven pump is not included in the model.

Since the engine

-driven pump is included in the EDG failure rate, a failure is considered a failure of the EDG as modeled.

BNP-PSA-062, Emergency Diesel Generator System Notebook, Section 5.7 Although the PRA model will not generate importance measures for the electric pump, if the system is categorized, an appropriate surrogate PRA event will be used for the pump.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 34 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 25 Failure of battery charger bleeder resistor to disconnect during loss of AC is included in the estimation of the switchboard failure rate. AC bleeder resistor disconnect prevents battery discharge.

BNP-PSA-062, DC Power System Notebook, Section 5.1 Although the PRA model will not generate importance measures for the bleeder resistor, if the system is categorized, an appropriate surrogate PRA event (e.g., the switchboard) will be used for the resistor since it is implicitly modeled (i.e., it supports the function).

26 Use of distribution panel 1A(B) as an alternative power source to the 125V DC distribution panel 2A(B) or the reverse is not modeled. This reduces the complexity of the circular logic by avoiding logic loops between panels and AC power supplies beyond those defined due to the normal alignment.

BNP-PSA-062 , DC Power System Notebook, Section 5.7 Although the PRA model will not generate importance measures for the alternate power supply components, if the system containing these component is categorized, appropriate surrogate PRA events will be used to generate importance measures for these components, or the components will be added to the model. Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 35 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 27 The Brunswick model makes the assumption that the Emergency Busses E1 through E8 located in the Diesel Generator Building Switchgear rooms do not depend on the building's HVAC system to perform its primary function during a 24

-hour mission time. Generic analysis concludes that the switchgear rooms in a diesel generator building will not experience high temperature related failures during a 24

-hour mission time based on the HVAC analyses in NUREG/CR-4550, Volume 4, Sections 4.3 and 4.6. BNP-PSA-062, Heating, Ventilation, and Air Conditioning System Notebook, Section 5.1 This analysis has been updated and confirms no HVAC is required.

See response to PRA RAI 5.a.

U.S. Nuclear Regulatory Commission Page 36 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 28 Divergence of air pressure through the idled RNA header is assumed to be probabilistically negligible.

Divergence would require the failure to close of two or more check valves in series and would require an additional leak path.

BNP-PSA-062, Instrument Air and Nitrogen Systems Notebook, Section 5.1 The probability of a check valve failing to close is 2.38E

-04/demand. Assuming a CCF factor of 0.1, the probability of two check valves failing to close is 2.38E

-05/demand. Assuming a conservative value of 1.0E-02 for a leak in the RNA system large enough to fail the system (over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time), the likelihood of flow diversion is approximately 2.4E

-07. This failure is conservatively assumed to be equivalent to common cause failure of two air compressors. The common cause probability of failure of two is approximately 4E-05. Thus, this failure mode of the IA system is more than 2 orders of magnitude lower than the failure probability of the compressors, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA

-Sa-2009, such that this uncertainty does not need to be addressed further. 29 The opening of air compressor cooling inlet valves SV-5008 and SV

-4384 is considered an integral part of the compressor start logic and is not separately modeled in TBCCW. These valves are controlled by the compressor start logic and the valves open on compressor start.

BNP-PSA-062, Turbine Building Closed Cooling Water System Notebook, Section 5.7 Although the PRA model will not generate importance measures for these valves, if the system is categorized, an appropriate surrogate PRA event (e.g., the compressor) will be used for the valves since they are implicitly modeled (i.e., they support the function).

U.S. Nuclear Regulatory Commission Page 37 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 30 Penetrations with two unique isolation valves (i.e., check valve and fail closed air operated valve) may be eliminated probabilistically. Since no common mode failure applies to these valves, the probability of failure to isolate these penetrations will be several orders of magnitude below the probability of penetrations where common mode failures apply to the isolation valves.

BNP-PSA-049, PSA Model Sections 7

-9 Level 2 Analysis, , Section C.2.5 The probability of a check valve failing to close on demand is 2.38E

-04, while the probability of an air operated valve failing to close is 9.51E-04, such that the independent failure of both valves is 2.3E-07. Since failure of a penetration has no impact on CDF, including these valve failures would have no impact on the CDF RAW and F-V values. Conservatively assuming BNP has an overall CDF of 1.0E-04, and that failure of the penetration is applicable to all of that CDF, the RAW value for the check valve would be 9.5E

-08, while the RAW value of the AOV would 2.4E

-08. The F

-V values would obviously be negligible.

Thus, this assumption has no impact on 10CFR 50.69 categorization 31 Containment isolation Signal failure probability not modeled in detail. The 1 E

-5/demand estimate is based on judgment and considers the multiple signal failures that must occur.

BNP-PSA-049, PSA Model Sections 7

-9 Level 2 Analysis, , Notes to Table C.2.7.-2 Although the PRA model will not generate importance measures for the containment isolation signal components, if the system containing these components is categorized, appropriate surrogate PRA events will be used to generate importance measures for these components since they are implicitly modeled (i.e., they support the function), or the components will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 38 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring No. Description of Assumption or Source of Uncertainty Source Assessment 32 If the H 2/0 2 analyzer annunciators fail to alarm, the operators must check local indication in the control room to recognize the conditions for venting and this action is not quantified in the fault tree model. The operator action for failing to observe indication is considered subsumed by the overall operator action for combustible gas venting BNP-PSA-049, PSA Model Sections 7

-9 Level 2 Analysis, , Section C.5.5 Although the PRA model will not generate importance measures for the H 2/0 2 analyzer annunciator components, if the system containing these components is categorized, appropriate surrogate PRA events will be used to generate importance measures for these components since they are implicitly modeled (i.e., they support the operator action), or the components will be added to the model.

c. A description of the specific assumptions and sources of uncertainty key to this application for the entries in LAR Attachment 6 in enough detail that their impact on the application can be clearly understood and that a specific sensitivity could be defined to examine the risk significance of the issue. Include in this description for any new sources of uncertainty or assumptions identified in Part b.

Duke Energy Response to PRA RAI 4.c.:

The updated assessment of key sources of uncertainty and assumptions performed in response to RAI 4.b. supersedes the contents of Attachment 6 to the original LAR. PRA RAI 5 - Key Assumptions and Uncertainties that could Impact the Application:

The licensee's dispositions for key assumptions and modeling uncertainties are presented in Attachment 6 of the LAR. Attachment 6 (page 56) of the LAR states that the GOTHIC analysis for switchgear HVAC requirements is not a bounding case and shows only one of eight HVAC fans needed for room cooling. However, in the disposition for this assumption/uncertainty, the licensee states that screening of HVAC for switchgear rooms needs to consider the level of detail in the GOTHIC analysis. The NRC staff is unclear if HVAC support has been screened from the model or the success criterion modeled is one of eight fans. Provide the following:

a. A clarification of the actual modeling of HVAC support of the switchgear rooms and specify the assumption/uncertainty related to this modeling choice.

Duke Energy Response to PRA RAI 5.a.:

A GOTHIC model of the Diesel Generator Building (DGB) switchgear rooms and the building's HVAC system has been produced and analyzed.

This is in addition to the other GOTHIC U.S. Nuclear Regulatory Commission Page 39 of 108 Serial RA-18-0178 Enclosure analyses that have been used to understand the environmental conditions in the Diesel Generator Rooms and DGB Basement.

The results demonstrate that switchgears E1 through E8 have the capability to operate throughout their modeled mission time without relying on the Diesel Generator Building HVAC system to function as designed. The Brunswick PRA model applies this independence between the switchgears and the DGB HVAC system. The system notebook documents this relationship and references the GOTHIC analysis as justification to support the modeling. Therefore, there is no longer an uncertainty in the analysis and modeling of the switchgears E1 through E8, nor are any sensitivity studies or actions required. In conclusion, this validated assumption does not impact the results of the 10 CFR 50.69 categorization process.

b. Justification that the specific assumption/uncertainty does not impact the results of the 1 0 CFR 50.69 categorization process.

Duke Energy Response to PRA RAI 5.b.:

The assumption that switchgears E1 through E8 do not depend on the DGB HVAC system is validated and documented by a GOTHIC analysis as discussed in response to RAI

-5.a. This independence is currently built in Brunswick's PRA model and therefore will have no impact to the results of the 10 CFR 50.69 categorization process.

c. Alternatively, ensure that the assumption/uncertainty resolution is incorporated into the PRA prior to implementation of the 10 CFR 50.69 risk categorization process.

Duke Energy Response to PRA RAI 5.c.:

The assumption that switchgears E1 through E8 do not depend on the DGB HVAC system is validated and documented by a GOTHIC analysis as discussed in response t o RAI-5.a. This independence is currently incorporated in Brunswick's PRA model and therefore no further action is needed.

PRA RAI 6 - Feedback and Adjustment Process: Section 11.2, "Following Initial Implementation," of NEI 00

-04 discusses that "a periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes." Specifically, NEI 00

-04, Section 12.1 discusses cases for which, in some instances, an updated PRA model could result in new risk achievement worth (RAW) and Fussell Vesley (FV) importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization. Provide the following:

a. Explain how this periodic review will be administered. At minimum, discuss the following:

1. Participants involved in the review;

2. Sources of material identified to be reviewed;

3. Periodicity for when the review will be performed;

U.S. Nuclear Regulatory Commission Page 40 of 108 Serial RA-18-0178 Enclosure

4. Documentation of the review performed (e.g., corrective action program, engineering evaluation, etc.); and

Duke Energy Response to PRA RAI 6.a.: Consistent with NEI 00

-04 Section 12, the periodic review will be performed by a system/strategic engineer, or equivalent, and a PRA engineer.

To assess the impact of plant changes on categorized SSCs, the following items are reviewed to ensure the continued validity of categorization:

Plant modifications since the last review that could impact the SSC categorization Plant specific operating experience that could impact the SSC categorization The impact of the updated risk information (that is, PRA model or other analysis used in the categorization) on the categorization process results Importance measures used for screening in the categorization process. If a review of the importance measures indicates that the SSC should be reclassified, then both the relative and absolute values of the risk metrics will be considered by the IDP.

An update of the risk sensitivity studies performed for the categorization Applicable industry operational experience for impact on existing categorizations Input from Regulatory Affairs and Operations regarding changes that may affect the bases for the categorization results.

The periodic review is completed at least once every other fuel cycle. The Periodic Review Process will be completed in accordance with Duke Energy procedures.

The periodic review is documented and will be presented to the Integrated Decision Making Panel (IDP) to make the final decision regarding any necessary recategorizations.

b. Provide the criteria to be used to determine if the change being reviewed has any impact to a modeled PRA hazard(s) and/or any SSC categorized by the 50.69 process.

Duke Energy Response to PRA RAI 6.b.: NEI 00-04, section 12.1, provides the criteria for updating the categorization of SSCs based on updated PRA models. It notes that in some instances, an updated PRA model could result in new RAW and F

-V importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization. That is, the new RAW

and F-V values may have changed enough that they are now above the LSS/HSS threshold when they had previously been below (or vice versa). In these cases, the assessment of whether a change in categorization is appropriate should be based on the absolute value of the importance measures. This is done in order to not inadvertently assess an SSC as HSS when its relative importance (FV and/or RAW) has gone up, but only due to a decrease in overall CDF and/or LERF.

Table 12-1 of NEI 00

-04 lays out the cases where the SSC categorization should be updated based on both the relative and absolute importance measures.

It should be noted that the table only allows downgrading an SSC from HSS to LSS if the relative importance U.S. Nuclear Regulatory Commission Page 41 of 108 Serial RA-18-0178 Enclosure measures for the HSS SSC from the updated model indicate LSS, and the absolute importance measures from the from the updated model are lower than before.

PRA RAI 7 - SSCs Categorization Based on Other External Hazards:

Section 3.2.4 of the LAR states:

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized that participate in screened scenarios and whose failure would result in an unscreened scenario. Consistent with the flow chart in Figure 5

-6 in Section 5.4 of NEI 00

-04, these components would be considered HSS.

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

The last sentence implies that the assessment has been completed and concludes that all other external hazards will never need evaluation during categorization. The individual plant examination of external events (IPEEE) screening process did not include the additional step illustrated in Figure 5

-6 in Section 5.4 of NEI 00

-04. Figure 5

-6 and its associated text states that an evaluation is performed to determine if there are components being categorized that participate in screened external event scenarios whose failure would result in an unscreened scenario.

Please clarify how the screening criteria in LAR Attachment 5, "Progressive Screening Approach for Addressing External Hazards," satisfy the guidelines that HSS will be assigned to SSCs whose failure would cause a screened external event scenario to become unscreened.

Duke Energy Response to PRA RAI 7: The screening criteria in Attachment 5 of the LAR were used to determine those external hazards listed in Attachment 4 of the LAR requiring a PRA model for this application and those screened from needing a PRA model. The LAR Attachment 5 denotes the screening criteria that determines "screened scenarios" versus "un-screened scenarios".

Per NEI 00

-04 the external hazard assessment is required for each SSC categorization. As such, each SSC being categorized will be assessed in accordance with NEI 00

-04 Figure 5

-6 for the external hazards listed in Attachment 4 of the LAR. If the failure of the SSC results in the screening criterion from Attachment 5 not being met, then the scenario would become unscreened and the SSC would become candidate High Safety Significant. NEI 00

-04 Figure 5

-6 is shown below for reference.

U.S. Nuclear Regulatory Commission Page 43 of 108 Serial RA-18-0178 Enclosure Guidance for Risk

-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269), provides the NRC's staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk

-informed decision making in accordance with the guidance of RG 1.200.

Provide the following information in the context of both the internal and external hazard PRA models credited in the licensee's 10 CFR 50.69 application:

a. A discussion detailing the extent of incorporation, i.e., summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application.

Duke Energy Response to PRA RAI 8.a.: Internal Events:

FLEX Diesel Generators The FLEX diesel generators (FLEX

-DGs) are utilized to supply power to 480 VAC emergency busses if other sources of station AC power are unavailable. In turn, the station 480 VAC emergency busses can supply power to the battery chargers to maintain the availability of instrumentation and control power.

The station has two FLEX

-DGs. Aligning the FLEX

-DGs requires manual, local action. The FLEX-DGs are permanently installed and their use does not require removing equipment from the FLEX Dome.

Prior to the installation of the FLEX

-DGs, the SAMA diesels were modeled as supplying power to the battery chargers. The FLEX

-DGs have replaced the SAMA diesels in performing that function. The modeling associated with the SAMA diesels had been peer reviewed. The FLEX

-DGs have been modeled using the same methods as were used previously for the SAMA diesels. FLEX Portable Pumps The FLEX portable pumps and their associated flow paths provide an injection path from the condensate storage tank to the reactor pressure vessel for core cooling.

There are two diesel

-driven FLEX portable pumps, which are normally in storage in the FLEX Dome. All associated FLEX connection points are closed and secured. There is also a diesel

-driven B.5.b pump capable of matching the performance of a FLEX portable pumps. (Both the two FLEX portable pumps and the B.5.b pump are modeled.)

FLEX Air Compressors

The FLEX engine

-driven air compressors provide pressurized air to supply the Backup Nitrogen bottles after they have depleted. They allow for operation of the safety relief valves and the hardened containment vent late in a sequence.

U.S. Nuclear Regulatory Commission Page 44 of 108 Serial RA-18-0178 Enclosure There is one FLEX air compressor per reactor unit. There is also an "n+1" compressor, to be used for either unit in the event of compressor failure. The normal configuration of the FLEX air compressors is storage in the FLEX Dome. All associated FLEX connection points are closed and secured. (Both the n+1 and the unitized FLEX air compressors are modeled.)

Documentation of the FLEX equipment has been added to the existing internal events documentation as needed, as is done with any other modeled equipment. Since the scope of addition is internal events, no consideration of debris removal due to damage from external hazards is necessary.

External hazards:

FLEX equipment is not currently credited in the external hazard models.

b. A discussion detailing the methodology used to assess the failure probabilities of any modeled equipment credited in the licensee's mitigating strategies (i.e., FLEX). The discussion should include a justification explaining the rational for parameter values, and whether the uncertainties associated with the parameter values are considered in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200.

Duke Energy Response to PRA RAI 8.b.:

Internal Events:

NUREG/CR-6928 generic parameter estimates for emergency diesel generators are used for the FLEX-DGs. The FLEX DG are simpler than the EDGs with less external dependencies, and are permanently installed like the EDGs. They are expected to be as reliable as the EDGs. NUREG/CR-6928 generic parameter estimates for standby engine

-driven pumps are also used for the FLEX pumps, and engine

-driven air compressors parameter estimates are used for the FLEX air compressors. Generic values are used currently since plant

-specific data is limited.

The parameter values include parameter uncertainty values. They are represented with beta or gamma distributions, with variance values calculated from the and parameters associated with the generic data.

External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

c. A discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include: 1. A summary of how the licensee evaluated the impact of the plant

-specific HEPs and associated scenario

-specific performance shaping factors listed in (a)

-(j) of supporting requirement HR

-G3 of the ASME/ANS RA

-Sa-2009 PRA standard.

2. Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable during an event, and U.S. Nuclear Regulatory Commission Page 45 of 108 Serial RA-18-0178 Enclosure if the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of the ASME/ANS RA

-Sa-2009 PRA standard.

3. If the licensee's procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical bases for probability of failure to initiate mitigating strategies.

Duke Energy Response to PRA RAI 8.c.:

Internal Events:

1. FLEX-related operator actions credited in the internal events model were evaluated per ASME/ANS RA

-Sa-2009 PRA standard supporting criterion HR

-G3. The EPRI HRA Calculator was used to quantify the events, explicitly addressing all performance shaping factors identified in HR

-G3.

2. Pre-initiator human failures that would render FLEX equipment unavailable during an event have been included in the model. The pre

-initiator human failure events were assigned screening values based on methods described in NUREG/CR

-4772. Since the events are not risk significant at the screening probability values, detailed assessments were not performed. This peer

-reviewed approach has been used with the other pre

-initiator events included in the model and meets the requirements described in HLR

-HR-D of the ASME/ANS RA

-Sa-2009 PRA standard.

3. The emergency operating procedures provide clear instructions for when to take action using FLEX equipment and which FLEX procedures are to be used to take the necessary action. External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

d. The ASME/ANS RA

-Sa-2009 Standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of AMSE/ANS RA

-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

1. Provide an evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences, OR 2. Propose a mechanism to ensure that a focused

-scope peer review is performed on the model changes associated with incorporating mitigating strategies, and associated F&Os U.S. Nuclear Regulatory Commission Page 46 of 108 Serial RA-18-0178 Enclosure are resolved to Capability Category II prior to implementation of the 10 CFR 50.69 categorization program.

Duke Energy Response to PRA RAI 8.d.:

Internal Events:

(1) Consideration of the Use of New Methodologies No new methodologies were used for incorporating FLEX equipment into the internal events model. As with the existing internal event operator actions, the same tool (EPRI HRA Calculator) and process was used to quantify the FLEX operator actions. Similarly, the existing data development process was used to quantify added FLEX random and common cause equipment failures, maintenance unavailabilities, and associated electrical or flow path failures. The BNP systems documentation was updated to include the added FLEX equipment.

(2) Consideration of Model Scope Change Impact on Significant Accident Sequences or Significant Accident Progression Sequences Sensitivity studies were performed to identify the significant CDF and LERF sequences given no credit for FLEX equipment. In comparison to the corresponding base case sequences, there were no unexpected changes. The contribution to CDF of the top SBO sequence (1.2% contribution to CDF, included in top 95% of sequences) was reduced (0.3% contribution to CDF, no longer included in top 95% of sequences). This moved the sequence from the risk significant category to the non

-risk significant category. However, this move from the very low end of the risk significant category to the non

-risk significant category is not judged as warranting a peer review given that a decrease in SBO sequences would be expected given the increased diversity provided by the FLEX

-DGs. For LERF, there are no risk significant SBO sequences in the case where FLEX is not credited, and there was no significant impact on the significant accident progression sequences.

The sensitivity discussed above is conservative in that it compared the significant sequence results to those given no credit for the FLEX equipment. As noted in the response to RAI 8.a, prior to the installation of the FLEX

-DGs, the SAMA diesels were modeled as supplying power to the battery chargers - a function now provided by the FLEX

-DGs. Since the same function is now being provided by FLEX

-DGs, no significant change to the SBO sequence contributions would be expected.

(3) Consideration of the Model Capability Change Impact on Significant Accident Sequences or Significant Accident Progression Sequences The impacts on significant sequences is discussed in (2) above.

External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

U.S. Nuclear Regulatory Commission Page 47 of 108 Serial RA-18-0178 Enclosure PRA RAI 9 - Proposed License Condition: The guidance in NEI 00

-04 allows licensees to implement different approaches, depending on the scope of their PRA (e.g., the approach if a seismic margins analyses is relied upon is different and more limiting than the approach if a seismic PRA is used). RG 1.201, Revision 1 states that "as part of the NRC's review and approval of a licensee's or applicant's application requesting to implement 50.69, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non

-PRA methods used in the licensee's categorization approach."

Section 2.3 of the LAR proposed the following License Condition:

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)

-1, RISC-2, RISC-3, and RISC

-4 SSCs specified in the license amendment request dated January 10, 2018. Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

The proposed license condition does not explicitly address the PRA and non

-PRA methods that were used. Provide a license condition that explicitly address the approaches, e.g.:

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC

-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, external flooding, and high winds; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO

-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non

-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA

-Sa-2009; as specified in Unit 1 and Unit 2 License Amendment No. [XXX] dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Note that if implementation items are identified, the license condition may need to be expanded to address them.

Duke Energy Response to PRA RAI 9:

Duke Energy proposes the following license condition, which is also reflected in the BSEP Operating License markup in Attachment 2 of this submittal.

U.S. Nuclear Regulatory Commission Page 48 of 108 Serial RA-18-0178 Enclosure Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)

-1, RISC-2, RISC-3, and RISC

-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO

-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 1

[Unit 2] License Amendment No. [XXX] dated [DATE]. Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 2, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA

-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

PRA RAI 10 - External Hazards Peer

-Review Process: Section 10 CFR 50.69(c)(1)(i) requires that the PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

According to Section 3.3 of the Enclosure to the LAR, the BSEP HW PRA and XF PRA models were subject to a full

-scope peer review in February 2012 against RG 1.200, Revision 2. Appendices B, C and D to RG 1.200, Revision 2, provide the NRC regulatory position on the peer review requirements in the peer review process in NEI 00

-02, "Probabilistic Risk Assessment Peer Review Process Guidance" Revision 1, May 2006 (ADAMS Accession No.

ML061510619), NEI 05

-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," Revision 2, November, 2008 (ADAMS Accession No. ML083430462) and NEI 07

-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," Revision 1, June 2010 (ADAMS Accession No. ML102230070). Section 2.2, "Industry Peer Review Program," in RG 1.200, Revision 2, states that when "the staff's regulatory positions contained in the appendices are taken into account, use of a peer review can be used to demonstrate that the PRA [with regard to an at

-power Level 1/LERF PRA for internal events (excluding external hazards)] is adequate to support a risk

-informed application." Therefore, RG 1.200, Revision 2, does not endorse any peer review guidance for external hazards. Section 2.2 of RG 1.200, Revision 2, further states that "[a]n acceptable peer review approach is one that is performed according to an established process..." and the peer reviewers' "technical expertise includes experience in performing (not just reviewing) the work in the element assigned for review."

U.S. Nuclear Regulatory Commission Page 49 of 108 Serial RA-18-0178 Enclosure NEI 12-13, "External Hazards PRA Peer Review Process Guidelines" (ADAMS Accession No. ML12240A027), provides guidance for conducting and documenting peer

-reviews of external hazard PRAs. The staff issued a letter accepting the use of NEI 12

-13, as modified by the staff's comments, in March 2018 (ADAMS Accession No. ML18025C025). Section 1.4 of NEI 12-13 states that the "on

-site External Hazards PRA Peer Review is a one

-week, tiered review" and that "[i]t is necessary to perform on

-site walkdowns during an External Hazards PRA Peer Review to confirm the relationships between SSCs and the potential effects of an external hazard." Section 2.2 of NEI 12

-13, referring to the peer review team composition and qualifications, states that "[t]he intent is to ensure that there is more than one peer reviewer with experience in each key External Hazards PRA process" and "experience should have involved explicit development of the PRA technical area being reviewed." The same section in NEI 12

-13 also states that the peer review team "should have at least two utility participants" with specialized experience in the hazards being reviewed. Section 3.2 of NEI 12

-13 describes the issues that should be identified by the review team as Unreviewed Analysis Methods (UAMs).

a. Provide details, including the source, for the peer review process and corresponding guidelines followed for the BSEP HW and XF PRA full

-scope peer

-reviews. Duke Energy Response to PRA RAI 10.a.:

Details are provided first on the key process issues identified during a conference call between NRC and Duke Energy on July 3, 2018, held in preparation for the Brunswick 50.69 External Flooding and High Winds PRA Audit. Next, an overview of how the external hazard peer review processes compare with NEI 12

-13 guidance is provided. Lastly, additional details on previous uses of this model and peer review are provided for consideration.

Overall, it is important to note the peer review process for the BSEP HW and XF PRAs was adapted from the internal events PRA peer review process outlined in NEI 05

-04 and used for other PRAs contemporary with the review. The peer review was:

- Completed by highly competent reviewers

- Thorough in scope to examine the adequacy of the PRA

- Meets the intent of NEI 12

-13, which was issued after the peer review was completed.

Process Issues Identified During NRC Call Duration of the Peer Review The size of the peer review team and duration of the review was determined by first considering the guidance in Section 1

-6.2.4 of the ASME PRA Standard as endorsed in RG 1.200 Rev 2 suggesting that a full-scope peer review be conducted by a team with a minimum of five members, and shall be performed over a minimum period of one week. The standard goes on to state that if the review is focused on a particular PRA Element, such as a review of an upgrade of a PRA Element, then the peer review should be conducted by a team with a minimum of two members, performed over a time necessary to address the specific PRA Element.

Additionally, NEI 05

-04 states that the number of members of the peer review team and their specific expertise and required level of qualification is a function of the number of PRA technical elements that are being reviewed. The NEI 05

-04 guidance also notes that the amount of time U.S. Nuclear Regulatory Commission Page 50 of 108 Serial RA-18-0178 Enclosure required, and the associated logistics, will depend on the scope of the review, the number of reviewers examining each technical element, and the availability of supporting documentation.

Since the Brunswick peer review addressed only two elements (high wind and external flood), the review was conducted by a team of three members with one day on

-site. The reviewers performed pre

-work ahead of the on

-site review portion to assess the various supporting requirements for their applicable technical areas. The peer reviewers completed a thorough review of the PRAs diving into the requirements for each supporting requirement to assess the completeness and quality of the PRAs. Appendix C of the Peer Review report provides detail about the documents reviewed and the basis for assessment of each SR, indicating the level of detail reviewed by the team. Based on the assessment for each of the supporting requirements, assessments for each high level requirement are also documented as part of the Peer Review report in Table 3

-2.

On-Site Walkdowns

NEI 12-13 states on

-site walkdowns are needed during an external hazard peer review to confirm the relationships between SSCs and the potential effects of an external hazard. The PRA standard Section 8

-3.3.4 and Section 7

-3.3.4 for the respective hazards, states the peer review team shall review the plant walkdown but does not require that the review team perform a walkdown themselves. Per Reg. Guide 1.200, Tables A

-7 and A-8, the NRC staff has no objection with the Standard peer review requirements in Section 7

-3 and Section 8

-3 as written. Additionally, NEI 05

-04 does not require plant walkdowns, even for internal flooding PRA peer reviews. The BNP XF and HW peer review team reviewed the walkdown data for the hazards. The assessment of HW SR WFR

-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. The assessment of XF SR XFFR

-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. Thus, the peer review team adequately assessed the relationship between SSCs and the potential effects of the hazard(s).

Team Composition - Specifically, Utility Participation & Qualifications

NEI 12-13 suggests the peer review team include two utility personnel knowledgeable in the hazard(s) being assessed. Per the guidance, the inclusion of utility personnel is to facilitate the exchange of ideas and techniques for effective use of External Hazards PRA methodologies.

The reviewers for the BSEP HW and XF PRA models have diverse experiences working on a number of PRAs across multiple utilities. Their experiences as well as their expertise in PRA provide the intent of multiple utility participants on the review team.

At the time of the peer review, and currently, there was/is a scarcity of utility personnel with the specialized experience in the hazards being reviewed. Instead the peer review team included one of the pioneering experts of external hazard analysis, who was/is a key member of the ASME standard writing committees, and whose work is referenced throughout the standard. He was the lead reviewer for the hazards and fragility analyses, while the lead reviewers for the plant response analyses were PRA experts with >20 yrs experience.

Although this exception was not documented, the composition of the review team did meet the intent "to ensure there is more than one peer reviewer with experience in each key External Hazards PRA process" as stated in NEI 12

-13.

U.S. Nuclear Regulatory Commission Page 51 of 108 Serial RA-18-0178 Enclosure As to the qualifications of the reviewers, there are three main areas of concern: plant response, hazard development, and fragility. The staff requested additional information on the reviewers' experience in performing these activities. The following describes the team members' experiences in performing hazard development, fragility, and plant response analysis prior to the peer review in question:

Dr. M.K. Ravindra - Lead Reviewer for Wind Hazard, Wind Fragility, Flood Hazard, and Flood Fragility Experiences applicable to Flood Hazard (Prior to 2012):

o Fragility:

Co-investigator in a project "Load and resistance Factor Design of Steel Buildings" o Hazard Development and Fragility:

Participated in the development of ASCE standard "Minimum Design Loads for Buildings and Other Structures", ASCE A7

-05 Principal Investigator "External Event Analysis of Vogtle Nuclear Power Plant,"

Consultant on "Other External Event IPEEE of Trillo and Asco Nuclear Power Plants" Peer Reviewer, "External Event Analysis of Calvert Cliffs Nuclear Power Plant" Project Manager, "External Event Analysis of Vandellos II, Spain" Task Leader, "External Event Analyses of Indian Point 2 as Part of IPEEE" Lead Reviewer on Wind, Tornado design and External Event PRA for COL of STP 3& 4 Consultant to "Development of IPEEE Procedures" Principal Investigator, "External Event Scoping studies for the New production Reactors" Member of ANS/NRC Technical Writing Group developing Procedures Guide on PRA of Nuclear Power Plants (author of chapters on Analysis of External Events and Seismic Risk Analysis)

Experiences applicable to Wind Hazard (Prior to 2012)::

o Hazard Development and Fragility:

Participated in the development of ASCE standard "Minimum Design Loads for Buildings and Other Structures", ASCE A7

-05 Principal Investigator "External Event Analysis of Vogtle Nuclear Power Plant,"

Consultant on "Other External Event IPEEE of Trillo and Asco Nuclear Power Plants" Peer Reviewer, "External Event Analysis of Calvert Cliffs Nuclear Power Plant" Project Manager, "External Event Analysis of Vandellos II, Spain" Task Leader, "External Event Analyses of Indian Point 2 as Part of IPEEE" Consultant to "Development of IPEEE Procedures" Project Manager, "Seismic and Wind Fragility and Risk Quantification of Advanced Test Reactor" U.S. Nuclear Regulatory Commission Page 52 of 108 Serial RA-18-0178 Enclosure Principal Investigator, "External Event Scoping studies for the New production Reactors" Project Manager, "Evaluation of Seismic and Tornado Design Criteria for Modular HTGR" Member of ANS/NRC Technical Writing Group developing Procedures Guide on PRA of Nuclear Power Plants (author of chapters on Analysis of External Events and Seismic Risk Analysis)

Published Work - "High Wind IPEEE of Indian Point Unit 2" Published Work - "State-of-the-Art and Current Research Activities in Extreme Winds Relating to Design and Evaluation of Nuclear Power Plants," in "The Tornado: Its Structure, Prediction, and Hazards," Geophysical Monograph, 79, American Geophysical Union Published Work - "Evaluation of Seismic and Wind Design Criteria for Modular HTGR" in Proceedings of Fifth International Conference on Applications of Statistics and Probability in Structures and Soils Engineering o Fragility:

Co-investigator in a project "Load and resistance Factor Design of Steel Buildings" Published Work - "Turbine Missile Risk Analysis", January 1984 in Proceedings ASCE Specialty Conference on Probabilistic Mechanics and Structural Reliability, Berkeley, California.

Published Work - "Probabilistic Limit Design of Concrete Structures", October 1976.

Published Work - "Wind and Snow Load Factors for Use in LRFD" Published Work - "Load Combinations for Natural and Man

-made Hazards in Nuclear Structural Design" presented at ANS Topical Meeting on Thermal Reactor Safety Diane Jones - Lead for External Flood Plant Response; Reviewer for Wind Fragility, Flood Hazard and Wind Plant Response High Wind and External Flood Hazard and Fragility Experience (prior to 2012):

o Developed the analysis of extreme winds/tornadoes for the mPower small modular reactor design. Included a hurricane, tornado, and straight

-line wind hazard analysis for a location on the Gulf Coast in the central US, as well as wind fragility, plant response, and quantification. A screening analysis for external flooding was also conducted.

o Updated the bounding analysis of external hazards for Plant Vogtle, including update of the tornado and missile hazard, and the extreme flood hazard.

o Developed the Kewaunee tornado missile (TORMIS) analysis.

o Developed external hazard analysis for NPP Borssele low power and shutdown PRA Plant Response Experience (Prior to 2012)::

o Development, update and quantification of plant response (event tree and fault tree) models for a combined 30 plants over more than 25 years Jeff Leary - Lead for Wind Plant Response; Reviewer for Wind Hazard Analysis, External Flood Fragility, and External Flood Plant Response. Experience prior to 2012:

U.S. Nuclear Regulatory Commission Page 53 of 108 Serial RA-18-0178 Enclosure Development, update and quantification of plant response (event tree and fault tree) models for a combined 30 plants over more than 25 years Developed fast

-solving top logic fault trees for several at

-power, shutdown and Level II (LERF) PRA/risk monitor models Developed or updated seven full Level 2 PRA models Integrated internal and external events models to utilize the same fault trees and databases for event tree and risk monitor models Updated internal flooding analysis and incorporated it into the PRA at two sites Unreviewed Analysis Method (UAM)

NEI 12-13 states that an issue identified by the review team can also be classified as an Unreviewed Analysis Method (UAM), which is further clarified in the staff's comments. The peer review noted that the hurricane and tornado hazard analyses used state

-of-the-art methodology and up-to-date databases of occurrences, as well as the accepted TORMIS and fragility methodologies. Thus, no UAMs were identified.

Overview Information The BSEP HW and XF PRA peer review was completed prior to the issuance of NEI 12

-13. The peer review process adapted the internal events PRA peer review process outlined in NEI 05-04 used for other PRAs contemporary with the review. NEI 05

-04 guidance states that the review team will focus on reviewing, for the technical elements to be reviewed, the host utility's self-assessment of the applicable elements against the corresponding scope in RG 1.200 Appendix B, and the degree to which the PRA meets the applicable requirements in the ASME/ANS PRA Standard SRs. Therefore, the key aspect of a peer review are the criteria against which the PRA is assessed. For the BSEP HW and XF PRA peer review, the criteria were obtained from the ASME/ANS PRA Standard RA

-Sa-2009. As noted in the peer review report, Standard RA

-Sa-2009 as clarified and endorsed by RG 1.200 Rev 2 presents an acceptable approach for assessing PRA technical quality. Specific elements of the process employed are described herein.

The review team members began prior to the onsite visit by reviewing the PRA material provided in advance by the utility (Progress Energy at the time), in accordance with NEI 12

-13 Section 2.1 Step 1.

Consistent with NEI 12

-13 Section 2.1 Step 2, based on the scope of the review, the peer review team was identified. The PRA Peer Review team was composed of contractor personnel knowledgeable in PRA issues and experienced in the performance and application of PRAs. The PRA Peer Review Team also included peers who are knowledgeable in PRAs for plants similar to the plant being reviewed. The size of the peer review team was determined by first considering the guidance in Section 1

-6.2.4 of the ASME PRA Standard suggesting that a full

-scope peer review be conducted by a team with a minimum of five members, and shall be performed over a minimum period of one week. The standard goes on to state that if the review is focused on a particular PRA element, such as a review of an upgrade of a PRA Element, then the peer review should be conducted by a team with a minimum of two members, performed over a time necessary to address the specific PRA element.

U.S. Nuclear Regulatory Commission Page 54 of 108 Serial RA-18-0178 Enclosure Additionally, NEI 05

-04 states that the number of members of the peer review team and their specific expertise and required level of qualification is a function of the number of PRA technical elements that are being reviewed. The NEI 05

-04 guidance also notes that the amount of time required, and the associated logistics, will depend on the scope of the review, the number of reviewers examining each technical element, and the availability of supporting documentation.

Since the Brunswick peer review addressed only two elements (high wind and external flood), the review was conducted by a team of three members over one day. The effort also included a review of material prior to the onsite visit and review and comment of the review report.

Consistent with the guidance in Section 1

-6.2.2 of the ASME PRA Standard, the review team members were:

(1) knowledgeable of the requirements in this Standard for their area of review

(2) experienced in performing the activities related to the PRA Elements for which the reviewer is assigned.

Per Sections 7

-3.2 and 8-3.2 of the standard (pertaining to high winds and external floods), the peer review team members shall have combined experience in the areas of systems engineering, evaluation of the hazard for the relevant external event, and evaluation of how the external event could damage the nuclear plant's structures, systems, or components, or a combination thereof (SSCs). All members of the Brunswick peer review team are experienced PRA personnel, each with a minimum of 20 years of experience in the field of PRA. The Technical Element Lead Reviewers in the Brunswick peer review were assigned to elements according to their level of knowledge and experience. The overall team expertise is sufficient to cover all of the PRA elements reviewed.

NEI 12-13 suggests the peer review team include two utility personnel knowledgeable in the hazard(s) being assessed. Per the guidance, the inclusion of utility personnel is to facilitate the exchange of ideas and techniques for effective use of External Hazards PRA methodologies. The reviewers for the BSEP HW and XF PRA models have diverse experiences working on a number of PRAs across multiple utilities. Their experiences as well as their expertise in PRA provide the intent of multiple utility participants on the review team.

Additionally, at the time of the peer review there was a scarcity of utility personnel with the specialized experience in the hazards being reviewed. Instead the peer review team included one of the pioneering experts of external hazard analysis, who was/is a key member of the ASME standard writing committees, and whose work is referenced throughout the standard. He was the lead reviewer for the hazards and fragility analyses, while the lead reviewers for the plant response analyses were PRA experts with >20 yrs experience .

Although this exception was not documented, the composition of the review team did meet the intent "to ensure there is more than one peer reviewer with experience in each key External Hazards PRA process" as stated in NEI 12

-13. Section 6 of the ASME PRA Standard also provides guidance regarding review team member independence with respect to the PRA under review. Per Section 1

-6.2.2 of the ASME PRA Standard, review team members shall have neither performed nor directly supervised any work U.S. Nuclear Regulatory Commission Page 55 of 108 Serial RA-18-0178 Enclosure on the portions of the PRA being reviewed. The Brunswick peer review team did not include any members who had worked on various portions of the Brunswick high wind or external flood PRAs.

Consistent with NEI 12

-13 Section 2.1 Step 3, the peer review team observed that the prerequisite activities were completed including a through and conscientious PRA development, recent PRA development and documentation, a self

-assessment of the HW and XF PRA against the ASME standard. Prior to the onsite review portion, the review team was selected and team member responsibilities and the schedule were defined by the Review Team Lead. The review team was provided the materials for review in advance of the on

-site review period.

NEI 12-13 Steps 4 through 6 are administrative items leading up to the on

-site review. Interviews with utility personnel involved in this peer review indicate several discussions were held prior to the on

-site review to resolve questions, provide materials, and address logistical issues.

Consistent with NEI 12

-13 Step 7, during the onsite visit the host utility presented an overview of the PRA and then the review team performed a comprehensive and concentrated review of the PRA documentation, electronic models, and results against the ASME PRA Standard Supporting Requirements criteria. The review team members performed independent study of the PRA against the criteria and consulted with the utility PRA personnel and other review members in order to come to an understanding of the PRA capabilities with respect to the ASME PRA standard criteria.

Consistent with the guidance in NEI 12

-13, checklists were utilized along with a supporting requirements (SR) assessment documentation database to provide a structure, which in combination with the review teams' experience provides the basis for examining the SRs of the applicable technical elements. The PRA Peer Review process uses capability categories as defined by the PRA Standard to assess the relative technical merits and capabilities of each technical supporting requirement reviewed. Capability category assignments were made based on the judgment of the Peer Review Team after reviewing the PRA, and the associated documentation.

Reviewers were assigned specific areas of focus. Consistent with NEI 12

-13 Section 2.1 Step 7 and Section 3.2, at the end of the review for each technical element, the team members conducted consensus discussions to assign Capability Categories to the SRs.

Initial determination of SR status was performed consistent with Section 3.2 of NEI 12

-13 which states that determination of the status of an SR should be guided by the following approach from RG 1.200:

"...[If] there are a few examples in which a specific requirement has not been met, it is not necessarily indicative that this requirement has not been met. If, the requirement has been met for the majority of the systems or parameter estimates, and the few examples can be put down to mistakes or oversights, the requirement would be considered to be met. If, however, there is a systematic failure to address the requirement (e.g., component boundaries have not been defined anywhere), then the requirement has not been complied with."

U.S. Nuclear Regulatory Commission Page 56 of 108 Serial RA-18-0178 Enclosure This same language from RG 1.200 is quoted in the Peer Review report as the basis for capability category assignments, such that the determination of the SR status performed by the peer review team is consistent with the guidance of NEI 12

-13.

Section 3.3 of NEI 12

-13 provides the criteria for assignment of capability categories. It states that section 2 of each part of the ASME/ANS PRA Standard presents the risk assessment SRs for each external hazard. These requirements are specified in terms of Capability Category requirements with increasing scope and level of detail, increasing plant

-specificity, and increasing realism as SRs satisfy Capability Category I through Capability Category III. The SRs evaluated in the BNP XF and HW peer reviews are listed in Table 3

-1 of the peer review report and are identical to those in the ASME standard. Additionally, the interpretation of supporting requirements in Table 3-1 of NEI 12

-13 is the same as used by the peer review team, as documented in Table 1

-3 of the peer review report. Thus, the assignment of capability categories performed by the peer review team is consistent with the guidance of NEI 12

-13. Also, as noted in the peer review assessment bases for SRs WPR

-A4 and XFPR

-A4, the high winds and external flooding PRA models were developed by modifying the internal events at

-power PRA model according to the requirements in Part 2 of the ASME/ANS PRA Standar

d. NEI 12-13 Section 2.1 Step 7c states on

-site walkdowns are needed during an external hazard peer review to confirm the relationships between SSCs and the potential effects of an external hazard. The PRA standard Section 8

-3.3.4 and Section 7

-3.3.4 for the respective hazards, states the peer review team shall review the plant walkdown. Additionally, NEI 05

-04 does not require plant walkdowns, even for internal flooding PRA peer reviews. The BNP XF and HW peer review team reviewed the walkdown data for the hazards. The assessment of HW SR WFR-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. The assessment of XF SR XFFR

-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. Thus, the peer review team adequately assessed the relationship between SSCs and the potential effects of the hazard(s).

NEI 12-13 Section 2.1 Step 7d provides guidance on sensitivity studies as needed to address the review team's questions. The PRA models and practitioners were available to the peer review team to provide these studies as needed for the review.

NEI 12-13 Section 2.1 Step 7e provides guidance for the peer review team to assess the maintenance and update process. The BNP HW and XF peer review team did not assess the maintenance and update process during the 2012 peer review. However, both the HW and XF models are based on the internal events model, which was peer reviewed in June 2010. The internal events PRA peer review did assess all MU SR's and found all to be met at capability categories 1

-3. NEI 12-13 Section 2.1 Step 8 describes the process for developing preliminary findings and results of the peer review. The process used in the BNP HW and XF peer review to apply capability categories, identify findings, and reach consensus are described above.

NEI 12-13 Section 2.1 Steps 9 through 14 describe the exit meeting through issuing the final report. The peer review was consistent with these steps as described in NEI 12

-13.

U.S. Nuclear Regulatory Commission Page 57 of 108 Serial RA-18-0178 Enclosure Previous Model Use/Application:

There have been two recent BSEP license amendments crediting the HW and XF PRA models, including the peer review in question. Both safety evaluations note the HW and XF PRA peer reviews were completed in accordance with the standard (ASME/ANS RA

-Sa-2009, as endorsed by RG 1.200, Revision 2) and were found acceptable. Note: Determining the PRA peer reviews were completed in accordance with the latest version of the standard is not an application specific conclusion as the PRA either does or does not comply with the standard.

Specifically, the BSEP application to adopt Technical Specifications Task Force (TSTF) traveler TSTF-425 Revision 3 "Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b" credits use of the high winds and external flood PRA models for surveillance frequency control program (SFCP) evaluations. The NRC's safety evaluation (ML17096A129, May 24, 2017) states:

These models were peer reviewed in 2012 against the ASME PRA Standard ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2. The NRC staff reviewed the F&Os from the 2012 peer review submitted in Table 4 of Enclosure 2 to the LAR. The staff reviewed the summary of the findings, the licensee's resolution to the findings, and the licensee's assessment of the impact on this application. The NRC staff assessed these peer review F&Os to ensure that any deficiencies in meeting Capability Category II can be addressed for the SFCP per the NEI 04-10, Revision 1 methodology. For most F&Os the staff found the licensee's resolution submitted in the LAR acceptable for the application. For four F&Os the staff requested additional information, as discussed below-.

Based on the licensee's assessments using the currently applicable PRA standard and revision of RG 1.200, the NRC staff concludes that the level of PRA quality, combined with the proposed evaluation and disposition of gaps, will be sufficient to support the evaluation of changes proposed to surveillance frequencies within the SFCP, and is consistent with Regulatory Position 2.3.1 of RG 1. 177.

Additionally, the BSEP application to extend the emergency diesel generator technical specification 3.8.1 completion time from 7 days to 14 days credits use of the High Winds and External Flood models as part of this risk

-informed license action. The NRC's safety evaluation (ML13329A362, February 24, 2014) states:

The licensee assessed the risk from high winds and external flooding using a PRA model that was subjected to an industry peer review in 2012, using the ASME PRA Standard ASME/ANS RA

-Sa-2009, as endorsed by the NRC in RG 1.200, Rev 2. The licensee resolved many of their industry peer review findings through additional analysis. There were four findings from this peer review where the high winds and external flooding PRA model was found not to conform to capability category II of the standard for certain SRs. Three findings were related to documentation and were determined not to impact this application. One finding WPR

-A3 identified included some of the structures, systems, or components (SSCs) that were not analyzed for fragility and was later dispositioned by the licensee. These SSCs were treated in a conservative manner (e.g.,

U.S. Nuclear Regulatory Commission Page 58 of 108 Serial RA-18-0178 Enclosure assumed to always fail during a high

-winds event) and therefore this issue is not expected to impact the amendment request.

Based on consideration of the gaps to capability category II of the ASME PRA standard and their disposition for this application, the NRC staff finds that the quality of the BSEP High Winds and External Flooding PRA is sufficient to support the proposed license amendment.

b. Discuss how the peer review, including the corresponding process and guidelines discussed in response to part (a), was consistent with NEI 12

-13, as modified and accepted by the NRC, and justify deviations from that guidance. Features of the external hazards PRA peer review that should be discussed include the process and extent of walkdowns performed by the peer-review team, the duration of the on

-site peer-review for each external hazard PRA, composition and qualification of the peer

-review team as cited above from NEI 12

-13, and identification of UAMs.

Duke Energy Response to PRA RAI 10.b.: The response to RAI 10.a. above provides the necessary justification to accept the External Hazard PRA (HW and XF) for the 10 CFR 50.69 application.

PRA RAI 11 - External Flooding Hazard Development - Storm Surge and Initiating Event Frequencies:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, the 2009 version of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard (ASME/ANS RA

-Sa-2009). High level requirement (HLRs) in Part 8 of the 2009 ASME/ANS PRA Standard, related to the external flooding technical element, specifically HLR

-XFHA-A, calls for the use of site

-specific probabilistic analysis to develop the hazard frequency and for the propagation of uncertainties in the model and parameter values to develop a family of hazard curves.

a. Discuss how the initiating event frequencies used in the XF PRA were developed. The discussion should include a description of (1) method(s) used, (2) input parameter selection such as precipitation events intensity and duration, storm surge flooding, stillwater levels, wave runup, and other associated effects, (3) how data were selected for specific analysis including time periods and intensities, and (4) how parametric and modeling uncertainties were addressed to develop a family of hazard curves.

Duke Energy Response to PRA RAI 11.a.: The BSEP External Flood model initiating event frequency is based on a point estimate from the BNP Individual Plant Examination for External Events (IPEEE), which corresponds to a 20 ft still water flood event and has an initiating event frequency of 7.4E

-04/yr. To suppose use of this frequency, a simplistic calculation was completed taking into account the intensity of the hurricane, level of exposure, and likelihood of the hurricane hazard.

In support of other plant activities, an updated storm surge analysis was completed using detailed computational modeling. The detailed analysis confirmed the external flood model U.S. Nuclear Regulatory Commission Page 59 of 108 Serial RA-18-0178 Enclosure initiating event frequency is a conservative estimate of the hazard frequency and no changes were made to the hazard frequency as a result of the detailed analysis. The detailed analysis is being incorporated into the PRA and will be peer reviewed as described in part b of this RAI. The detailed analysis is described below.

(1) Method Used A storm surge analysis focused on estimating storm surge and wave induced flooding associated with hurricanes affecting the BNP site was performed by industry subject

-matter experts. The study utilized a 500,000 year simulation of synthetic hurricanes occurring in the North Atlantic basin using the vendor's peer

-reviewed hurricane simulation model. The hurricane model is updated and reviewed every two years as required by the Florida Commission on Hurricane Loss Projection Methodology. The version used in this study was approved by the commission in 2010. This is the same hurricane model that was used to develop the hurricane wind hazard curves for the HW PRA (see response to RAI

-13).

The vendor's hurricane hazard model is described in detail in various academic literature available for audit. Using the simulated tracks, a hurricane wind speed hazard curve for the BNP site was developed, from which data were retained for 14,217 storms that produced gust wind speeds of 90 mph or greater at BNP. This reduced storm set was used to drive NOAA's SLOSH model (NOAA, 1992) using the fast

-running SLOSH wind field model. The 100 hurricanes that produced the highest storm surge elevations at BNP were re

-run through the SLOSH model with the vendor's wind field model . From these 100 storm surge simulations, the 10 hurricanes producing the highest storm surge at the BNP site were provided to UNC

-CH to conduct more detailed storm surge modeling.

The Renaissance Computing Institute (RENCI) and Institute of Marine Sciences (IMS) of UNC

-CH conducted a set of storm surge and wind wave simulations for the 10 synthetic storms identified by the vendor. These simulations were conducted using the coupled storm surge and wave model ADCIRC/SWAN to predict the surge and wave response to the pre

-determined hurricane storm tracks with the vendor's hurricane wind field model . The ADCIRC/SWAN grid used in the recent FEMA flood insurance study was updated to include more accurate topographic detail in the BNP area. As such, the grid resolution used in the hydrodynamic surge-wave modeling performed by UNC

-CH was much finer than that associated with the SLOSH model.

The result of this analysis is the estimated still water elevation levels (SWEL), including wave setup and static tidal height, and maximum significant wave heights at 14 locations around the BNP site for each of the 10 storms modeled. Results are produced for four different tide levels, including Mean Sea Level (MSL), Maximum High Water level (MHW), MHW minus 1 foot, and MHW plus 1 foot. Given that these 10 storms produce the highest level of storm surge at BNP over the 500,000 years simulated, the storm that produces the maximum surge is a single realization of the 500,000 year storm surge level (2E

-06/yr) and the storm with the 10 th highest storm surge is a single realization of the 50,000 year surge level (2E

-5/yr). The resulting SWEL and maximum significant wave heights for the intake canal, Service Water Building, and Switchyard are presented in Table 1 and Table 2, respectively. Note that the plant grade is approximately 20 ft above MSL and dashes in the tables indicate there was no inundation at that location for the storm and associated tide level.

U.S. Nuclear Regulatory Commission Page 60 of 108 Serial RA-18-0178 Enclosure Table 1. Still Water Elevation Level above MSL for 10 Storms Modeled Table 2. Maximum Significant Wave Height for 10 Storms Modeled (2) Input Parameter Selection The method described above relates only to the storm surge hazard. This storm surge analysis produced estimates of storm surge induced still water elevation levels and maximum significant wave heights at 14 locations for 10 synthetic hurricanes. These 10 storms were selected from a 500,000 year hurricane simulation that were identified as having the greatest potential for producing maximum storm surge at BNP using the coarse SLOSH model. The SWEL estimates include the effects of wave setup and a static tidal height.

Wave runup is generally calculated using empirical methods that consider the slope of the beach or dune that the waves are running up onto. Given the flat nature of the BNP site, any calculation of wave runup would have negligible effect on the overall results of the storm surge analysis. As such, wave runup was not considered in the BNP storm surge analysis.

(3) How Data were Selected Data selected for use in the storm surge analysis were selected based on the best available information to perform a state

-of-the-art hurricane storm surge analysis.

Data used to develop the 500,000 year synthetic hurricane storm set include the sources listed below. MHW+1MHWMHW-1MSLMHW+1MHWMHW-1MSLMHW+1MHWMHW-1MSL 1trk04536_122.922.021.120.023.022.121.120.423.422.621.620.8 2trk13867_221.921.020.019.121.921.0--21.620.7--3trk11833_321.220.319.518.921.3---21.0---4trk07223_421.020.119.318.221.0---20.5---5trk06474_920.920.118.917.921.020.520.4

-22.621.921.421.2 6trk02401_1020.319.318.417.520.520.4--21.521.120.4

-7trk02352_719.919.117.916.9--------8trk10785_519.719.017.716.8--------9trk01974_619.218.116.915.8--------10trk09613_819.017.916.815.9--------SWEL at Service Water BuildingSWEL at SwitchyardSWEL at Intake CanalStormRankMHW+1MHWMHW-1MSLMHW+1MHWMHW-1MSLMHW+1MHWMHW-1 MSL 1trk04536_14.34.34.24.21.51.20.9

-1.71.10.60.3 2trk13867_24.44.34.34.21.41.1--0.70.3--3trk11833_34.54.44.34.21.3---0.4---4trk07223_44.74.64.54.50.9---0.3---5trk06474_93.43.43.23.20.70.50.4

-1.10.80.70.5 6trk02401_103.63.63.53.50.60.5--0.60.60.3-7trk02352_74.03.93.93.9--------8trk10785_55.45.35.35.2--------9trk01974_64.34.34.24.1--------10trk09613_84.54.54.44.4--------RankStormMax Significant Wave Height (ft) at Intake CanalMax Significant Wave Height (ft) at Service Water BuildingMax Significant Wave Height (ft) at Switchyard U.S. Nuclear Regulatory Commission Page 61 of 108 Serial RA-18-0178 Enclosure

a. HURDAT - contains tropical cyclone positions, maximum wind speed, and central pressure (if available) every 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b. Aircraft measurements of pressures and wind speeds

c. Landfall data

d. Dropsonde data, e. Sea surface temperatures

f. Tropopause temperatures

g. Wind shear The ADCIRC/SWAN modeling used the high

-resolution ADCIRC grid developed for the FEMA

-funded North Carolina Flood Insurance Study as the starting point for this project's grid. From the FEMA coastal flood hazard perspective, the BNP site is well above the 1% annual chance level of flooding, and hence was not included in detail in the original FEMA grid. Because of this, the FEMA grid was modified for this study based on available digital imagery, ortho

-photographs, and LiDAR to improve the representation of the study area (lower Cape Fear River). (4) How Parametric and Modeling Uncertainties were Addressed to Develop a Family of Hazard Curves The approach described in Items (1) to (3) led to the following estimates: the mean estimate of the 1E-05 annual exceedance probability hurricane

-induced water level is 18.5 ft above National Geodetic Vertical Datum of 1929 (NGVD 29). The mean estimate of the 2E

-06 annual exceedance probability water level is 20.3 ft above NGVD 29.

In the external flood probabilistic risk assessment (XF PRA), a point estimate from the BNP Individual Plant Examination for External Events (IPEEE) was used, which corresponds to a 20 ft still water flood event and has an initiating event frequency of 7.4E

-04/yr. Comparing that point estimate to those of the ARA and UNC

-CH study shows that it is appreciably conservative (i.e., the 20

-ft water level of the storm surge is considered to occur with a much higher frequency in the XF PRA than estimated in the ARA and UNC

-CH study). In light of that conservatism, the XF PRA did not develop a family of hazard curves.

b. It appeared from the audit discussions that the method presented to support the technical acceptability of the flood hazard development for this application has not been peer

-reviewed. Discuss and provide the results of a focused

-scope peer

-review, including the resolution of finding level Facts and Observations (F&Os) not closed using a NRC approved process, for the development of the initiating event frequencies that will be used in the XFPRA. Duke Energy Response to PRA RAI 11.b.: Duke Energy will complete a focused scope peer review of the BNP External Flood PRA model hazard development prior to implementation of 10 CFR 50.69. Any findings from the focused scope peer review will be resolved and closed per an NRC approved process prior to implementing 10 CFR 50.69.

U.S. Nuclear Regulatory Commission Page 62 of 108 Serial RA-18-0178 Enclosure PRA RAI 12 - External Flooding Hazard Development - Local Intense Precipitation and Screening:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA

-Sa-2009. Section 8

-2 of the 2009 ASME/ANS PRA Standard indicates that certain flooding phenomena can be screened out using the screening methods in Part 6 of the cited PRA Standard. Part 6 of the 2009 ASME/ANS PRA Standard provides criteria for screening along with associated supporting requirements (SRs) and peer

-review.

The summary of the staff's review of the licensee's reevaluated flood

-causing mechanisms, included in the letter dated March 16, 2017 (ADAMS Accession No. ML17072A364), stated that the reevaluated flood hazard results for the local intense precipitation (LIP), streams and rivers, failure of dams and onsite water control/storage structures, storm surge, and tsunami flood

-causing mechanisms were not bounded by the current design basis. Such flooding mechanisms may lead to flooding in excess of plant grade such that water impinges upon plant structures.

Further, use of the licensee's design basis to screen out certain flooding phenomena does not address the frequency of exposure to floods (including lower than the design basis flood) that may impinge upon SSCs and challenge plant safety, the impact of associated effects and the temporal characteristics of the event (e.g., the period of site inundation), and the risk associated with those floods.

a. In light of the above information, describe and justify the approach used for screening out any flooding mechanism from inclusion in the licensee's XF PRA. The descriptions should include justification for any credit taken for permanent, passive, or active flood protection features. Duke Energy Response to PRA RAI 12.a.: The approach used in the external flooding probabilistic risk assessment (XF PRA) for screening out flooding mechanisms is summarized below. The local intense precipitation (LIP) flooding mechanism is addressed separately in the response to Part b of this RAI.

A flooding mechanism is screened out from the XF PRA for one of the following two reasons:

The flooding mechanism is not applicable to the site. For example, extreme lake flooding is screened out because Brunswick Steam Electric Plant (BSEP) is not located in the vicinity of a lake. A demonstrably conservative deterministic analysis of the flooding mechanism finds that its flood elevation does not reach the nominal site grade elevation of the buildings that host the structures, systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The deterministic analysis used for screening out a flood mechanism is demonstrably conservative in that it fulfills the following criteria:

U.S. Nuclear Regulatory Commission Page 63 of 108 Serial RA-18-0178 Enclosure It accounts for the characteristics of the underlying flooding mechanism (including, as relevant, associated effects such as waves and runup) to ensure that there is no potential for the flood mechanism to impinge on credited SSCs.

It relies on the site grade elevation, which is an inherently rugged feature of site topography, is permanent, passive, and not significantly affected by the flooding mechanism.

It provides a margin between the conservatively determined flood elevation and the occurrence of cliff

-edge effects.

Besides LIP (addressed in the response to Part b of this RAI), the letter dated March 16, 2017 (ADAMS Accession No. ML17072A364) identified the following flooding hazards as not bounded by the current design basis: 1) streams and rivers, 2) failure of dams and onsite water control/storage structures, 3) tsunami, and 4) storm surge. For the first three hazards, the BSEP design basis was not bounded because it did not include flood elevations. A subsequent demonstrably conservative analysis calculated these flood elevations and established, with sufficient margin, that they did not reach the nominal site grade elevation, allowing for their elimination in the XF PRA. This left the fourth hazard (i.e., storm surge) as requiring further evaluation in the XF PRA.

b. Describe, with justification, how LIP was considered in the licensee's XF PRA. Include discussion of precipitation event intensity and duration (with source of information), any hydrologic and hydraulic modeling, and elevations of LIP induced flooding that supported the consideration.

Duke Energy Response to PRA RAI 12.b.:

The LIP flood causing mechanism was screened from inclusion in the XF PRA. The approach used to screen out flooding mechanisms is the same as described in RAI

-12.a. response. Particularly the portion described below:

A demonstrably conservative deterministic analysis of the flooding mechanism finds that its flood elevation does not reach the nominal site grade elevation of the buildings that host the structures, systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The methodology of the demonstrably conservative hazard analysis can be found in the flood hazard reevaluation report (FHRR) as submitted to NRC on March 11, 2015 (ML15079A385). This document contains the information necessary to address event intensity and duration, along with the hydrologic and hydraulic modeling. The resulting water surface elevations (WSEs) across the site can be found in the Interim Staff Guidance (ISG) document published after an NRC audit on the results (ML17072A364). Lastly, the analysis on the impacts from the revised hazard levels are provided in the Focused Evaluation (FE) (ML18270A372) submitted on September 27, 2018. The ISG reported that a LIP event would produce standing water above only two door thresholds in the Reactor Building (D

-2 & D-3). In the FE, it was shown that leakage through the air lock door would be very minimal and floor drains or stairwells are present to route the water into the Reactor Building Basement sump area with ample volume to store the water prior to reaching any SSCs.

U.S. Nuclear Regulatory Commission Page 64 of 108 Serial RA-18-0178 Enclosure The FE describes the available physical margin (APM) from the in

-leakage water collecting in the basement to the lowest SSC on a one

-foot pedestal. Therefore, the APM is calculated to be 0.7 feet with a depth of water of 0.3 feet. These calculated values were justified as conservative based on the following assumptions:

1. Sump pumps are not credited in actively removing water. They are considered a defense-in-depth measure to remove in

-leakage from the RB basement.

2. A WSE of 22 ft was assumed at both Doors D

-2 and D-3, where the actual WSE were 20.79 ft and 21.07 ft, respectively. This conservative assumption for the WSE yields a conservative in

-leakage rate of 30 gpm. The actual in

-leakage is anticipated to be lower.

Given the above assumptions, inputs and calculation results, the LIP flood hazard was screened from inclusion in the XF PRA based on conservative deterministic analysis showing there are no impacts to SSCs from a LIP event.

c. Identify and describe any topographic changes to the site that can invalidate prior analyses (e.g., Individual Plant Examination for External Events) for screening or mitigation of external flooding hazards.

Duke Energy Response to PRA RAI 12.c.:

The demonstrably conservative deterministic analysis used to screen out flooding mechanisms accounted for site

-specific topographical information to produce flooding elevations and was recently updated for the FE (ML18270A372). These flooding elevations were developed in concert with the NRC, audited and found appropriate for the BSEP site as noted in NRC Letter, Brunswick Steam Electric Plant, Units 1 and 2 - Interim Staff Response to Reevaluated Flood Hazards Submitted In Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation (CAC Nos. MF6104 and MF6105), dated March 16, 2017, ADAMS Accession Number ML17072A364.

PRA RAI 13 - High Winds Hazard Development:

Discuss the approach followed for the development of hazard curves for the extreme winds, tornadoes, and hurricanes used in the BSEP HW PRA. For each hazard, the discussion should include information on the (i) source(s) of data, (ii) the process used to develop the corresponding non

-exceedance curves, (iii) consideration of uncertainties in parameter values, and (iv) the sources of model uncertainty and key assumptions.

Duke Energy Response to PRA RAI 13: Four types of extreme winds can affect the BNP site in Southport, NC, including hurricanes, thunderstorms, extra

-tropical storms, and tornadoes.

Location-specific analyses of each of these wind hazards were performed with appropriate data sets from the National Weather Service (NWS), National Climatic Data Center (NCDC), National Severe Storm Prediction Center (NSSPC), and the National Hurricane Center (NHC). State

-of-the-art methods were used to develop best

-estimates of the high wind hazard that are not intended to be conservatively biased. Uncertainties in these estimates were used to estimate the 5 th and 95 th percentile confidence bounds around mean values.

Figure 1 presents the individual mean wind hazard

U.S. Nuclear Regulatory Commission Page 66 of 108 Serial RA-18-0178 Enclosure are the results of a 10 million year hurricane simulation performed for the NRC (NUREG/CR-7005) and a second specific study developed using a 500,000 year simulation. The hurricane hazard model used in the study has formed the basis for the US national wind loading standard, ASCE 7, from 1998 through to the present. Details of this model are presented in various academic literature and are available for audit. This hurricane model is updated and reviewed every two years as required by the Florida Commission on Hurricane Loss Projection Methodology. The version used in this study was approved by the commission in 2010. iii. Uncertainties in parameter values: Estimates of uncertainties were developed using the uncertainty estimates presented in Vickery, et al. (2009b). Uncertainties were considered for the following parameters:

iv. Sources of model uncertainty and key assumptions: Sources of modeling uncertainty are discussed above. Key assumptions in the Hurricane Wind Hazard Analysis were identified based on research and development of hurricane wind field and occurrence models, sensitivity analyses, and engineering judgment.

The key assumptions include:

a. The historical information on hurricanes during the last 100 years is representative of the hurricane wind climate during the life of the plant.

b. The hurricane simulation model provides a good representation of the hurricane hazard at the BNP site.

2. Thunderstorm and Extra

-Tropical Storm Winds:

i. Source of data. Gust wind speed data from Wilmington (NC) International Airport (KILM) during the period of 1972 through 2009 was used in the analysis. These data were obtained from the National Climatic Data Center (NCDC) and contain the daily maximum gust wind speed, associated wind direction, and a daily thunder indicator.

Uncertainty TypeNumberParameterBasis for QuantificationModeling 1Hurricane Occurrence Rate, RMW, Holland B, Central Pressure, Translation SpeedPropagation of component errors as given in Vickery et al. (2009b) 1Inland DecayJudgment, chosen to double the variance of the error from Vickery et al. (2009b) given above 2Wind Field Model ErrorDerived from comparisons of modeled and observed wind speeds from historical hurricanesRandom U.S. Nuclear Regulatory Commission Page 67 of 108 Serial RA-18-0178 Enclosure ii. Process to develop non

-exceedance curves: The daily maximum wind speed data were separated into two data sets based on the thunder indicator. Thunderstorm wind gusts were defined as the maximum gust wind speed recorded on a day when thunder was reported. All other daily maximum wind speeds were maintained in the extra

-tropical storm dataset. Wind speed data were adjusted (increased) to account for local surface roughness effects around the KILM anemometer and to adjust 5

-second block averaged gust data to an equivalent 3

-second running average gust wind speed. The wind hazard curves for the thunderstorm and extra

-tropical storm winds were developed using a Type I extreme value analysis.

iii. Uncertainties in parameter values

Figure 1 shows that winds associated with thunderstorms and extra

-tropical storms have virtually no effect on the estimate of the combined wind speed for annual exceedance probabilities less than about 0.05 (return periods of about 20 years). As a result, uncertainties in the thunderstorm and extra

-tropical storm hazard analyses were not addressed in this analysis.

iv. Sources of model uncertainty and key assumptions: Model uncertainties were not considered as discussed above. There are no key assumptions for the thunderstorm and extra

-tropical storm hazard analyses because the analyses showed that these hazards had a negligible effect on the wind hazard (see Figure 1), hence the effect on the overall HW PRA will be negligible as well.

3. Tornado Winds:

i. Source of data: NCDC/NSSPC data for the years 1950

-2009 were used for this analysis. These data have been screened to eliminate coding errors in the record fields. In addition, corrections have been introduced to account for reporting efficiency and time series, or other potential errors resulting from the indirect characteristics of the available data.

ii. Process to develop wind speed frequency curves: Analysis of the NCDC tornado data follows the approach developed and adopted for the TORMIS methodology and enhancements for tornado wind speed risk analysis using the TORRISK methodology. Figure 2 summarizes the overall approach for the BNP site-specific tornado hazard analysis. This analysis included the following steps:

a. A homogenous tornado sub-region around BNP was developed using statistical cluster analysis on a 15 degree by 15 degree lat

-long grid centered on the BNP site. Tornadoes in the NCDC data set were mapped on the grid, as shown in Figure 3, and analyzed for key tornado risk variables - including occurrence rate, point strike probability, and path U.S. Nuclear Regulatory Commission Page 68 of 108 Serial RA-18-0178 Enclosure direction - using the EML CLUSTER procedure in SAS (SAS Institute, 1992). One- and three-degree clustering sets were produced to aid in development of the final BNP subregion.

b. The final subregion selected is shown in Figure 4. This method addresses both broad regions and small areas around the plant site.

c. The BNP subregion data set was analyzed to produce tornado occurrence rate, intensity, path length, path width, and path direction. Probability distributions were developed for each of these variables and their correlations, as appropriate.

d. The TORRISK computer code was then used to develop a family of tornado hazard curves and strike probabilities for a single point (for use with wind pressure fragilities), and for the BNP safety envelope (for use with wind missile fragilities).

iii. Uncertainties in parameter values: Several epistemic (modeling) and aleatory (random) uncertainties were considered. The following table summarizes the epistemic and aleatory parameters/models. These uncertainties were propagated in a two loop Monte Carlo simulation model using TORRISK to produce percentile curves and a derived mean wind speed frequency curve.

Uncertainty Type Number Parameter Basis for Quantification Epistemic 1 Tornado Occurrence Rate Considered statistical uncertainty in the number of reported tornadoes, based on the number of years of record.

2 Tornado F/EF Distribution Developed frequency distributions from as- reported data, and updated distributions reflecting tornado classification errors from observed damage. These frequency distributions were weighted to reflect the uncertainties in the distribution of intensities.

3 Tornado F/EF

-Scale Wind speeds Judgment based weights on F, F', and EF damage scale wind speeds to reflect the uncertainties in tornadic wind speeds Aleatory 1 Tornado Occurrence Rate Number of tornadoes in plant subregion and analysis of reporting trends by F-scale 2 Tornado Intensity Number of tornadoes in each intensity scale; reporting trends; error analysis 3 Variation of intensity along tornado path Mapping of tornado damage for selected events U.S. Nuclear Regulatory Commission Page 69 of 108 Serial RA-18-0178 Enclosure Uncertainty Type Number Parameter Basis for Quantification 4 Wind Speeds Tornado wind speeds given damage 5 Path Direction Analysis of lat

-long positions of starting and ending point of tornado path 6 Path Length Analysis of path length data conditional on F-Scale 7 Path Width Analysis of path width data conditional on F-Scale and path length.

8 Tornado Wind Field Parameters Quantification of Translation Speed, Rmax, inflow parameter, Boundary Layer height, velocity profile, core slope parameters developed in the Tornado Missile Risk Analysis products from EPRI (NP

-769 and NP-2005). iv. Sources of model uncertainty and key assumptions: Sources of modeling uncertainty are listed in item 3.iii above. The approach used to identify the key assumptions are based on research and analysis of the tornado database, structural response to tornado wind fields, modeling, sensitivity analyses, and engineering judgment. Some of the major assumptions in tornado hazard development include:

a. Wind speeds associated with tornado damage intensity scales, such as the F, F', and EF Scales.

b. Assumptions regarding tornado reporting efficiencies for different eras of the database and uncertainties in tornado occurrence rates.

c. The probability distribution of tornado intensities.

d. Tornado wind field parameters.

e. Items a, b, and c were modeled with epistemic uncertainties and then fully propagated to develop a derived mean tornado hazard curve and estimated percentiles.

f. The Item d parameters were modeled as random variables in the model with statistical ranges to reflect the natural variations observed in the data regarding tornado wind fields and damage swaths.

U.S. Nuclear Regulatory Commission Page 72 of 108 Serial RA-18-0178 Enclosure PRA RAI 14 - Wind Generated Missile Hazard Development:

Discuss the approach followed for the evaluation and development of wind

-generated missile hazard for inclusion in the BSEP HW PRA. The discussion should include the approach used to (i) to identify and assess the number, type and location of potential missiles, and (ii) to determine the frequency of damage on individual SSCs from high

-winds and tornado generated missiles. Justify any deviation(s) from using a plant

-specific high wind missile analysis methodology for determining the frequency of damage resulting from missiles generated by high-winds and tornadoes on individual SSCs and demonstrate the impact of identifie d deviation(s) on this application.

Duke Energy Response to PRA RAI 14: Approach to identify number, type, and location of potential missiles:

A detailed survey of the BNP site was conducted to develop an inventory of potential wind missiles following the TORMIS methodology. The process to document potential wind missiles located within 2,500 feet of the HW PRA SSCs included:

1. Dividing the plant and surrounding area into 31 relatively homogenous missile source zones as shown in Figure 1. a. Missiles observed in each zone were counted and classified into the 22 potential missile types presented in Table 3. b. The number of potential tree missiles in forested areas was estimated based on the treed area determined from aerial photos and tree density information from the US Department of Forestry for Brunswick County, NC.

c. Table 4 presents the number of missiles for each missile source zone and missile type. The survey resulted in a total of 114,327 potential zone

-origin missiles.

2. Identifying 62 missile source structures that are likely to fail in extreme winds and tornadoes. The list of missiles source structures included in the analysis are shown in Table 5. a. Inventories of buildings were surveyed and classified as potential missiles followed the same process used for missile zones

b. Total number of missiles from the failure of structures was estimated based on observed construction types and building dimensions.

c. Table 6 presents the number of missiles for each missile source structure and missile type. The survey resulted in a total of 121,668 potential structure

-origin missiles.

3. Identifying nine Category I, reinforced concrete structures that provide missile shielding to the SSCs, including:

a. Unit 1 and 2 Turbine Buildings below the turbine operating floor, b. Unit 1 and 2 Reactor Buildings, c. Control Building, d. Radwaste Building, e. Diesel Generator Building

f. Off-gas Building, and

g. Service Water Building

U.S. Nuclear Regulatory Commission Page 74 of 108 Serial RA-18-0178 Enclosure Table 3. Tornado Missile Types and Characteristics used in BNP Missile Survey Table 4. Number of Zone Missiles by Missile Type and Zone Length LDepthWidthPenetration Area (feet)d b Amin (in)(in) (in 2)1*1a 1RebarSt eel3.001.001.002.670.798.01 2 1c 1Gas CylinderSteel5.0010.0210.0238.649.45193.20 3 1d 1Drum, TankSteel5.0019.9819.9823.55311.60117.754*2b 2Utility PoleWood35.0013.5013.5032.06143.101122.10 5 2c 2Cable ReelWood1.7642.2142.21140.70126.60247.636*3b 33" PipeSteel10.003.503.507.582.2075.807*3c 36" PipeSteel15.036.636.6318.905.60284.078*3d 312" PipeSteel15.0012.7512.7549.6014.60744.00 9 5b 4Metal Storage BinSteel6.0038.4036.00112.5040.50675.00108a 5Concrete Masonry UnitConcrete1.338.008.0033.3364.0044.3311*9a 6Wood BeamWood12.0012.004.009.5048.00114.001211a 7Wood PlankWood10.0012.001.203.3012.0033.001312a 8Metal SidingSteel30.0012.002.256.3327.00189.901413a 97/8" Plywood SheetWood8.0048.001.0025.0024.00200.001514b10Wide Flange (W14x26)Steel15.0011.295.0327.878.16418.051616a11Channel Section (6 x 13)Steel18.005.113.8311.883.49213.841718a12Small EquipmentSteel8.0046.4830.0044.024.63352.161819a13Large EquipmentSteel12.0067.0736.0088.6715.701064.041922a14Steel GratingSteel6.0043.311.0012.372.2274.222022b14Large Steel FrameSteel24.3597.4132.4747.2311.001150.0521*25a15VehicleSteel15.9566.0066.00250.002574.003987.502226a16TreeWood20.008.008.0035.0050.27700.00

• Denotes membership in the 1975 NRC Missile SpectrumWeight (lbs)Final Missile Sub setAero SetSequential Aero Set No. (MTRANS)Missile Description (Typical)MaterialWeight per Unit Length (lb/ft)12345678910111213141516 1Rebar00 11 4290002837501745 028931335000 2Gas Cylinder001351460000376300 77000 3Drum, Tank002 1746039 13 0 975000 4Utility Pole00300600 182000124 5Cable Reel003 150001642190 05216000 63" Pipe 62 7473811 011534763012898526 01708554890 5 10 76" Pipe1524 0 4200 362 032519 0 279200 812" Pipe001516 8 335413046 038355310100 9Metal Storage Bin008 6000061905917010 10Concrete Frag. (Concrete Block)004 3500002889834645 0 5730000 11Wood Beam00221130603646901007812400 12Wood Plank0016962400015109412018600 13Metal Siding00364410005913243 03084000 147/8" Plywood Sheet003521202016131175 020470000 15Wide Flange (W14x26)006 6300 157 0 531011718800 16Channel Section (6 x 13)000 6502163515556 0277900 12 17Small Equipment301230021348170 236710 18Large Equipment40122422763517043200 19Steel Grating70169352051011684765 05958610002 20Large Steel Frame003 2505 92 06627 0 443000 21Vehicle83308 8 20000143417 07129510 22Tree 0 309000000 260 01220922 031827839164417464811263855141844207371716656386612207678262445607859177234.02 39.1819.1924.496.6010.5327.5120.2628.3317.9814.7472.5655.59131.75125.87152.17 51759157 2171531835882158310647356212171819202122232425262728293031Total 1Rebar0024495400000071797 0 11204 2Gas Cylinder0000600000006332 7 566 3Drum, Tank0000 1310000001021 0 201 4Utility Pole00 12804000000000 60 5Cable Reel0010 180000000780 368 63" Pipe001206448898 0 60000010491660 1 16267 76" Pipe000 18040000001424 0 885 812" Pipe0000300000001618 0 530 9Metal Storage Bin001643100000001736 5 279 10Concrete Frag. (Concrete Block)000 420000000033749 0 12122 11Wood Beam000141000000003 189 4 754 12Wood Plank0030 107000000020753212104 13Metal Siding00 24 0734100000000141142 0 2047 147/8" Plywood Sheet0030 100300000074254 7 1286 15Wide Flange (W14x26)003088240000002920 0 587 16Channel Section (6 x 13)0052514872000000193182 0 1072 17Small Equipment00 12 018290000002227 0 261 18Large Equipment0090030000002668 0 278 19Steel Grating 0 0 372391850000000461407 3 3569 20Large Steel Frame00006 360000006 30 2 345 21Vehicle000 28106000000172216932 22Tree573182427283223583749757411362241335539470000 58610573182427515154473329415741196224133553947 0257647396611432781.80113.64107.3845.75108.2032.8977.31125.94135.6850.7549.2642.9424.7719.2614.221810.5470737034682974 2176680 0104246 5 63Missiles / 10000 sfSubsetMissile DescriptionZone Number Total MissilesZone Area (*10000 sf)Missiles / 10000 sfSubsetMissile DescriptionZone NumberTOTALZone Area (*10000 sf)

U.S. Nuclear Regulatory Commission Page 75 of 108 Serial RA-18-0178 Enclosure Table 5. List of Missile Source Structures Included in BNP Missile Fragility Analysis Missile Source Structure NumberStructure DescriptionZone LocationMissile Source Structure NumberStructure DescriptionZone Location 100TAC 1 131Clean Trash Monitoring 12 101Central Access Building 1 132New Plant Garage 13 102Doc Control Bldg 1 133Warehouse 6 13 103Training Center 22 134Warehouse 7 13 104Contractor Building 1 3 135Warehouse 10 13 105Contractor Building 2 3 136Receiving Building 13 106Clean Maintenance Shop 3 137Aux Boiler 29 107Metal Building 3 138Contaminated Storage Building 29 108Fire House 3 139Mini Storage 29 109Security Office 4 140RMCSB Bldg 30 110Administration Building 4 141Diesel Fire Pump Building 30 111Maintenance Bldg Part 1 4 142Control Building Roof TopN/A 112Maintenance Bldg Part 2 4 143Lower Reactor Building Roof Unit 2N/A 113Scrub Storage Building 4 144Lower Reactor Building Roof Unit 1N/A 114Paint and Used Oil Building 4 145Turbine Building Units 1&2 - 3rd FloorN/A 115Clean Tool Warehouse 4 146TB North SidingN/A 116Service Building 4 147TB West SidingN/A 117Clean Maintenance Shop 4 148TB East SidingN/A 118Material Issue 4 149TB South SidingN/A 119TeleCom Bldg 6 150TB RoofN/A 120Garage 8 151Reactor Unit 2 RoofN/A 121Diesel Repair Shop 8 152Reactor Unit 2 North Wall SidingN/A 122Insulation Fab Shop 8 153Reactor Unit 2 South Wall SidingN/A 123Maintenance&Equipment 8 154Reactor Unit 2 West Wall SidingN/A 124Laydown Buidling 10 155Reactor Unit 2 East Wall SidingN/A 125Chemical Storage 10 156Reactor Unit 1 - 5thFloorN/A 126Mechanical Fab Shop 10 157Reactor Unit 1 RoofN/A 127Oil Storage 12 158Reactor Unit 1 North Wall SidingN/A 128Chemical Storage 12 159Reactor Unit 1 South Wall SidingN/A 129Sand Blast Storage 12 160Reactor Unit 1 West Wall SidingN/A 130Paint Office 12 161Reactor Unit 1 East Wall SidingN/A U.S. Nuclear Regulatory Commission Page 76 of 108 Serial RA-18-0178 Enclosure Table 6. Number of Structure Origin Missiles by Structure and Missile Type 100101102103104105106107108109110111112113114115116117 1Rebar619221551615659163179 6 034427546016993831432619243 2Gas Cylinder0000 12080 37008 29 22112 0 28 3Drum, Tank0000 140810002386 7 4410 52 4Utility Pole000000000000000000 5Cable Reel000020110003111510000 32 63" Pipe000000000000000000 76" Pipe0000 41 0 10 0000000500 36 812" Pipe00005040000000200 12 9Metal Storage Bin432153610920 27 2 4241978288171410224360 10Concrete Masonry Unit0000 14 0 174 000 81000004 246 0 28 11Wood Beam172860144437181348 1 09677109403566017344 12Wood Plank777627064819669064212 7 043234656921024630360778279 13Metal Siding30142734761291549274362451653638362915381511631376601635 147/8" Plywood Sheet864307221870 25 6 04838179662417886137 15Wide Flange (W14x26)6675287249562444 5156719111272171813411093 16Channel Section (6 x 13)720501202941124976 9318032781923633150144191 17Small Equipment21610246644 3 15 1 21610391341011212972 18Large Equipment 72 5122934 1 12 01834 100341416 19Steel Grating0000 60 0 35 110031115105022 0 143 20Large Steel Frame000090109008 29 21125 0 12 21Ve hicle000000004000003000 22Tree000000000000000000216819802135622411604911241852691478900223577674392456387325972113118119120121122123124125126127128129130131132133134135 1Rebar1633147070821610146 82629176448216828035 2Gas Cylinder16112125117122043560 3Drum, Tank3831717153242550 12 94522495 4Utility Pole000000000000000000 5Cable Reel40300 2043026701612 1 59 0 63" Pipe000000000000000 1300 76" Pipe 0 10 022220000000000 1200 812" Pipe0307700000000004 12 0 9Metal Storage Bin71622 3674341113 128212610 10Concrete Masonry Unit0801717 018901688000 3038000 45500 11Wood Beam28217171051 36134 23867840 5 12Wood Plank1936167777973112163103034117765751024030 13Metal Siding1049186216216325 769480711901843739430314181428243 147/8" Plywood Sheet 17 0 150087491109273128685174322140 15Wide Flange (W14x26)12171438383602 68 7 1851342711210828 16Channel Section (6 x 13)2230 9 6767770648133416 0705325225253 17Sm all Equipment 4 11 324242043 122671161229114 4 18Large Equipment050101000040000002620 1 19Steel Grating 4 32 367672043026701612700250031 20Large Steel Frame11122511012204316726026 21Vehicle000000000000004120 22Tree00000000000000000021630017666566583520221816971133366338422581062171725567591136137138139140141142143144145146147148149150151152153 1Rebar 157 014614104579 2 2 18600000000 2Gas Cylinder2211126300 0 1800000000 3Drum, Tank40315185830 0 5600000000 4Utility Pole000000000000000000 5Cable Reel00401021100 0 8400000000 63" Pipe 0 3360000 411 6 6 317500000000 76" Pipe000 1900000000000000 812" Pipe000600088000000000 9Metal Storage Bin42624197031 1 23300000000 10Concrete Masonry Unit0001510250400000000000 11Wood Beam 350215516000000000000 12Wood Plank 166 0176748653011000000000 13Me tal Siding508262922171178193 01111 0258156456413981584482632632 147/8" Plywood Sheet 225 0 15 04954813 1 1 15800000000 15Wide Flange (W14x26)4424112912822088000000000 16Channel Section (6 x 13)9251205830745621010000000000 17Small Equipment 7 17 4211321118 8 25200000000 18Large Equipment94080043 3 15800000000 19Steel Grating9445914711175 2 2 336200000000 20Large Steel Frame5012 263100900000000 21Vehicle 1200700000000000000 22Tree1000000000000000001280702194612511752975661617691258156456413981584482632632154155156157158159160161TOTAL 1Rebar00 4000000 17096 2Gas Cylinder00 1100000 300 3Drum, Tank00100000 1187 4Utility Pole000000000 5Cable Reel00000000 530 63" Pipe00 39800000 4345 76" Pipe00000000 177 812" Pipe00000000 78 9Metal Storage Bin00 2200000 3128 10Concrete Masonry Unit00000000 16723 11Wood Beam00000000 3797 12Wood Plank00000000 18398 13Metal Siding63263223548263263263263233268 147/8" Plywood Sheet00 1400000 4795 15Wide Flange (W14x26)00 140000 0 2893 16Ch annel Section (6 x 13)00 21600000 4337 17Small Equipment00 7800000 1558 18Large Equipment00 1400000 507 19Steel Grating00 16600000 7883 20Large Steel Frame00200000 634 21Vehicle00000000 33 22Tree0000000016326321211482632632632632121668SubsetMissile DescriptionMissile Source Structure NumberTotal MissilesSubsetMissile DescriptionMissile Source Structure NumberTotal MissilesTotal MissilesSubsetMissile DescriptionMissile Source Structure NumberTotal MissilesSubsetMissile DescriptionMissile Source Structure Number U.S. Nuclear Regulatory Commission Page 77 of 108 Serial RA-18-0178 Enclosure Approach to determine wind missile damage to individual SSCs:

A simplified method for missile fragility analysis was developed that used plant specific data inputs into a multivariate model derived from previous TORMIS analysis of other plants.

Missile hit and damage data from two previous TORMIS analyses of nuclear power plants was used to develop a multivariate statistical model to estimate wind missile hit and damage for the BNP SSCs. This model was developed from a statistical analysis of existing TORMIS inputs and results and was focused on identifying the site

-specific parameters that best explain missile hit and damage probability at any given nuclear power plant. The data analyzed included 117 SSCs at five different tornado intensities (EF scale levels) for a total of 585 observations.

The statistical analysis resulted in identifying a simple logistic model that estimated tornado missile impact probability from four site-specific parameters which include:

1. Exposed Target Area (A T). This is defined as the sum of the surface area in square feet for all target surfaces exposed to wind missiles. For example, a hypothetical 1 foot cube target sitting on the ground in the open would have an exposed area of 5 ft 2 (bottom of cube not exposed). If the same cube backs up to a concrete wall (i.e. the wall protects one side of the cube) the exposed area would be 4 ft 2, and so on.

2. Missiles within 300 feet of target, considering quadratic blockage (Mq 300). This is a simplified way to consider missile proximity and blockage from intervening structures in the calculation of missile population.

Mq 300 is determined with the following equation:

=(1+) Where M i is the number of missiles associated with missile source i , n is the total number of missile sources (zones and structures) whose centroid is within 300 feet of the subject target, and B i is a number between 0 and 3 representing missile blockage provided by intervening structures. Blockage between each missile source and a given target (B i) is considered to be 0 if missiles from missile source i have a direct line of site to the target. Values of 1 to 3 are used to represent increasing blockage provided by intervening structures.

Note that the number of missiles between 300 to 750 feet from targets, and more than 700 feet from targets were considered in the statistical analysis, but were not ultimately selected as part of the best fit model. It is important to note, however, that the TORMIS results used to develop the statistical model do include missiles located more than 300 feet from the targets. As such, the results produced by the statistical model inherently include the risk contribution from these missiles despite not being included as separate fitting parameters in the model.

3. Wind Speed (W i). The peak gust wind speed in mph at 10 m above grade

4. Target Centroid Height (T h). The height of the centroid of the target in feet.

The logistic form of the regression model provides for proper bounding of the conditional probabilities between 0 and 1. For this model, the overall r 2 for all the data is 73% in the logistic fitting space and 64% in the conditional probability space. These values mean that about 60% of the variance in missile hit probability is explai ned by the model discussed above. The mean square error of the estimator is 2.19. This value is used to estimate the confidence in the model and estimate the 5 th and 95 th percentile missile fragilities.

U.S. Nuclear Regulatory Commission Page 79 of 108 Serial RA-18-0178 Enclosure Figure 7. Estimated Mean Conditional Tornado Missile Hit Probabilities by EF Scale Damage Given Missile Hit.

Missile hit may not always damage an SSC (result in loss of function). The BNP target list includes several targets with some inherent degree of resistance to missile impact. For example, missile impacts that do not perforate the CST are not expected to produce damage (i.e. produce loss of water inventory or otherwise prevent suction from tank). For such targets, we have separately analyzed data from previous TORMIS analyses to develop a conditional probability perforation function for steel

-plated targets. This analysis was limited to perforation given missile hit and was done on TORMIS outputs, after aggregation over all EF scales. Hence, the conditional perforation probability is applied to the final missile hit probability (produced after aggregation over all wind speeds from the wind hazard curve).

A logistic regression model was used to fit the steel perforation data for various thicknesses of steel from previous TORMIS analyses that are shown in Figure 4. 1.E-021.E-011.E+00123456789101112131415Conditional Probability of Missile Hit Target NumberMean Conditional Probability of Missile Hit by Tornado IntensityEF5EF4EF3EF2EF1

U.S. Nuclear Regulatory Commission Page 81 of 108 Serial RA-18-0178 Enclosure PRA RAI 15 - External Flood PRA Walkdowns:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA

-Sa-2009. Several SRs in Parts 7 (e.g. SR WFR

-A1 and WPR-A10) and 8 (e.g. SR XFFR

-A1, XFPR-A10, and XFPR

-B1) of the 2009 ASME/ANS PRA Standard discuss the use of walkdowns in the development of the HW and XF PRAs.

Discuss the walkdowns performed to support the XF PRA including (i) composition of the walkdown team, (ii) approach taken to perform the walkdown citing any relevant guidance that was followed, (iii) whether any areas that could be impacted were not included in the walkdown based on flood protection features or barriers, and (iv) the salient results of the walkdown and their incorporation into the XF PRA.

Duke Energy Response to PRA RAI 15: Walkdowns were performed for the BSEP XF PRA. These walkdowns are documented in a BSEP PRA calculation. The general purpose of the walkdown was to collect data on:

Flooding sources Impact of dependencies Critical flooding depths that when reached would fail PRA equipment Mitigating systems and their dewatering capabilities Water propagation and flow paths Critical water levels for ingress into buildings The walkdown was performed by a Civil/Structural System Engineer from the BNP Plant Staff and a PRA Engineer from the Corporate Staff. The buildings chosen for the walkdown were buildings that had the potential for vulnerabilities that could fail PRA equipment due to external flooding. Areas of the plant that were included in the walkdowns are the reactor building, Diesel Generator Building/Fuel Oil Tank Chamber (FOTC), service water building, water treatment building, turbine building, control building, radwaste building (includes SAMA DGs), circulating water intake structure, and the switchyard. No areas were excluded from the walkdown based on flood protection features or barriers. Items specifically called out to be observed during the walkdowns wer e: Access doors (personal and equipment)

Roll-up doors Ventilation (exposed louvres/ exhausts)

Drains Sumps/sump pumps Curbs Sills MCCs (location/how high off the floor/enclosed?), electrical buses, transformers, electrical cabinets, and electrically operated large motors.

Equipment at 20 ft elevation and lower Potential for water load on roofs

U.S. Nuclear Regulatory Commission Page 82 of 108 Serial RA-18-0178 Enclosure Potential for failure of structure or components due to large debris related to external flooding The detailed results of the walkdowns are documented in the walkdown note sheets contained in a BSEP PRA calculation. The walkdown results were used to support the following XF PRA tasks: 1. External Flood Fragility Analysis: This task involves determining the flood conditions that can result in failure of safety and non-safety equipment modeled in the PRA.

2. External Flood Screening: External flood screening was done based on information gained during the walkdowns.

3. External Flood Human Reliability Actions: The determination of operator action feasibility was based on walkdown observations that identified vulnerabilities associated with the ability to execute a HRA due to a 20 ft or a 23 ft still water level flood.

PRA RAI 16 - Sufficient External Flooding Data Points to Capture Spectrum of Plant Response:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA

-Sa-2009. SR XFPR

-B1 of the 2009 ASME/ANS PRA Standard calls for the assessment of accident sequences that are initiated by external flooding. Accident sequences in XF PRA models that are initiated by external flooding can vary depending on the flood elevation and the corresponding impact of SSCs and actions.

Describe how sufficient data points for the external flooding hazard were determined to capture the plant response at different flooding elevations.

Duke Energy Response to PRA RAI 16: The external flood probabilistic risk assessment (XF PRA) mainly relies on information gathered from walkdowns to determine the elevations at which flood damage could impinge on structures , systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The elevation of 20 ft above National Geodetic Vertical Datum of 1929 (NGVD 29), which is the finished floor elevation of the reactor building, is selected as the key elevation beyond which external flooding impacts on core damage frequency (CDF) and large early release frequency (LERF) become significant. In particular:

For external flooding events below 20 ft elevation, the potential for SSCs credited in the XF PRA to be damaged by water is minimal, given the fact that safety

-related buildings (i.e., Reactor Building Unit 1, Reactor Building Unit 2, Diesel Generator Building, Service Water Intake Structure, and Control Building) are water proofed to an elevation of 22 ft elevation to provide external flood protection. Given the available design margin, leakage from seal penetrations in the rattle space to the Reactor Buildings is not expected to significantly impact the plant risk. The main risk impact comes from a loss of offsite power, caused by hurricane high winds, which is the concurrent hazard expected with the external flooding event. The loss

-of-offsite power risk contribution in this situation is already accounted for in the internal events PRA and high

-winds PRA.

U.S. Nuclear Regulatory Commission Page 83 of 108 Serial RA-18-0178 Enclosure For external flooding events at or above 20 ft elevation, the XF PRA models the flood

-induced impacts on credited SSCs and operator actions to calculate the resulting CDF and LERF. To best represent the plant response, the modeling focuses on impacts between 20 ft and less than 23 ft elevation. 23 ft represents the elevation of the Diesel Generator Building, at which a flooding event has the potential to damage the diesel generators relied upon in the XF PRA to maintain the plant in safe and stable conditions. It is the next key elevation at which the severity of flood

-induced damage to SSCs credited in the XF PRA changes appreciably (cliff

-edge effect).

The mean estimate of the 1E

-05 annual exceedance probability hurricane

-induced water level is 18.5 ft (NGVD 29). The mean estimate of the 2E

-06 annual exceedance probability water level is 20.3 ft (NGVD 29). This latter annual exceedance probability indicates that the CDF for a flood event at or above 20.3 ft is bounded by 2E

-06/yr. Taking into consideration that 1) failure of SSCs are not postulated until the water elevation reaches 20 ft, 2) the next elevation threshold at which a cliff

-edge effect in the plant response (in this case, failure of diesel generators) is at an appreciably higher elevation (23 ft), and 3) the XF PRA conservatively does not credit sandbagging as a flood mitigation feature, it is estimated that the majority of plant risk in response to external flood events occurs at an elevation at and above 20 ft, but below 23ft.

Based on the foregoing discussion, sufficient data points are considered to adequately capture the plant response.

PRA RAI 17 - External Flood and High Winds Key Assumptions and Sources of Uncertainty:

Section 3.3.2, "Assessment of Assumptions and Approximations," of RG 1.200, Revision 2, states "[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision

-making associated with the application." Further, Section 4.2, "Licensee Submittal Documentation," of RG 1.200, Revision 2, states that "[t]hese assessments provide information to the NRC staff in their determination of whether the use of

these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate." RG 1.200, Revision 2, defines the terms "key assumption" and "key source of uncertainty" in Section 3.3.2.

Section 3.2.7 of the Enclosure to the LAR cites certain references for the process of identifying model uncertainties but does not elaborate on the implementation by the licensee. The same section further states that key BSEP PRA model specific assumptions and sources of uncertainty for this application have been identified and dispositioned in Attachment 6 of the Enclosure. Item 9 in Attachment 6 of the Enclosure to the LAR states that the disposition for the uncertainty associated with the initiating event frequency of external events at extreme ranges "will be addressed as individual systems are categorized in this risk

-informed application." The discussion for this item also states that "the Initiating Events for the very rare events is believe[d] to be assigned a frequency higher than actual."

a. Describe the approach used to identify and characterize the "key" assumptions and "key" sources of uncertainty in the licensee's HW and XF PRA models. The description should U.S. Nuclear Regulatory Commission Page 84 of 108 Serial RA-18-0178 Enclosure contain sufficient detail to identify: (i) whether assumptions and sources of uncertainty related to aspects of the hazard, fragility, and plant response analysis were evaluated to determine whether they were "key," and (ii) the criteria for determining whether the modeling assumptions and sources of uncertainty were considered "key."

Duke Energy Response to PRA RAI 17.a.: Assumptions and uncertainties related to the hazard, fragility, and plant response for the high winds PRA were identified based on vendor input and PRA documentation. The assumptions/uncertainties identified for the high winds model include:

1. Hurricane and Straight Wind Hazard Assumptions in the Hurricane Wind Hazard Analysis were identified based on research and development of hurricane wind field and occurrence models, sensitivity analyses, and engineering judgment. The assumptions identified and include:

a. The historical information on hurricanes during the last 100 years are representative of the hurricane wind climate during the life of the plant

b. The hurricane simulation model provides a good representation of the hurricane hazard at the BNP site

2. Tornado Wind Hazard:

Several assumptions are documented in the BSEP HW PRA documentation and industry literature related to tornado missile risk analysis.

The approach used to identify these are based on research and analysis of the tornado database, structural response to tornado wind fields, modeling, sensitivity analyses, and engineering judgment. Some of the major assumptions in tornado hazard development therefore included:

a. Wind speed uncertainties associated with tornado damage intensity scales were estimated with a weighted distribution of the F, F', and EF Scales, which provide a wide range of uncertainties used to compute the derived mean windspeeds.

These uncertainties reflect the subjective approaches inherent in the F and EF damage scales and the assumed windspeeds associated with these scales.

b. The tornado reporting efficiency was developed using a backward averaging approach that resulted in a 30% increase in the number of reported tornadoes in the historical database for the Brunswick sub

-region. c. Tornado occurrences are assumed to be Poisson distributed and the uncertainties in the mean Poisson occurrence rate were estimated and propagated through the mode. d. Uncertainties in the tornado wind field model are as described in EPRI Tornado Risk Analysis reports (NP

-768, NP-769, NP-2005 and academic literature. Tornadoes are simulated with a wide range of sizes (path widths and lengths) intensities (F, F', and EF wind speeds), radius to maximum winds, path directions, and other parameters that reflected the available databases.

Note that Items a, b, and c were modeled with epistemic uncertainties and then fully propagated to develop a derived mean tornado hazard curve and estimated percentiles.

U.S. Nuclear Regulatory Commission Page 85 of 108 Serial RA-18-0178 Enclosure The item d parameters were modeled as random variables in the model with statistical ranges to reflect the natural variations observed in the data regarding tornado wind fields and damage swaths.

3. Missile Fragility Analysis The assumptions of the TORMIS methodology are documented in EPRI Tornado Risk Analysis reports (NP

-768, NP-769, NP-2005. The assumptions/uncertainties specific to the Brunswick analysis include:

a. A statistical model was developed for the Brunswick missile fragilities instead of using TORMIS directly. The statistical model was based on several TORMIS runs for other plants and used some site and target specific inputs from Brunswick. This approach is assumed to provide reasonable estimates of missile fragilities for Brunswick.

b. All potential missiles developed from the Brunswick plant survey are assumed to be minimally restrained.

c. All missile impacts, regardless of missile type or velocity, on the SAMA generators, fire water pumps, and traveling screens are assumed to damage these components and render them inoperable.

d. A steel thickness of 1/4" was assumed for perforation failure of Condensate Storage Tanks and the Fire Water Tank. This thickness is typical for the tops of such tanks, but tank walls are generally comprised of thicker steel at lower levels of the tank.

e. The previous TORMIS analyses used to develop the statistical missile model had a similar overall layout, distribution of missile types, and total number of missile to BNP. In

addition, the methods followed to collect the site

-specific information for all plants were the same. As a result, it was assumed that the missile risk data developed by the statistical model is applicable to BNP.

4. Plant Response Model The assumptions/uncertainties specific to the Brunswick analysis include:

a. All tornado missile hits to a PRA SSC are assumed to result in functional failure.

b. It is assumed that all tornado events and straight winds with F1 and greater peak gust winds at the BNP site will automatically induce a LOOP event.

c. Recoverable losses of offsite power due to high winds and tornados are addressed in the BNP Loss of Offsite Power Analysis. This study does not credit recovery of offsite power due to high winds and tornados.

d. High wind initiating events were determined on the basis of discrete intervals along the mean high wind hazard curve. Full integration of the high wind hazard curve with the fragility curves was not performed.

e. The hazard curves are based on a combination of high wind data and expert opinion.

f. The fragilities for some equipment were quantified on the assumption of mutual independence of the high wind impact. There may be some "state

-of-knowledge" correlation issues that could impact this assumption.

g. A number of High Wind initiators are modeled as direct core damage which may be conservative.

h. An HRA multiplier approach was used to perform the BNP high winds human reliability analysis (HRA).

U.S. Nuclear Regulatory Commission Page 86 of 108 Serial RA-18-0178 Enclosure

i. Condensate Storage Tanks 1

-CST and 2-CST are assumed to be at the 75% fill level or higher. j. The RB Bridge Cranes are assumed to be idle, parked, and have parking locks engaged. k. For most items, capacities are derived from the current design basis loading without credit for design margin (factor Fc3 is set to 1.0). This is a conservative assumption. Higher factors may be justified but would require substantial research and analysis to obtain. l. It is assumed that the operators will not perform any activities outside the protected buildings during the first 30 minutes after a tornado or straight

-wind event and during the first 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of a hurricane event.

m. It is assumed that the operators will know the post

-tornado plant condition within one hour of the tornado initiator.

n. Impacts on operator actions that directly involve establishing/maintaining vessel injection are assumed to be negligible for high winds initiators. These actions will take place immediately after the attempted plant shutdown and the operator's attention will be focused on reactor power. The stress levels will be high already and will dominate in priority; therefore, these actions should not be impacted by the high wind event.

o. Actions that must be performed within 5 minutes and involve reactivity control and injection are of high priority. These actions are performed in the control room and practiced regularly in the simulator and therefore, it is assumed that these actions are not impacted by the high wind initiators.

p. Since containment is a Category 1 building, it is assumed that high wind initiators cannot cause any pipe break inside containment and thus, the loss of coolant accident initiators are excluded from review.

q. BNP equipment that resides in the turbine building are assumed protected from wind hazard to the same extent as the loss of offsite power fragility. Most of the equipment in the turbine building are lost with the loss of offsite power which is much more fragile than the turbine building. Therefore, for equipment inside turbine building no fragility is assessed. r. It is assumed that Circulating Water Pumps are protected at least to the extent that their power source - offsite power - is protected

s. It is assumed that U1 and U2 Turbine Building components are protected at least to the extent that their power source - offsite power - is protected

t. It is assumed that Startup Transformers are protected at least to the extent that their power source - offsite power - is protected

u. It is assumed that Air compressors are protected at least to the extent that their power source - offsite power - is protected

v. Failure of a non

-Class I building/structure due to high wind results in unavailability of all SSCs in that building/structure.

w. High winds of all speed categories result in turbine trip.

The assumptions/uncertainties identified for the BNP external flood model include:

1. Hazard Development The assumptions in this analysis were identified based on research and development of hurricane wind field and storm surge models, sensitivity analyses, and engineering judgment. The assumptions identified include:

U.S. Nuclear Regulatory Commission Page 87 of 108 Serial RA-18-0178 Enclosure

a. The historical information on hurricanes during the last 100 years are representative of the hurricane wind climate during the life of the plant

b. The hurricane simulation model provides a good representation of the hurricane hazard at the Brunswick NPP site

c. Approximately 20 years of data is sufficient to develop mean centered statistical models for the radius to maximum wind and the Holland b parameter

d. 500,000 years of storms were produced and hence a key assumption was that this number of years was sufficient for Duke Energy's purpose in using this data.

e. The top 100 storm surges derived from SLOSH are the same as those that would be obtained if a far more resolved model was used instead of SLOSH

f. The ADCIRC

-waves models provide mean centered estimates of the observed water levels g. The coupled ADCIRC and wave models are able to adequately propagate surge and waves overland.

2. Plant Response Model The assumptions/uncertainties specific to the BNP analysis include:

a. Doors that do not have design in

-leakage limits associated with them are identified and conservatively assumed to be ineffective at preventing flow of flood waters.

b. Doors that did have design in

-leakage associated with them were assumed to have the in-leakage limits from section 3.4.1.1.1 of the BNP UFSAR.

c. The potential for flooding through storm proof louvres, HVAC ducts, blow out panels and roof hatches was assumed to have a relatively small contribution to flood sources compared to the contribution of personnel doorways, roll

-up doors, and track doors.

d. The following ductbanks have no in

-leakage limit associated with them and are therefore assumed to be negligible flood sources:

• Ductbanks (connect to manholes East of the Reactor Buildings Unit 1 and 2) that run through the basement of the DG Building (2 ft elevation).

• Ductbanks (connect to manholes North of the DG Building) that run through the basement of the SW Building (-13 ft elevation)

e. Equipment such as manual valves, check valves, safety valves, heat exchangers, and trainers/filters were assumed to be unaffected by flood damage. MOVs and AOVs where considered failed due to expected failure of its associated trains and components.

f. Unless otherwise noted, motor control centers throughout the plant were assumed to be mounted at least 4 in. above the floor as per UFSAR Section 3.4.2.1. If the flood water level is > 4 in. above the floor, those panels are assumed to be failed.

g. If water accumulates above 5 ft elevation in the DG Building basement, failure of all diesel generators is assumed, as the transformers located in the basement serve as excitation for the diesel generators.

h. The Fuel Oil Tank Chambers (FOTCs) could be breached during a 23 ft still water flood through two personnel doors at the FOTC sheet metal enclosures (at 23 ft elevation). These exterior doors connect to stairs that connect to interior doors. Although there are no in-leakage limits associated with any of these doors, it is safe to assume that there will be a relatively low in

-leakage rate through them.

U.S. Nuclear Regulatory Commission Page 88 of 108 Serial RA-18-0178 Enclosure

i. As the electric fire water pump is located at a critical height of 21'3" in the Waste Treatment Building (WTB), it is conservatively assumed that both 20 ft and 23 ft still water floods will fail this component.

j. As the diesel fire water pump is located at a critical height of 21'3" in the WTB, it is conservatively assumed that both 20 ft and 23 ft still water floods will fail this component.

k. Circulating water intake pumps (CWIPs) are powered by 4kV buses1(2)C/D. Therefore, the CWIPs will be lost with the loss of offsite power (LOOP) assumed for a 20ft still water flood. Moreover, the circulating pump motors are located above elevation 17.5 ft so that the level alarm will trip before the flood reaches the motors. Therefore, the circulating water pumps at the intake are failed for either flood scenario.

l. When considering an extreme coastal flooding event due to hurricanes, it is assumed that the switchyard will fail whenever the water level reaches 20 ft and above. When considering any other external flooding event, the critical height at which the switchyard is assumed lost is at 20'9".

m. Without offsite power, the plant would rely on onsite emergency AC power from the diesel generators. Coolant injection will be provided by the high pressure injection systems from the CST until depletion of the Condensate Storage Tank (CST). It is assumed that the operators will fail to isolate the hotwell makeup line from the CST to terminate loss of CST inventory (OPER

-HWLVLCV is set to 1 in the model).

n. Due to the large degree of uncertainty related to the frequency and duration of the external flooding event associated with the 23ft still water flood, this event probability is set to 0 in the model, while the external flooding event associated with the 20ft still water flood is set to its nominal value. A sensitivity case including the 23ft still water flood is documented in calculation BNP PSA

-094, PSA Model External Flooding Analysis.

Once the above uncertainties were identified, the process of determining which assumptions/uncertainties are key to the application was performed on an ad hoc basis, using engineering judgement. This approach was reviewed against the latest NRC guidance in NUREG-1855 rev. 1, and it was determined that it was not consistent with that NUREG. As such, an evaluation of these uncertainties/assumptions and their treatment with respect to the 10CFR 50.69 application was re

-performed in accordance with the NUREG, as described in the response to RAI

-17.b., below. This re

-assessment, along with the results of the re-assessment for internal events, internal floods and fire discussed in RAI 04.b

., replaces Attachment 6 of the Enclosure to the original LAR.

b. Discuss how each key assumption and key source of uncertainty identified above was dispositioned for this application. If available, provide sensitivity studies that will be used to support the disposition for this application or use a qualitative discussion to justify why different reasonable alternative assumptions would not affect this application.

Duke Energy Response to PRA RAI 17.b.:

The process for identifying sources of uncertainty and assumptions is described in the response to RAI 17.a. above. Based on this, the process to assess the identified uncertainties/assumptions to determine which are key to the application was not consistent with NUREG-1855 rev. 1. Additionally, for those uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria), Stage F (section 8) of NUREG 1855, Rev. 1, provides guidance on justifying the strategy used to address the key uncertainties that contribute to risk metric U.S. Nuclear Regulatory Commission Page 89 of 108 Serial RA-18-0178 Enclosure calculations that challenge application

-specific acceptance guidelines. This process was not originally performed in conformance with the latest revision of the NUREG. As such, an updated assessment was performed, as described below.

Since the ultimate goal in assessing model uncertainty is to determine whether (and the degree to which) the risk metric results challenge or exceed the quantitative acceptance guidelines for the application, due to sources of model uncertainty and related assumptions, the first step in the updated evaluation was to identify the risk metrics used as acceptance guidelines for the 10 CFR 50.69 categorization process. For 10 CFR 50.69 categorization, the acceptance guidelines are threshold values for Fussell

-Vesely (F-V) and Risk Achievement Worth (RAW) for each component (SSC) being categorized, above which the SSC is categorized as high safety significant (HSS), and below which the SSC is categorized as low safety significant (LSS). As described in Step E

-2 of the NUREG, each relevant uncertainty/assumption requires some sort of sensitivity analysis, and each sensitivity performed to evaluate an uncertainty/assumption involves some change to the PRA results. Since any change to the PRA results has the potential to change the F

-V and RAW importance measures for all SSCs, every relevant uncertainty/assumption has the potential to challenge the acceptance guidelines. That is, since RAW and F-V are relative importance measures, any change to any part of the model will generate a new set of cutsets and potentially impact the RAW and F

-V for every SSC. Thus, the only way to evaluate the impact of a sensitivity is to quantify the sensitivity case and compare the F

-V and RAW values for all SSCs against the base case F

-V and RAW values to determine if any exceed the HSS threshold in the sensitivity case that did not previously do so.

However, as stated in Stage F of NUREG-1855 rev. 1 (section 8.1), an appropriate method for dealing with uncertainties and related assumptions that challenge or exceed the acceptance guidelines is to use compensatory measures or performance monitoring requirements. Section 8.5 of the NUREG states that performance monitoring can be used to demonstrate that, "following a change to the design of the plant or operational practices, there has been no degradation in specified aspects of plant performance that are expected to be affected by t he change. This monitoring is an effective strategy when no predictive model has been developed for plant performance in response to a change". Since no predictive model of the increase in unreliability following alternative treatment of LSS SSCs exists, this option is appropriate for 10CFR 50.69. In fact, the example of a performance monitoring approach to address key uncertainties/assumptions given in section 8.5 is the factor of increase sensitivity combined with the performance monitoring process required for 10CFR 50.69 in NEI 00

-04. The NUREG states: One example of such an instance is the impact of the relaxation of special treatment requirements (in accordance with 10 CFR 50.69) on equipment unreliability. No consensus approach to model this cause

-effect relationship has been developed. Therefore, the approach adopted in NEI 00

-04 as endorsed in Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance," [NRC, 2006a] is to:

• Assume a multiplicative factor on the SSC unreliability that represents the effect of the relaxation of special treatment requirements.

• Demonstrate that this degradation in unreliability would have a small impact on risk.

U.S. Nuclear Regulatory Commission Page 90 of 108 Serial RA-18-0178 Enclosure Following acceptance of an application which calls for implementation of a performance monitoring program, such a program would have to be established to demonstrate that the assumed factor of degradation is not exceeded.

The use of the sensitivity study required by section 8.1 of NEI 00

-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. The impact of any key uncertainty or assumption sensitivity would be to potentially cause an SSC to be categorized as HSS when the base PRA analysis showed it to be LSS. The potential impact of categorizing an SSC as LSS rather than HSS is that the SSC could have alternative treatments applied to it and as such, the possibility exists that the reliability of the SSC could be reduced (i.e., the specified aspect of plant performance that is expected to be affected by the change is the reliability of the SSC). Per section 8.1 of NEI 00-04, a sensitivity is performed which assumes the unreliability of all LSS components is increased by a factor of 3 to 5. Since, as discussed in NEI 00

-04, no significant decrease in reliability is expected, this is very conservative. Additionally, since the failure probability of all LSS SSCs are increased at the same time in the sensitivity, this approach addresses all uncertainties/assumptions which could potentially impact the LSS/HSS categorization. The LSS sensitivity then must be shown to demonstrate that even assuming this factor increase, the quantitative guidelines of Reg. Guide 1.174 are not exceeded. Thus, the LSS sensitivity demonstrates that the potential impact of all uncertainties/assumptions is acceptable. Additionally, a performance monitoring program must be established as part of the 10 CFR 50.69 process (per NEI 00

-04 section 12) which will monitor the reliability of all LSS SSCs to ensure that the factor of increase assumed in the sensitivity is not exceeded. This ensures the validity of the sensitivity study following implementation.

It is noted that uncertainties/assumptions which are related to SSCs being excluded from the PRA model, either because they are not believed to be required for accident mitigation or because they perform a backup function to other equipment but were conservatively not credited in the model, may not be adequately addressed by the above sensitivity and performance monitoring program. If an SSC is not in the PRA model, but actually performs (or could perform) an accident mitigation function, and that SSC is categorized as LSS (based on non-PRA criteria) the factor increase sensitivity would not appropriately address the uncertainty associated with this assumption/uncertainty. This is because if there are no failure events in the PRA model for the SSC, the LSS sensitivity study has no events to which to apply the factor of increase. If, contrary to the assumption, the SSC is actually required for accident mitigation and had been included in the model, increasing its failure rate by the factor of increase could have an impact on the sensitivity results with respect to the RG 1.174 limits.

Based on the above discussion, the list of uncertainties and assumptions in item 17.a, above, was reviewed to identify any that are not adequately addressed by the factor increase sensitivity study required by Section 8.1 of NEI 00

-04 and the performance monitoring program required by Section 12 of NEI 00

-04. None of the above uncertainties/assumptions relate to exclusion of SSCs from the model, such that they are all adequately addressed by the factor increase sensitivity study and the performance monitoring program, and no additional sensitivities are required. Again, this re

-assessment, along with the results of the re

-assessment for internal events, internal floods and fire discussed in RAI 04.b

., replaces Attachment 6 of the Enclosure to the original LAR.

U.S. Nuclear Regulatory Commission Page 91 of 108 Serial RA-18-0178 Enclosure

c. Provide clarification on the uncertainty associated with the initiating event frequency of external events at extreme ranges (Item 9 in Attachment 6 of the Enclosure) and describe how that uncertainty is dispositioned "as individual systems are categorized" for licensee's HW and XF PRA models.

Duke Energy Response to PRA RAI 17.c.: As discussed in the response to RAI 17.a. and RAI 17.b. above, Attachment 6 to the Enclosure to the original LAR is replaced by the above re

-assessment.

d. Discuss why the licensee believes that the assigned frequencies are conservative (i.e.,

"higher than actual" as described by the LAR).

Duke Energy Response to PRA RAI 17.d.:

As discussed in the response to RAI 17.a. and RAI 17.b. above, Attachment 6 to the Enclosure to the original LAR is replaced by the above re

-assessment.

PRA RAI 18 - External Flooding PRA Finding Level Facts and Observations:

Section 3.3 of the Enclosure to the LAR states that findings were reviewed and closed using the process documented in Appendix X to NEI 05

-04, NEI 07

-12, and NEI 12

-13, "Close

-out of Facts and Observations" as accepted by the NRC by letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The licensee cites closure of findings for its internal events, internal flood, high winds, and fire PRA models.

a. Clarify whether the process cited above was applied to the licensee's XF PRA and discuss the results therefrom.

Duke Energy Response to PRA RAI 18.a.:

To clarify, two of the four open external flood findings were reviewed by the closure team. The other two findings were not resolved sufficiently to warrant review by the closure team. The closure team had additional questions that the SME's were not available to answer, thus none of the findings were closed. As such, each of the open findings was dispositioned for the 10 CFR 50.69 application.

Attachment 3 of the Enclosure to the LAR provides the open peer review findings and their disposition by the licensee for this application. The following requests for information apply to the XF PRA F&Os and their corresponding resolutions in above mentioned attachment:

b. Finding XFPR

-A11-1, related to SR XFPR

-A11, stated that "there is no evaluation of the potential impact of external floods on system recoveries credited in the Level 1 PRA." The resolution discusses staging of personnel and re

-evaluation of human reliability events and concludes that "changes made are enough to support...the 50.69 application." The discussion does not include sufficient detail to determine how environmental conditions and flood protection failures were incorporated in the determination of HEPs and to support staff's review of the licensee's conclusion. Water, due to in

-leakage from various doors, is expected at various locations and manipulations of electrical equipment under such U.S. Nuclear Regulatory Commission Page 92 of 108 Serial RA-18-0178 Enclosure conditions may prove dangerous or require guidance as well as availability of certain special equipment. Failure of credited flood protection features, such as sump pump(s), drain(s), and floor door(s), could prevent operators from performing their actions. Such considerations are expected to have an impact on the internal events HEPs via either execution time or other relevant performance shaping factors (PSFs).

In light of the above, discuss changes made to the XF PRA to resolve XFPR

-A11-1 including discussion on consideration and inclusion of (i) the impacts of environmental conditions such as the presence or accumulation of water on the staged and unstaged operator actions, (ii) the flood protection or mitigation features credited in the licensee's XF PRA, and (iii) the failures of flood protection or mitigation features that could prevent operators from performing their actions or achieve the desired level of protection.

Duke Energy Response to PRA RAI 18.b.: i. An evaluation of the impact of an external flood on system recoveries was performed as documented in Duke Energy calculation BNP-PSA-094, section 4.3. The criteria for screening were based on walkdown observations that identified vulnerabilities associated with executing an operator action due to a 20 ft or a 23 ft still water level flood. It was also taken into consideration that during extreme hurricane conditions, the station's Sever e Weather procedure recommends pre

-staging approximately three people in the Diesel Generator Building, two in the Service Water Building, and two Engineers in the Control Room if conditions warrant prior to hurricane arrival. The following changes were made to the HRA as a result of the analysis:

1. No credit was taken for crossconnecting the service water discharge headers since the discharge isolation valves are located in a pipe tunnel that would be submerged by the flood. 2. No credit was taken for realigning offsite power to equipment since for an external flood, offsite power is assumed to be lost and not recovered.

It is also noted that no credit is taken for the potential to recover offsite power following its loss due to an external flood since for external events, the repair of damaged switchyard or transmission system components does not generally occur quickly.

ii. Plant design features such as drains, gratings, stairwells, curbs, water

-tight sills, pedestals, sumps, sump pumps, flood doors, penetration seals are all considered in determining the plant's response to an external flood. See Duke's response to RAI 18.c for additional detail.

iii. In general, flood protection features are credited for performing as designed. This is considered a realistic approach given the passive design of many of the features and that plant maintenance programs are in place to keep the features functional. However, flood waters can render mitigation features or equipment unavailable, therefore external flood fragility was considered.

Example external flood fragility assumptions include:

Doors that do not have design in

-leakage limits associated with them are U.S. Nuclear Regulatory Commission Page 93 of 108 Serial RA-18-0178 Enclosure conservatively assumed to be ineffective at preventing flow of flood waters.

Doors with design in

-leakage limits were assigned in

-leakage limits as specified in the Brunswick Updated Final Safety Analysis Report.

Rattle spaces are seismic isolation spaces located between the Turbine Buildings, Reactor Buildings, Control Building and Radwaste Building. These rattle spaces contain sump pumps that have been permanently installed which provide input to Storm Drain System piping. The purpose of these sump pumps is to reduce the water in-leakage through sleeves, piping, and building seals entering the Radwaste, Turbine, and Reactor Buildings through these rattle spaces. However, rattle space sump pumps are powered from normal 120 AC power (non

-emergency power) and are therefore not credited for flood mitigation. Moreover, rattle spaces are expected to be flooded during external flooding events as water will back up into them once the basin water level has risen above 15'6".

Unless otherwise noted, motor control centers throughout the plant were assumed to be mounted at least 4 in. above the floor as per the UFSAR Section 3.4.2.1. If the flood water level is > 4 in. above the floor, those panels are assumed to be failed.

c. Finding XFPR

-A3-1, related to SRs XFPR

-A3, -A5, -A8, and -A10, stated that assurance was needed that external flood

-caused failures were modeled and that a systematic review of potential impacts of external flooding was performed. The resolution discusses documentation changes but does not provide information on the systematic review of the potential impacts of external flooding. External flood doors, internal drains, and sump pumps appear to be relied on to keep equipment from being inundated. It also is unclear whether random or flood induced failures of such features and components are considered in the licensee's XF PRA. Exclusion of such random or flood induced failures of credited flood protection features and components could underestimate the risk of external flooding events. Provide details of the systematic review performed including discussion on (i) the development of the list of SSCs or features required for external flood hazard mitigation, (ii) the selection of SSCs for inclusion in the XF PRA model, and (iii) the consideration of failures of flood protection features such as manually operated doors, water

-tight doors, door seals, penetration seals, conduit seals, internal drainage systems, and sump pumps.

Include discussion on how the licensee's resolution to the F&O addresses all the four SRs against which the finding is cited.

Duke Energy Response to PRA RAI 18.c.: i. Duke Energy calculation BNP-PSA-094, section 3.2 evaluates the impact of two external flood events, the 20 ft and 23 ft floods, on plant SSCs. The evaluation considers flood propagation pathways and plant design features such as door, floor and wall penetrations, stairwells, hatches, drains, grating, curbs, pedestals, walls, sills, sumps, sump pumps, availability of power to sump pumps during flood, drain path backflow check valves, manual isolation valves, permanently installed plugs, equipment critical heights, and resistance of electrical equipment to falling water. Critical flood levels and propagation pathways were determined from information gained during the walkdown and from BNP

-specific references.

The analysis addresses the following buildings:

Reactor Building

U.S. Nuclear Regulatory Commission Page 94 of 108 Serial RA-18-0178 Enclosure Turbine Building Diesel Generator Building/ Fuel Oil Tank Chambers Control Building Service Water Building Radwaste Building ii. BNP-PSA-094, section 4.2 documents additions to the model to reflect the equipment failure impacts due to external floods. The 20' flood fails the switchyard, the electric and diesel firewater pumps, and the circulating water pumps. The 23' flood also fails the emergency diesel generators.

iii. Design features such as drains, gratings, stairwells, curbs, water

-tight sills, pedestals, sumps, sump pumps, flood doors, penetration seals are all considered in determining the plant's response to an external flood. Credit for such features was based on whether or not the feature would be expected to mitigate the flood of interest. For example, for large floods that would exceed sump pump capacity, no credit was taken for the existence of the pump. Similarly, if essential power is not supplied to the pump, it would not be credited. Duke administrative procedure AD

-EG-BNP-1619, Rev. 0, standardizes the methods used to develop, administer, and implement the External Events Protection (EEP) Program at the Brunswick Nuclear Plant, including external floods.

External Events protection features (including external floods) are described in 0BNP-TR-019, Revision 7. This document describes the flood protection features and the Sump Pump and Check Valve Performance for External Flooding Events. Section 4.0 describes the inspection process and Section 5.0 describes the external flood attributes. Flood protection features include, concrete structures, steel structures, penetrations/seals, concrete plugs (exterior side only), Manhole Covers (exterior side only), Piping, Cable Vaults, Tunnels, Electrical Cable Conduit, Floor Hatches (exterior side only), Credited Non-Watertight Doors, and pumps.

The flood protection features implement passive (i.e., Flood Water Intrusion Barriers) and active (i.e., sump pumps and check valves) measures to mitigate external flood events. Since the sump pumps are non-safety, they are not credited in the External Flood PRA. For flood water intrusion, the items required to protect the equipment include intact walls, low leakage doors, below grade penetration seals, conduit seals, and other below grade seals. The station maintains a list of flood protection features associated with this category and the associated PMs.

Engineering Change 410845, Rev. 0, Attachment C, External Flood Protection Feature Sampling Plan, is used every refueling cycle to perform inspections of all passive flood protection features listed in Attachment 1 of 0BNP

-TR-019. This excludes all manhole covers, active flood protection features (i.e. check valves, sump pumps, etc.) and temporary passive flood protection features (cliff edge barriers) which are inspected via different PMs.

Manhole penetration seals are evaluated BNP

-178099-RP01, Rev. 0. All safety

-related buildings (Reactor Building Unit 1, Reactor Building Unit 2, Diesel Generator Building, Service Water Intake Structure, and Control Building) were originally water proofed to 22

-

U.S. Nuclear Regulatory Commission Page 95 of 108 Serial RA-18-0178 Enclosure foot MSL to provide external flood protection. Brunswick Nuclear Plant uses a system of underground manholes and duct banks to route electrical conduits to the wall penetrations in the buildings. In Class I safety related buildings, the manholes are classified as safety

-related. The rattle space penetration seals are inspected part of EC287907, Rev. 3, and have been upgraded to an external flood level of 26.1 feet. Vendor Manual FP

-82632, Rev. E, indicates that penetration seals used in the rattle space, are designed for a hydrostatic pressure of 40 feet of head, or 20 psig. This translates to an external flood level that exceeds 26.1 feet.

The resolution to Finding XFPR

-A3-1 F&O addressed all four SRs against which the finding was written, as summarized below.

PRA Standard Supporting Requirement Action Taken to Address Finding XFPR

-A3-1 XFPR-A3 Evaluations of the potential external flooding impact on operator actions and equipment were performed. Human error probabilities for actions that were determined to be not feasible were set to 'TRUE' in the hazard's flag file.

XFPR-A5 Operator stress would be considered high. However, the external flood evaluation is based on a flooding hazard due to a hurricane that would not occur without warning many hours before the event, and HRA actions can be taken following trained procedure actions. Therefore, external flood HRA stress multipliers were not used to increase the human error probabilities.

XFPR-A8 N/A; no screening of human failure events was performed.

XFPR-A10 External flood impact on operator action probabilities was evaluated. It was also taken into consideration that during extreme hurricane conditions, the station's Severe Weather procedure recommends staging approximately three people in the Diesel Generator Building, two in the Service Water Building, and two Engineers in the Control Room if conditions warrant prior to hurricane arrival.

d. Finding XFPR

-A7-1, related to SR XFPR

-A7, called for the performance of an analysis of external hazard caused dependencies and correlations. The resolution states that the external flooding analysis does not model dependencies and correlations of equipment failure other than the effects from inundation and that the analysis has equipment failure correlated due to submergence. The resolution also cites inspections performed on the trash racks for debris accumulation. The note accompanying SR XFPR

-A7 in the 2009 ASME/ANS PRA Standard indicates that it is vital to capture spatial and environmental dependencies among external flood caused failures and further states that external floods can affect multiple SSCs or a combination of SSCs at the same time. Further, Section 8

-1.3 of the 2009 ASME/ANS PRA Standard mentions the importance of considering "rational probabilistic

-based combinations" of external flooding phenomena. The resolution does not provide sufficient information to determine whether dependencies have been appropriately considered and included in the XF PRA model.

U.S. Nuclear Regulatory Commission Page 96 of 108 Serial RA-18-0178 Enclosure

i. Provide details on and results from the approach used to identify, capture, or screen spatial and environmental dependencies that can affect multiple SSCs or a combination of SSCs in the XF PRA model.

ii. Discuss the approach used to consider probabilistic-based combinations of external flooding phenomena (e.g., wind driven LIP and wind driven storm surge) and their inclusion in the XF PRA model. Address any inconsistencies in modeling the failure of SSCs such as the Severe Accident Mitigation Alternatives (SAMA) diesel generator and the emergency diesel generator (EDG) exhaust between the licensee's XF and HW PRA models that are related to such combination of phenomena.

Duke Energy Response to PRA RAI 18.d.: i. Duke Energy calculation BNP-PSA-094, section 4.7, provides analysis of dependencies associated with external flooding events. This section considers:

Water crossing the plant grade Interference with the Service Water Discharge due to water crossing the plant grade Intake structure clogging due to debris Storm Drain Collector Basin (SDCB) backflow.

For convenience, information from section 4.7 is repeated below.

4.7.1 Water Crossing Plant Grade Plant grade is approximately elevation 19.5 ft MSL. To ensure that operators are alerted to a rising water level in the intake canal, a level indicator was provided with the sensor installed in the Class I service water intake structure and the recording indicator in the control room. The level indicator will provide an alarm in the control room when the water in the intake canal reaches elevation 14.5 ft MSL. When the alarm annunciates in the control room, an evaluation will be made whether or not to shut down the plant. The evaluation will include determining whether the flood has crested and the expected duration and intensity of the hurricane.

4.7.2 Interference with SW discharge due to Water Crossing Plant Grade The SWS takes water from the intake canal and discharges it to the discharge canal. The TBCCW, RBCCW, and the SWS all discharge water to the same location in the discharge canal. At the time of high water (23 ft MSL), the site is virtually underwater. The top of the discharge canal at 18 ft MSL will be underwater. The SWS pumps would need to discharge to a height of 23 ft. The head of the SWS pumps is about 250 ft. Normal levels in the discharge canal are about 10 ft. The addition of 10

-15 ft of head to the discharge of the SWS pumps would not be expected to have a significant change on the pump performance. Therefore, interference with SW discharge due to water traversing across the site is not a concern.

U.S. Nuclear Regulatory Commission Page 97 of 108 Serial RA-18-0178 Enclosure 4.7.3 Intake Structure Clogging due to Debris A major source of debris that affect intake structures are storm

-generated debris, such as weeds, grass, and kelp that enter the intake structure because of high winds, high tides, wave action, or run

-off from rivers and streams. Hurricanes or other significant rainfall events can dump large amounts of rain in the Cape Fear River basin which forces the salt wedge, which is normally located near Wilmington, downstream toward the intake canal. This action forces the marine life in the area to move down with the salt wedge in large numbers.

However, the fact that the plant will not be at 100% power during severe weather conditions would minimize the amount of debris being sucked into the canal and subsequently to the intake structure as the circulating water pumps would not be at full power. Moreover, as part of storm preparation procedures, inspection is done on the trash racks at the intake and diversion structures for accumulation of trash/debris on the racks.

4.7.4 Storm Drain Collector Basin (SDCB) Backflow The Storm Drain Collector Basin (SDCB), located northwest of the Turbine Building, is a concrete structure designed to collect gravity drainage of underground piping. Drainage collection consists of an underground network of concrete and cast iron storm piping of various sizes, non

-contaminated building floor drains, building roof and building rattle spaces drainage piping. The underground pipes are laid with approximately 1/8

-inch slope per 1 linear foot run so that gravity supplies the motive force for drainage. Surface drainage, run

-off after rains, and neutral nonradioactive wastes are collected by this system. Once the storm drainage has collected in the SDCB, pumps are provided to empty the contents of the basin into the stabilization pond via a monitoring station. During severe inclement weather however, the overflow from the SDCB is directed to the discharge canal, bypassing the stabilization pond through two in

-line overflow valves. One valve is the overflow isolation valve and the other is the overflow control valve. An indication that the operation of these valves may be required is the need to prevent the basin level from reaching 15'- 6". These valves may be manually opened to prevent water from backing up in the storm drainage header piping. However, in the event of a still water level flood of 20 ft or above, water will back up in the plant storm drains. When this occurs, an immediate influx into the plant radiologically controlled areas occurs though cable vaults, drains, manholes and rattles paces, adding to the demand on the radwaste processing system. Impact of water backflow into buildings was addressed in Section 3.2.

ii. Simultaneous consideration of high winds and external flooding was included in the analysis. High winds could produce a storm surge flood and could spatially impact offsite power, fire water system pumps and storage tank, the EDGs, and back

-up DC power.

The modeling of the failure of SSCs such as the Severe Accident Mitigation Alternatives (SAMA) diesel generator and the emergency diesel generator (EDG) exhaust between the BNP XF and HW PRA models is consistent. The same fragility parameters are used for these components in the XF and HW analyses. However, in the XF model, the high wind drives a storm surge that leads to failure of these components by inundation. In the HW model, failure of the components is tied more directly to component fragility.

U.S. Nuclear Regulatory Commission Page 98 of 108 Serial RA-18-0178 Enclosure

e. Finding XFPR

-C2-1, related to SR XFPR

-C2, stated that the documentation of the specific adaptions to the internal events PRA to produce the XF PRA was not performed. Since the documentation was unavailable at the time of the peer review, it appears that the peer reviewers did not have information necessary to determine whether the adaption of the internal events model was performed appropriately. Provide details of and basis for the specific adaptions that were made to the internal events model to develop the XF PRA.

Duke Energy Response to PRA RAI 18.e.:

Duke Energy calculation BNP-PSA-094, section 4.2, documents additions to the model to reflect the equipment failure impacts due to external floods. The 20' flood fails the switchyard, the electric and diesel firewater pumps, and the circulating water pumps. The 23' flood also fails the emergency diesel generator. Tables 4.2.1 and 4.2.2 identify changes to the internal events model for external flood for Units 1 and 2, respectively. Table 4.2.1 is repeated below for convenience. Table 4.2.2 is analogous.

Table 4.2.1

- Additions to Internal Event Models Unit 1 Direct Gate Direct Gate Description Parent Gate Parent Gate Description ACP_TE_EXTFLOOD

-L External Flood (23ft) Induced Loss of Offsite Power ACP_TE_S Site Loss of Offsite Power CWS-G10-PMPA CW Pump A run failures CWS-G10-PMPB CW Pump B run failures CWS-G10-PMPC CW Pump C run failures CWS-G10-PMPD CW Pump D run failures FPS-GEDP-PUMP Diesel Driven Fire Pump Train

- Pump Failures FPS-GMDP-PUMP Motor Driven Fire Pump Train

- Pump Failures SWS-+1FW-RHR Firewater to RHR injection using SW EDG-$1003 Failure of Emergency Diesel Generator 1 to Run EDG-$2003 Failure of Emergency Diesel Generator 1 to Run EDG-$3003 Failure of Emergency Diesel Generator 1 to Run EDG-$4003 Failure of Emergency Diesel Generator 1 to Run EDG-+1003 FAILURE OF EMERGENCY DIESEL GENERATOR 1 TO RUN EDG-+2003 FAILURE OF EMERGENCY DIESEL GENERATOR 2 TO RUN EDG-+3003 FAILURE OF EMERGENCY DIESEL GENERATOR 3 TO RUN

U.S. Nuclear Regulatory Commission Page 99 of 108 Serial RA-18-0178 Enclosure PRA RAI 19 - High Winds PRA Initiating Event Identification:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA

-Sa-2009. SR WPR

-A1 of the 2009 ASME/ANS PRA Standard calls for the inclusion of initiating events caused by high wind hazards that give rise to significant accident or accident progression sequences using a systematic process. The note accompanying the cited SR indicates the importance of thoroughly investigating site

-specific wind

-caused failure events including multiple

-unit impacts and dependencies.

Describe the systematic process that was followed to determine the initiating events from the internal events model that would be included in the licensee's HW PRA. Include discussion on consideration of SSC failures that can result in initiators, spatial and environmental dependencies, multiple

-unit impacts, and feedback from plant walkdowns as well as the outcome of the process.

Duke Energy Response to PRA RAI 19:

The BNP internal events model initiating events were systematically reviewed for potential impact from the high wind hazards. Some internal event initiators cannot be induced by a high wind event. For example, since containment is a Category 1 building, it is assumed that high wind initiators cannot cause any pipe break inside containment. Thus, the loss of coolant accident initiators are not modeled for high winds.

EDG-+4003 FAILURE OF EMERGENCY DIESEL GENERATOR 4 TO RUN EDG-G1003 FAILURE OF EMERGENCY DIESEL GENERATOR 1 TO RUN EDG-G2003 FAILURE OF EMERGENCY DIESEL GENERATOR 2 TO RUN EDG-G3003 FAILURE OF EMERGENCY DIESEL GENERATOR 3 TO RUN EDG-G4003 FAILURE OF EMERGENCY DIESEL GENERATOR 4 TO RUN ACP_TE_EXTFLOOD

-S Small External Flood (20ft) Induced Loss of Offsite Power ACP_TE_S Site Loss of Offsite Power CWS-G10-PMPA CW Pump A run failures CWS-G10-PMPB CW Pump B run failures CWS-G10-PMPC CW Pump C run failures CWS-G10-PMPD CW Pump D run failures FPS-GEDP-PUMP Diesel Driven Fire Pump Train

- Pump Failures FPS-GMDP-PUMP Motor Driven Fire Pump Train

- Pump Failures SWS-+1FW-RHR Firewater to RHR injection using SW U.S. Nuclear Regulatory Commission Page 100 of 108 Serial RA-18-0178 Enclosure Plant-specific high wind hazard curves were developed to quantify high wind initiating event frequencies for the BNP high wind PRA model. The high wind initiating event frequencies were determined on the basis of discrete intervals along the mean high wind hazard curve. An evaluation of high wind functional impacts was performed and the induced initiating events identified. For example, failure of the switchyard relay house was identified and modeled as a wind-induced loss of offsite power initiating event to both units.

During the determination of fragilities and initiating events both spatial and environmental dependencies and multi-unit impacts were considered. High wind walkdowns were performed to independently evaluate the findings of the high wind IPEEE and collect additional data. The walkdowns were utilized to support the PRA model inputs, high wind missile counts, and data utilized in the fragility analysis. Walkdown observations were later compared to plant design documentation. This provided a check of consistency between as

-built conditions and the plant design basis documents. The walkdown team also searched for potential high wind interaction hazards.

PRA RAI 20 - Propagation of Changes in the Base Internal Events PRA to the High Winds and External Flooding PRAs:

According to Sections 7

-1.2 and 8-1.2 of the 2009 ASME/ANS PRA Standard it is assumed that a full-scope internal

-events at-power Level 1, and Level 2 LERF, PRAs exist and that those PRAs are used as the basis for the HW and XF PRA. Therefore, the acceptability of the internal events PRA model used as the foundation for the XF and HW PRAs is an important consideration. Section 3.3 of the Enclosure to the LAR states that the internal events findings were reviewed and closed using the process documented in Appendix X to NEI 05

-04, NEI 07

-12, and NEI 12

-13. However, the LAR does not provide information about the propagation of changes made to the internal events model for closing the finding level F&Os to the XF and HW PRAs. a. Clarify whether changes made to the internal events model to resolve the corresponding finding level F&Os have been implemented in the XF and HW PRAs or justify not implementing the changes in the context on this application.

Duke Energy Response to PRA RAI 20.a.:

The changes made to the internal events model to resolve finding level F&Os are documented in Attachment 8, of BNP

-PSA-068, BNP-PSA Model Peer Review F&O Resolutions. Modifications to the PRA models are performed in accordance with Duke procedures and processes. All model changes documented in Attachment 8 of BNP

-PSA-068 were reviewed and it was determined that any finding level resolution implemented in the Internal Events model are captured in the PRA Tracking database in order to ensure implementation into other models as applicable. The PRA Tracking database is the tool used by Duke Energy PRA practitioners to maintain model configuration control. Those applicable Tracking Items are listed below.

A review of Appendix D (2010 F&O Responses) of BNP-PSA-068, BNP-PSA Model Peer Review F&O Resolutions, discovered no changes to the Internal Events model (other than the addition of FLEX) that would impact the External Flooding or High Winds PRA models.

U.S. Nuclear Regulatory Commission Page 101 of 108 Serial RA-18-0178 Enclosure PRA Tracker Item # B 0010 is written for the next model update of the External Flood and/or High Winds PRA to include addition of the FLEX equipment as done in the Internal Events Model. Not taking credit for FLEX is conservative and is not expected to have a negative risk impact on the model or an impact on the 50.69 LAR Submittal.

PRA Tracker Item # B 0030 has been written to incorporate model changes for HW PRA from Peer Review F&O resolutions into the BNP Model of Record. This item has been documented as LOW risk in the PRA Tracker database and there is negligible risk impact expected for this application. This action is not expected to have a significant risk impact on the model or an impact on the 50.69 LAR Submittal.

PRA Tracker Item # B 0014 has been written to incorporate data updates from the internal events PRA model into the HW and XF PRA models. This item has been documented as LOW risk in the PRA Tracker database and there is negligible risk impact expected for this application. Additionally, the Peer Review team stated that there is little risk increase expected from these data updates for the internal events. It is reasonable to project this assumption to have little impact on the risk increase of the HWs and/or XF PRA models. This action is not expected to have a significant risk impact on the PRA models or an impact on the 50.69 LAR Submittal. Expected to be bounded by the required 50.69 sensitivity exercises.

b. Clarify and address any human actions or SSC functions credited in the internal events model that may have been included in the XF PRA but are incompatible with assumptions in the XF PRA. Examples include credit for control rod drive (CRD) injection and sump pumps, both of which rely on offsite power.

Duke Energy Response to PRA RAI 20.b.: External Flooding Human Reliability Analysis Table 4.3 and section 4.3 of Duke Energy calculation BNP-PSA-094, PSA Model External Flooding Analysis, discusses the internal events HRA's and those evaluated for the external flooding hazard as well as any applied credit. The criteria for screening were based on walkdown observations that identified vulnerabilities associated with not executing a HRA due to a 20 ft. or a 23 ft. still water level flood. It was also taken into consideration that during extreme hurricane conditions it is recommended pre

-staging approximately three people in the Diesel Generator building, two in the Service Water Building, and two Engineers in the Control Room prior to hurricane arrival. Although a recommendation, this action was actually put into practice in September 2018. The step remains a "recommendation" in order to allow flexibility in operations to dictate the need based on severity of circumstances.

Human reliability actions that were not feasible (OPER

-SWDISCHX and OPER

-RESOSP) were set to 'TRUE' (guaranteed to fail) in the Flag File. There are no additional penalties applied through the performance shaping factors. All applicable HRA actions are assessed for feasibility under the given environmental conditions.

U.S. Nuclear Regulatory Commission Page 102 of 108 Serial RA-18-0178 Enclosure Assumptions of SSCs credited in the Internal Events The assumptions identified in the internal events, as captured in BNP

-PSA-003, Revision 5, Ground Rules & Assumptions, were reviewed for applicability to the External Flooding PRA model. Any assumptions that were identified as cascading into the External Flood PRA are appropriately modeled or would be bound by any sensitivity analysis conducted in the normal 50.69 sensitivity process.

The noted power sources that are necessary and credited for mitigation in the External Flood model are appropriately powered from emergency sources (i.e. CRD injection pumps).

- The CRD pumps and ECCS room sump pumps are powered from emergency bus power and would then be available after the LOOP. CRD Pumps are powered from the Emergency Buses (E1 through E4; see BNP Electrical Power Distribution System drawing). ECCS room sump pumps are powered from 480V substations fed from the Emergency Buses (E1 through E4; see 0OP

-50.1 and BNP Electrical Power Distribution System drawing).

- Per review of BNP

-PSA-094, PSA Model External Flooding Analysis, the Fire Water Pumps are not credited in the External Flooding analysis. Table 3.3 of Duke Energy calculation BNP-PSA-094 provides a list of Plant SSCs that are vulnerable to the flooding hazard as well as a reason for their external flood fragility.

Passive components, such as buildings, doors, and penetrations, that were not explicitly listed in the Internal Events PRA were assessed directly for the external flooding hazard.

PRA RAI 21 - Inclusion of New Site

-Specific Hazard and Plant Change Information in External Flooding and High Winds PRAs:

Section 3.2.6 of the Enclosure to the LAR describes the licensee's PRA maintenance and update process and states that the process includes provisions for monitoring potential areas affecting the PRA models and for assessing the risk impact of unincorporated changes. Further, the licensee states that the assessment of the impact of the changes will be performed no longer than once every two refueling outages. The licensee's HW and XF PRAs use site

-

specific hazard information that can change during the implementation of the 10 CFR 50.69 program. The discussion of the licensee's PRA maintenance and update process does not include information about the consideration and inclusion of changes to the site

-specific hazard information (e.g., occurrence frequencies).

a. Discuss how new information about the high winds and external flooding hazard will be identified, evaluated, and incorporated in the licensee's HW and XF PRAs that support this application during the implementation of the 10 CFR 50.69 program.

Duke Energy Response to PRA RAI 21.a.: Model updates are performed periodically to ensure the models appropriately reflect the as

-built, as-operated plant.

U.S. Nuclear Regulatory Commission Page 103 of 108 Serial RA-18-0178 Enclosure Duke Energy's PRA Maintenance and Update process includes a step to consider changes in external events hazards when completing a model update.

This process would consider both changes to the plant

-specific hazard inputs (e.g. topographical changes that might impact flood runup) and changes to the generic hazard frequencies and hazard strength data. However, for the latter, significant changes are not expected as the hazard development included a significant dataset. Additionally, any new industry guidance on hazard development methodology will be considered as specifically required by the Duke Energy PRA Maintenance and Update procedures.

b. Discuss how plant changes will be evaluated for their impact on the licensee's HW and XF PRAs that support this application and subsequently incorporated in those PRAs during the implementation of the 10 CFR 50.69 program. Discuss whether the appropriate modeling inputs for the plants changes (e.g., high wind fragility) will be evaluated for inclusion in the XF and HW PRAs.

Duke Energy Response to PRA RAI 21.b.:

Section 12 of NEI 00

-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated.

Additionally, the Duke Energy PRA model update procedures require periodic model updates. These procedures specifically address initiatives from industry insights with respect to changes in PRA technology that could change the PRA results, and changes in external event factors, as well as physical plant changes. Following a PRA model update, the procedures require that PRA applications, including 10 CFR 50.69 be reviewed to assess the impact of the model change on the application. This would address any plant changes as well as other modeling inputs. PRA RAI 22 - Importance Measure Calculation and Categorization of Non

-Aligned Components:

The categorization of SSCs using the licensee's HW and XF PRA models is expected to be based on importance measures and corresponding numerical criteria as described in Sections 5.1 and 5.3 of NEI 00-04. 10 CFR 50.69(c) provides requirements for the categorization process including determination of SSC functional importance. 10 CFR 50.69(1)(ii) states that

"[t]he functions to be identified and considered include design bases functions and functions credited for mitigation and prevention of severe accidents." The discussion on "other external risks" in Section 1.5 of NEI 00

-04 includes an example of the inclusion of importance measures arising specifically from the impact of an external hazard in the categorization process. Further, the discussion of integral importance measures in the same section states that "[e]ach risk contributor is initially evaluated separately...". Section 5.4 of NEI 00

-04, while discussing the importance measure calculation for "other external hazards", states that "the risk importance process is slightly modified to consider the fact that plant components cannot initiate external events such as floods, tornadoes, and high winds" and does not exclude the impact of the U.S. Nuclear Regulatory Commission Page 104 of 108 Serial RA-18-0178 Enclosure external hazard from the importance measure development. Section 5.6 of NEI 00

-04 discusses the "integral assessment" wherein the hazard specific importance measures ar e weighted by the individual hazard contribution to the plant risk.

a. Describe how the importance measures are determined from the HW and XF PRA models in the context of the 'binning' approach employed those models. Describe and justify how the same basic events, which were discretized by binning during the development of the PRA, are then combined to develop representative importance measures. Further, discuss how they are compared to the numerical criteria, justify any impact on the categorization results, and describe how the approach is consistent with the guidance in NEI 00

-04. Duke Energy Response to PRA RAI 22.a.:

The BSEP external flooding model does not use a 'binning' approach. It considers a component failed when the component becomes submerged or is impacted by spray, such that there are no 'binned' basic events. Therefore, no combining of flood failure basic events is required. Therefore, importance measures for all components in the external flood model will be determined from the random failure events for components in the model, just as they are for internal events, and the numerical criteria are applied the same way (i.e., sum of F

-V, max of RAW, etc.) for the basic events that apply to each component.

The BSEP high winds model does use a 'binning' approach to address the different probabilities of failure of some components due to the different initiating events. Therefore, there will be multiple basic events representing the wind

-induced failure of those components which need to be combined to develop importance measures. The BNP high winds model is a single top model that quantifies all wind initiators and produces a single cutset file. To calculate the F

-V value for any component, the F

-V value for all basic events which represent the failure of that component, including both wind

-induced failures and random failures, are simply added together. This is then the F

-V value for the component for the high winds hazard. To calculate the RAW value for the component, all basic events which represent the failure of that component are failed (i.e., set to logical true) at the same time. The resulting risk metric (CDF or LERF) is then divided by the baseline risk metric. This is then the RAW value for the component for the high winds hazard. The F-V and RAW value for each component can then be directly compared to the numerical criteria in NEI 00

-04.

b. In the context of the "integral assessment" described in Section 5.6 of NEI 00

-04, it is understood that importance evaluations performed in accordance with the process in NEI

00-04 are determined on a component basis. However, it is not apparent from the LAR and the NEI 00

-04 guidance how the integrated importance measures are calculated for certain components where corresponding basic events, which represent different failure modes for a component, in the HW and XF PRA models may not align with basic events in other PRA models. Examples of such basis events include those that are specific to the HW and XF PRA model, including implicitly modeled components, or basic events that represent a subcomponent modeled within the boundary of an internal events PRA component.

Provide details, with justification, of how the integrated importance measures will be calculated for HW and XF basic events that may not align directly with basic events in other PRA models. Include discussion on (i) any mapping that will be performed between HW and XF PRA basis events and those in other PRA models as well as cases where such U.S. Nuclear Regulatory Commission Page 105 of 108 Serial RA-18-0178 Enclosure mapping would be performed, and (ii) treatment of implicitly modeled components in the HW and XF PRA models in the categorization process.

Duke Energy Response to PRA RAI 22.b.:

The integral assessment is performed on a component basis, not on a basic event basis, and therefore integrated importance measures are not calculated for HW and XF basic events. For all models, importance measures are first calculated for each component being categorized. As stated in NEI 00

-04, the importance measures of basics events which represent different failure modes of the component within that model are combined to produce importance measures for that component for that model. This is done separately for all models, such that a F

-V, RAW, and common cause RAW value are developed for each component for each model. The integral importance measures are then calculated for each component using the formulas in section 5.6 of NEI 00

-04. As noted in those formulas, this is all done using component importance measures, not basic event importance measures. If a component is credited in one hazard model, but not in all (or any) of the other models, for those models which do not credit the component, the F

-V value would be 0 and the RAW value would be 1.0. These values are then used in the integral assessment formulas in section 5.6 of NEI 00-04. The CDF/LERF contribution from those models would be included in the denominator. If a component is explicitly modeled in one hazard model but is treated as being within the component boundary of another larger component (i.e., a 'sub

-component') in other models, for the model where the sub

-component is explicitly modeled, the importance measures of the sub

-component would be combined with the importance measures of the larger component (i.e., add the F

-V value and use the maximum RAW value) to determine the importance of the larger component. The larger component would then be used in the integral assessment. Note that in the categorization process, once a component becomes high safety significant for a function, all other components within that system which support that function also become high safety significance (HSS). If the larger component in this case becomes HSS, the sub

-component also becomes HSS, such that a separate integral calculation for the sub-component is not required.

PRA RAI 23 - Categorization Sensitivity Studies for High Winds and External Flooding PRAs:

Section 5.4 of NEI 00

-04 indicates that components can be identified as being safety significant following sensitivity studies. Section 5.4 also recommends the completion of several sensitivity studies, including any applicable sensitivity studies identified in the characterization of PRA acceptability.

a. Table 5-5 of NEI 00

-04 identifies sensitivity studies for HW and XF PRAs and includes any applicable sensitivity studies identified in the characterization of PRA acceptability. Clarify whether the sensitivity analyses in Table 5

-5 and those identified as part of PRA acceptability for HW and XF PRAs will be performed every time SSCs are categorized under 10 CFR 50.69.

U.S. Nuclear Regulatory Commission Page 106 of 108 Serial RA-18-0178 Enclosure Duke Energy Response to PRA RAI 23.a.: Yes, the sensitivity analyses in Table 5

-5 and those identified as part of PRA adequacy for HW and XF PRAS will be performed every time SSCs are categorized under 10 CFR 50.69.

b. The key assumptions and sources of uncertainties identified as part of the licensee's LAR may change as HW and XF PRA model updates could affect the significance of those assumptions for this application or create new key assumptions or sources of uncertainties. Describe how the licensee's 10 CFR 50.69 program continues to evaluate assumptions and sources of uncertainty when the HW and XF PRA models are updated in the future and subsequently incorporates key assumptions and key sources of uncertainty in a sensitivity analysis that is performed consistent with the guidance in NEI 00

-04.

Duke Energy Response to PRA RAI 23.b.:

Section 12 of NEI 00

-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated. This would include any PRA model changes which result in new key assumptions and uncertainties, and an evaluation of any new sensitivities required.

Additionally, the Duke Energy PRA model update procedures require periodic model updates. These procedures specifically address initiatives from industry insights with respect to changes in PRA technology that could change the PRA results, and changes in external event factors.

Following a PRA model update, the procedures require that PRA applications, including 10CFR 50.69 be reviewed to assess the impact of the model change on the application. This would address any new key assumptions and uncertainties, and an evaluation of any new sensitivities required. PRA RAI 24 - Risk Sensitivity Study and Compliance with Requirements of 10 CFR 50.69(e): The regulation 10 CFR 50.69(c)(1)(iv) requires that the categorization process includes evaluations that provide reasonable confidence that for SSCs categorized as RISC

-3, any potential increase in CDF and LERF resulting from changes in treatment are small. The regulations 10 CFR 50.69(e)(2) and (3) require the licensee to monitor the performance of RISC-1 and RISC

-2 SSCs and consider the data collected for RISC

-3 SSCs and make adjustments to the categorization or treatment processes so that the categorization process and results are maintained valid.

Section 8 of NEI 00

-04 provides guidance on how to conduct risk sensitivity studies during the categorization process for all the preliminary LSS SSCs to confirm that the categorization process results in acceptably small increases to CDF and LERF. An example is provided in the guidance to increase the unreliability of all preliminary LSS SSCs by a factor of 3 to 5, which U.S. Nuclear Regulatory Commission Page 107 of 108 Serial RA-18-0178 Enclosure appears to address random failures. No explicit discussion of risk sensitivity studies for external hazard PRAs is provided in the guidance.

The categorization of SSCs using the external hazard PRAs is dominated by structural failure modes, which are dependent on the corresponding modeling inputs such as the 'dominant failure modes' and

'fragility curves'. These modeling inputs are derived using several parameters, including the SSC design, testing, and as

-built installation, all of which can be impacted by alternative treatments.

Based on the preceding discussion,

a. Describe and justify how the required risk sensitivity study outlined in Section 8 of NEI 00

-04 will be performed for categorization using the licensee's HW and XF PRA models to meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

Duke Energy Response to PRA RAI 24.a.:

The BSEP external flooding model does not use a 'binning' approach. It considers a component failed when the component becomes submerged or is impacted by spray, such that no binning approach is required (i.e., component fails with a probability of 1.0). The risk sensitivity study outlined in Section 8 of NEI 00

-04 for the XF model will therefore be performed in the same manner as for internal events, by increasing the random failure probability of all LSS components by a factor of 3.

The BNP high winds model does use the binning approach which applies failure probabilities to components based on their capacity to withstand different wind initiators. However, the risk sensitivity study outlined in Section 8 of NEI 00

-04 sensitivity will not increase the probability of the wind-induced failure events associated with the LSS components. This is based on the programs and processes in place at BNP which provide reasonable confidence that the wind capacities of LSS component will not be impacted by alternative treatments. Even though a component is categorized as LSS, it remains safety related, and therefore must continue to be able to meet its design function (i.e., to withstand a given wind event). As stated in 10CFR 50.69, for RISC

-3 SSCs the licensee shall ensure, with reasonable confidence, that RISC

-3 SSCs remain capable of performing their safety

-related functions under design basis conditions, including environmental conditions and effects throughout their service life. Additionally, periodic inspection and testing activities must be conducted to determine that RISC

-3 SSCs will remain capable of performing their safety

-related functions under design basis conditions. Any identified degradation is corrected through the BNP Corrective Action Program. Thus, the monitoring and corrective action programs for SSCs ensures that potential degradation of the wind capacity would be detected and addressed before significantly impacting the high winds risk. In addition to the monitoring program, Duke Energy has a rigorous configuration management program to maintain the configuration of SSCs in the plant. Whenever a change is made to an SSC, an appropriate design change process is utilized to ensure that design requirements remain unchanged as required by the 10 CFR 50.69 rule. Additionally, safety

-related components are subject to periodic monitoring which will identify any degradation in the component.

U.S. Nuclear Regulatory Commission Page 108 of 108 Serial RA-18-0178 Enclosure In summary, based on the BNP 50.69 program procedures, and the supporting plant process and procedures, there is reasonable confidence that the high wind capacities of LSS components will not be impacted. Thus, inclusion of LSS components in a sensitivity study required by NEI section 8.0 is not warranted. As with other hazard models, this sensitivity will increase the random failure probability of all LSS components by a factor of 3.

b. Describe how it will be determined that the modeling inputs in the licensee's HW and XF PRA models and those used for the risk sensitivity study continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e).

Duke Energy Response to PRA RAI 24.b.: Section 12 of NEI 00

-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated. Duke Energy's PRA Maintenance and Update process includes a step to consider changes in external events hazards when completing a model update. Therefore, modeling inputs in the HW and XF PRA models are adequately evaluated to ensure they remain valid.

Serial: RA 0178 Brunswick Steam Electric Plan, Unit Nos. 1 and 2 Docket Nos. 50

-325 and 50

-324 / Renewed License Nos. DPR

-71 and D PR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" Attachment 1 Brunswick 50.69 PRA Implementation Items

U.S. Nuclear Regulatory Commission Page 1 of 1 Serial RA-18-0178 Attachment 1 The table below identifies the items that are required to be completed prior to implementation of 10 CFR 50.69 at Brunswick Steam Electric Plant (BSEP), Unit No s. 1 and 2. The issue identified below will be addressed and any associated changes made, focused scope peer reviews performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA

-Sa-2009, as endorsed by RG 1.200, Revision 2), and findings resolved and reflected in the PRA of record prior to implementation of 10 CFR 50.69. Brunswick 50.69 PRA Implementation Items UDescription UResolution

i. The BSEP external flood (XF) model hazard is being updated with more detailed analytical modeling as described in response to RAI 11 in Duk e Energy letter dated November 2, 2018.

The additional details need a focused scope peer review.

Duke Energy will complete a focused scope peer review of the BSEP External Flood PRA model hazard development prior to implementation of 10 CFR 50.69. Any findings from the focused scope peer review will be resolved and closed per an NRC approved process prior to implementing 10 CFR 50.69.

Serial: RA 0178 Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Docket No s. 50-325 and 50

-324 / Renewed License No

s. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, "Risk

-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" Attachment 2 Markup of Proposed Renewed Facility Operating License

INSERT UNIT 1 Amendment Number Additional Conditions Implementation Date [NUMBER] Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC

-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA

-Sa-2009; as specified in Unit 1 License Amendment No. [XXX] dated [DATE]. Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 1, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused

-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA

-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Upon implementation of Amendment No. [XXX].

INSERT UNIT 2 Amendment Number Additional Conditions Implementation Date [NUMBER] Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC

-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA

-Sa-2009; as specified in Unit 2 License Amendment No. [XXX] dated [DATE]. Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 1, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused

-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA

-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Upon implementation of Amendment No. [XXX].

Serial: RA 0178 Brunswick Steam Electric Plan, Unit Nos. 1 and 2 Docket Nos. 50

-325 and 50

-324 / Renewed License Nos. DPR

-71 and DPR

-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors" Attachment 3 Brunswick 50.69 LAR Supplement (Revision to High Winds PRA CDF and LERF)

U.S. Nuclear Regulatory Commission Page 1 of 1 Serial RA-18-0178 Attachment 3 Several changes have been incorporated into the Brunswick Steam Electric Plant (BSEP), Unit Nos. 1 and 2 High Winds (HW) PRA resulting in a substantial reduction in the core damage frequency (CD F) and large early release frequency (LERF). The HW CDF and LERF given in the original BSEP LAR Attachment 2 is superseded with the following:

Units Model Baseline CDF Baseline LERF Comments 1 & 2 High Winds PRA 1.98E-06 (Unit 1) 1.81E-06 (Unit 2) 4.69E-08 (Unit 1) 4.40E-08 (Unit 2) This model represents the current HW PRA Model of Record (MOR). Note: only the HW CDF and LERF frequencies from Attachment 2 of the original LAR are superseded. Everything else from Attachment 2 of the original LAR remains as a part of the application to adopt 10 CFR 50.69.