ML19200A216

Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors

ML19200A216
Person / Time
Site:	Calvert Cliffs
Issue date:	07/19/2019
From:	Jim Barstow Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
EPID L-2018-LIA-0482
Download: ML19200A216 (72)

Text

Exelon Generation @

200 Exelon Way Kennett Square. PA 19348 www.exeloncorp.com 10 CFR 50.90 10 CFR 50.69 July 19, 2019 U.S. Nuclear Regulatory Commission A TIN: Document Control Desk Washington, DC 20555-0001 Calvert Cliffs Nuclear Power Plant, Units 1 and 2 Renewed Facility Operating License Nos. DPR-53 and DPR-69 Docket Nos. 50-317 and 50-318

Subject:

Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors".

References:

1) License Amendment Request dated November 28, 2018 titled "Application to Adopt 10 CFR 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors."

2) Supplement to Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors," dated November 29, 2018.

3) Revised submittal to Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors," dated May 10, 2019.

4) E-mail from Michael Marshall, U.S. Nuclear Regulatory Commission, to Enrique Villar, Exelon, titled "[External] Calvert Cliffs Nuclear Power Plant, Units 1 And 2- Request For Additional Information Regarding Request To Adopt 10 CFR 50.69 Risk Informed Categorization And Treatment Of Systems, Structures, And Components (EPID L-2018-LIA-0482)," dated June 4, 2019. (ML19155A127)

5) Response to Request for Additional Information Regarding the Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors," dated July 1, 2019 By letter dated November 28, 2018 (Agencywide Documents Access and Management System (ADAMS) Package Accession No. ML18333A022), as supplemented by letters dated November 29, 2018 and May 10, 2019 (ADAMS Accession Nos. ML18337A038 and ML19130A180, respectively), Exelon Generation Company, LLC (Exelon) submitted a license amendment request (LAR) regarding Calvert Cliffs Nuclear Power Plant Units 1 and 2

Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69 July 19, 2019 Page2 (CCNPP). The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 1O of the Code of Federal Regulations (1 o CFR) Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors."

In Reference 4, the NRC staff identified the need for additional information to complete their evaluation. The NRC's request for additional information (RAI) transmitted in Reference 4 requested 30-day responses to RAls 4, 5, 6, and 8, and 45-day responses for RAls 1, 2, 3, and 7.

By letter dated July 1, 2019 (Reference 5), Exelon submitted its 30-day response to RAls 4, 5, 6, and 8. to this letter contains Exelon's 45-day response to RAls 1, 2, 3, and 7. contains the appropriate revised portions of the EPRI 30002012988 report. contains a list of acronyms used in this letter.

Exelon has reviewed the information supporting a finding of no significant hazards consideration, and the environmental consideration, that were previously provided to the NRC in Reference 1 letter. Exelon has concluded that the information provided in this response does not affect the bases for concluding that the proposed license amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92. In addition, Exelon has concluded that the information in this response does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.

Additionally, Attachment 1, Reference 51, of the May 10, 2019 letter (Reference 3) listed an incorrect ADAMS Accession number. The correct ML number is ML 181 OOA966.

There are no regulatory commitments contained in this letter.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 19th day of July 2019.

If you should have any questions regarding this submittal, please contact Enrique Villar at 610-765-5736.

Respectfully, J(M'-J r. -'Jr--

James Barstow r

Director - Licensing and Regulatory Affairs Exelon Generation Company, LLC

Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69 July 19, 2019 Page 3

Attachment:

1) Response to Request for Additional Information to License Amendment Request to Adopt 10 CFR 50.69

2) EPRI 30002012988 - 50.69 Seismic Alternative markups

3) List of Acronyms cc: Regional Administrator, NRC Region I NRC Senior Resident Inspector NRC Project Manager D. A. Tancabel, State of Maryland

ATTACHMENT 1 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 1 of 46 REQUESTS FOR ADDITIONAL INFORMATION

1. Section 3.2.3 of the enclosure to the LAR states that [t]his approach relies on the insights gained from seismic PRAs examined in Reference 4. Reference 4 in the enclosure to the LAR is the EPRI report. The EPRI report derives risk insights from four case studies. Those case studies compare the High Safety Significance (HSS) SSCs determined based on a seismic PRA (SPRA) against HSS SSCs determined from other PRAs used for categorization. Each of the cases studies included a full power internal events (FPIE) PRA but only two of the four case studies used information from a Fire PRA.

Section 3.3, Demonstration of Technical Adequacy of the PRA, of Regulatory Guide (RG) 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, identifies two aspects necessary to demonstrate the technical acceptability of the PRA. The first aspect is assurance that the pieces of the PRA used in the application have been performed in a technically correct manner.

Section 3.3.1, Assessment That the PRA Model is Technically Correct, of RG 1.200, Revision 2, further discusses that various consensus PRA standards and industry PRA programs, as endorsed, may be interpreted to be adequate for demonstrating that the first aspect is met.

Sections 3.3 through 3.5 of the EPRI report provide general information about the peer reviews conducted for the PRAs used for in each of the four case studies. However, the level of information is insufficient to determine whether the PRAs used in the case studies supporting this application have been performed in a technically correct manner.

For Plant A:

a. Information available to the staff about the SPRA for Plant A includes investigation of the impact of refinement of highest acceleration (%G8) bin. The results demonstrated an appreciable impact of such a refinement with a 17 percent increase in seismic large early release frequency (LERF). As a result, it is expected that the importance measures for SSCs based on the sensitivity will be different from the base case.

Information available to the staff about the SPRA for Plant A also indicates that human error probabilities (HEPs) for Diverse and Flexible Coping Strategies (FLEX) actions were not considered to be failed for the highest acceleration bin. Substantial uncertainty exists about the feasibility of FLEX actions during a seismic event at acceleration levels far above the design basis. Factors such as environmental conditions, ability to clear debris, equipment status, and status of connecting locations for FLEX equipment contribute to such uncertainty.

The refinement of the highest bin for seismic LERF determination as well as the credit for FLEX actions in that bin have the potential of impacting the dominant risk contributors, the corresponding importance measures and therefore, the insights used to support the proposed approach.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 2 of 46 Discuss the impact of the simultaneous refinement of highest acceleration (%G8) bin and proper adjustment of HEPs associated with FLEX credit for that bin, especially changes to the insights from Plant A and identification of any unique HSS SSCs from that SPRA that are not identified by the corresponding FPIE or Fire PRA.

1a. Plant A Response The Plant A response is based on a similar response provided for the NTTF 2.1 Seismic PRA submittal for Plant A. The impact of the simultaneous refinement of the highest acceleration (%G8) bin and no credit for FLEX are discussed.

The results of the sensitivity case support no new insights with respect to the identification of any unique HSS SSCs from the SPRA that are not identified by the corresponding FPIE or Fire PRAs.

As requested by this RAI, sensitivity case 1d (refinement of G8 interval) of the NTTF 2.1 Seismic submittal for Plant A [1] was re-performed with the added constraint of failing FLEX credit (via flag settings in the quantification flag file that directly fail the FLEX logic in the SPRA logic model). The results from this sensitivity quantification are provided in Tables RAI#1a-1 through RAI#1a-4. Differences in the rankings with respect to the corresponding tables in the NTTF 2.1 submittal are discussed below.

1. Differences in Risk Significant SSC Fragility Lists:

• Shaded rows in Tables RAI#1a-1 and RAI#1a-2 indicate SSC fragility groups that were below the FV=5E-3 threshold in the base Plant A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case.

All such fragility groups are relay chatter fragility groups related to 4kV AC emergency AC distribution. FLEX is reliant on 480V distribution (via alignment of the FLEX diesel generator to 480V). Given that this sensitivity case involves directly failing FLEX the FV risk importance of 4kV distribution (supporting other mitigation options) rises slightly; the relay chatter fragility groups rising above the FV=5E-3 threshold for this sensitivity are still minor contributors (each less than 1% of SLERF).

• Various fragilities already above the FV=5E-3 threshold changed rankings (e.g., PCIV fragility increased higher in the list due to extending the hazard curve in the analysis and removing of FLEX credit; 4kV relay chatter fragility importances increased due to same reason as described above).

• The SGIG nitrogen tank fragility dropped below the FV=5E-3 threshold.

This tank is one of the pneumatic options supplying ADS. FLEX is reliant on RPV depressurization for success. Given that this sensitivity case involves directly failing FLEX the FV risk importance of the SGIG nitrogen tank reduces slightly.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 3 of 46

2. Differences in Risk Significant HEP Lists:

• No operator actions that were below the FV=5E-3 threshold in the base Plant A NTTF 2.1 SPRA model increased above this threshold for this sensitivity case.

• Operator actions related to aligning or supporting FLEX (e.g., aligning FLEX generator, DC load shed) reduced in FV risk significance given that FLEX is directly failed in this sensitivity study; some of these actions dropped below the FV=5E-3 threshold.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 4 of 46 TABLE RAI#1a-1 RAI#1a REVISION TO SUBMITTAL TABLE 5.5-2: PLANT A U2 SLERF FRAGILITY FVs Base FRAGILITY FV Am Failure Submittal GROUP ID FRAGILITY GROUP DESCRIPTION TOTAL (g) r u Mode Fragility Method FV Rank OSP Offsite Power 8.57E-01 0.3 0.3 0.45 Functional Representative 1 SCRAM RPV Internals (Scram) 2.42E-01 1.35 0.28 0.32 Anchorage CDFM 2 S-PCI2 Primary Containment Isolation (Inboard and Outboard MSIVs) 9.95E-02 2.18 0.24 0.32 Functional Representative 8 S-DCBT1- DC Batteries 2(A-D)D01, 3(A-D)D01 8.62E-02 0.73 0.28 0.52 Anchorage SOV 3 S-CNWG2- Conowingo Hydroelectric Plant (OSP) 5.76E-02 0.3 0.3 0.45 Functional Representative 4 BOC Break Outside Containment 2.70E-02 2.69 0.35 0.4 Anchorage CDFM 5 S-CEPA1- Panel 20C003, 20C004C, 30C003, 30C004C, 00C29(A-D) 1.58E-02 0.82 0.28 0.37 Anchorage SOV 7 S-CC138- Relay Chatter Group 138 (150G relay) (4KV Bus 20A15 - 1.32E-02 0.78 0.3 0.43 Functional SOV 15 Recoverable)

S-CC190A- Correlated Relay Chatter Group 190A (52B-151N relays) (EDGs 1.26E-02 0.82 0.3 0.39 Functional SOV 13 A and D - Recoverable)

S-CNCT1- Condensate Storage Tank 20T010, 30T010 1.20E-02 0.5 0.24 0.32 Anchorage CDFM 10 S-CC162- Relay Chatter Group 162 (150G relay) (4KV Bus 20A18 - 9.31E-03 0.84 0.44 0.3 Functional SOV 21 Recoverable)

S-CEPA7- Panel 20C32 (U2 Engineering Sub Systems I Relay Cabinet) 8.05E-03 0.83 0.24 0.32 Functional Representative 9 SML Seismic Induced Medium LOCA 7.78E-03 2.69 0.35 0.4 Anchorage CDFM 6 S-CC154- Relay Chatter Group 154 (150G relay) (4KV Bus 20A17 - 7.30E-03 0.83 0.43 0.3 Functional SOV 18 Recoverable)

S-CEPA8- Panel 20C33 (U2 Engineering Sub Systems II Relay Cabinet) 6.49E-03 0.83 0.24 0.32 Functional Representative 14 S-CC166- Relay Chatter Group 166 (150G relay) (4KV Bus 30A18 - 5.40E-03 0.86 0.43 0.3 Functional SOV 24 Recoverable)

S-CC390- Correlated Relay Chatter Group 390 (33-102 relay) (EDG C - 5.22E-03 0.73 0.32 0.24 Functional SOV 17 Unrecoverable)

Notes to Table RAI#1a-1:

(1) This table lists SSC fragility groups with a FV (with respect to the SLERF of this RAI sensitivity calculation) value > 5E-3. Shaded rows indicate SSC fragility groups that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case.

(2) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for SSC fragilities are the weighted sum of the individual SSC FV values calculated for each of the individual hazard intervals.

(3) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 5 of 46 TABLE RAI#1a-2 RAI#1a REVISION TO SUBMITTAL TABLE 5.5-3: PLANT A U3 SLERF FRAGILITY FVs Base FRAGILITY FV Am Failure Submittal GROUP ID FRAGILITY GROUP DESCRIPTION TOTAL (g) r u Mode Fragility Method FV Rank OSP Offsite Power 8.62E-01 0.3 0.3 0.45 Functional Representative 1 SCRAM RPV Internals (Scram) 2.16E-01 1.35 0.28 0.32 Anchorage CDFM 2 S-PCI2 Primary Containment Isolation (Inboard and Outboard MSIVs) 1.27E-01 2.18 0.24 0.32 Functional Representative 9 S-DCBT1- DC Batteries 2(A-D)D01, 3(A-D)D01 7.25E-02 0.73 0.28 0.52 Anchorage SOV 3 S-CNWG2- Conowingo Hydroelectric Plant (OSP) 6.41E-02 0.3 0.3 0.45 Functional Representative 5 BOC Break Outside Containment 3.82E-02 2.69 0.35 0.4 Anchorage CDFM 6 S-CEPA1- Panel 20C003, 20C004C, 30C003, 30C004C, 00C29(A-D) 3.07E-02 0.82 0.28 0.37 Anchorage SOV 4 S-CNCT1- Condensate Storage Tank 20T010, 30T010 1.31E-02 0.5 0.24 0.32 Anchorage CDFM 10 S-DCBS4- DC Panel 20D24, 30D21 1.08E-02 0.86 0.28 0.52 Anchorage SOV 8 S-CC190A- Correlated Relay Chatter Group 190A (52B-151N relays) (EDGs 1.06E-02 0.82 0.3 0.39 Functional SOV 13 A and D - Recoverable)

S-DCBS10- 250 VDC Bus 30D11 9.61E-03 0.51 0.24 0.32 Anchorage Representative 11 SML Seismic Induced Medium LOCA 7.62E-03 2.69 0.35 0.4 Anchorage CDFM 7 S-CC142- Relay Chatter Group 142 (150G relay) (4KV Bus 30A15 - 6.73E-03 0.82 0.42 0.3 Functional SOV 15 Recoverable)

S-CC166- Relay Chatter Group 166 (150G relay) (4KV Bus 30A18 - 5.84E-03 0.86 0.43 0.3 Functional SOV 16 Recoverable)

S-CC138- Relay Chatter Group 138 (150G relay) (4KV Bus 20A15 - 5.24E-03 0.78 0.43 0.3 Functional SOV 75 Recoverable)

Notes to Table RAI#1a-2:

(1) This table lists SSC fragility groups with a FV (with respect to the SLERF of this RAI sensitivity calculation) value > 5E-3. Shaded rows indicate SSC fragility groups that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case.

(2) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for SSC fragilities are the weighted sum of the individual SSC FV values calculated for each of the individual hazard intervals.

(3) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 6 of 46 TABLE RAI#1a-3 RAI#1a REVISION TO SUBMITTAL TABLE 5.5-4: PLANT A U2 SLERF OPERATOR ACTION FVs Base Submittal OPERATOR ACTION ID OPERATOR ACTION DESCRIPTION FV TOTAL FV Rank RHUBLKSTDXI2 OPERATOR FAILS TO MANUALLY START RCIC (BLACK START) - SEISMIC PRA VERSION 7.68E-02 1 EHURLY4KDXI2 OPERATOR FAILS TO MITIGATE RELAY CHATTER FOR 4KV BUSES (SEISMIC) 6.07E-02 2 EHU-SE11DXI0 OPERATOR CROSS TIES 4KV EMERGENCY BUSES 5.66E-02 3 2CZOP-SLCLWL-H-- OPERATORS FAIL TO INJECT SLC WITH BORON ON LOW WATER LEVEL 2.39E-02 10 AHU--CADDXI2 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 2 INS 'B' 1.98E-02 11 AHU--CADDXD2 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 2 INS 'B' - DELAYED; CONDITIONAL 1.89E-02 4 EHURLYDGDXI2 OPERATOR FAILS TO MITIGATE RELAY CHATTER for EDGs (SEISMIC) 1.71E-02 6 RHUCSTSPDXI2 OPERATOR FAILS TO SWAP RCIC SUCTION FROM CST TO SUPPRESSION POOL 1.59E-02 15 EHULS-ACDXI2 OPS FAIL TO PERFORM SE-11 LOAD SHED (single unit- RCIC only) 9.85E-03 12 EHUATT-TDXI0 OPS FAIL TO PERFORM SE-11 LOAD SHED (single unit, both divisions) 8.96E-03 13 AHUBTL-RDXI2 OPERATORS FAIL TO VALVE IN N2 BOTTLES AFTER ACCUMULATOR DEPLETION (EARLY) 5.60E-03 14 Notes to Table RAI#1a-3:

(1) This table covers independent and dependent post-initiator operator action HEPs with a FV (with respect to the SLERF of this RAI sensitivity calculation) value

> 5E-3. Note that no dependent HEPs appear; all dependent HEPs are below FV=5E-3 in this sensitivity (same as the base PLANT A NTTF 2.1 SPRA).

(2)

No operator actions that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model increased above this threshold for this sensitivity case.

(3) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for the HEPs are the weighted sum of the individual HEP FV values calculated for each of the individual hazard intervals.

(4) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 7 of 46 TABLE RAI#1a-4 RAI#1a REVISION TO SUBMITTAL TABLE 5.5-5: PLANT A U3 SLERF OPERATOR ACTION FVs Base Submittal OPERATOR ACTION ID OPERATOR ACTION DESCRIPTION FV TOTAL FV Rank RHUBLKSTDXI3 OPERATOR FAILS TO MANUALLY START RCIC (BLACK START) - SEISMIC PRA VERSION 9.90E-02 1 EHU-SE11DXI0 OPERATOR CROSS TIES 4KV EMERGENCY BUSES 3.54E-02 6 EHURLY4KDXI3 OPERATOR FAILS TO MITIGATE RELAY CHATTER FOR 4KV BUSES (SEISMIC) 2.99E-02 7 AHUBTL-RDXI3 OPERATORS FAIL TO VALVE IN N2 BOTTLES AFTER ACCUMULATOR DEPLETION (EARLY) 1.89E-02 2 3CZOP-SLCLWL-H-- OPERATORS FAIL TO INJECT SLC WITH BORON ON LOW WATER LEVEL 1.84E-02 8 AHUBTL-RDXD3 OPS FAILS TO VALVE IN N2 BOTTLES AFTER ACCUM DEPLETION (LATE; CONDITIONAL) 1.82E-02 9 AHU--CADDXI3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' 1.62E-02 3 AHU--CADDXD3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' - DELAYED; CONDITIONAL 1.55E-02 4 RHUCSTSPDXI3 OPERATOR FAILS TO SWAP RCIC SUCTION FROM CST TO SUPPRESSION POOL 1.28E-02 5 EHURLYDGDXI3 OPERATOR FAILS TO MITIGATE RELAY CHATTER for EDGs (SEISMIC) 1.05E-02 10 EHULS-ACDXI3 INITIAL LOAD SHED PER SE-11, ATT. T (STEPS FOR RCIC) 6.16E-03 13 Notes to Table RAI#1a-4:

(1) This table covers independent and dependent post-initiator operator action HEPs with a FV (with respect to the SLERF of this RAI sensitivity calculation) value

> 5E-3. Note that no dependent HEPs appear; all dependent HEPs are below FV=5E-3 in this sensitivity (same as the base PLANT A NTTF 2.1 SPRA).

(2) No operator actions that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model increased above this threshold for this sensitivity case.

(3) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for the HEPs are the weighted sum of the individual HEP FV values calculated for each of the individual hazard intervals.

(4) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 8 of 46

b. Based on information available to the staff about the SPRA for Plant A, the description and basis of the finding level Facts and Observation (F&O) 3-1 for Plant A SPRA indicates that the approach taken at the time of the peer review to identify dominant contributors for possible improvements was lacking realism. The suggested resolution for the F&O recommends using an approach to determine potentially significant seismic failures that considers the combined impact of the sets of failures. The disposition discusses numerous improvements related to human reliability analysis (HRA) refinement, credit for FLEX equipment and actions, and refinement of fragility determination. However, it is unclear whether these changes were included in Plant As SPRA used to develop the insights supporting Exelons proposed approach. Further, it is unclear whether a systematic approach was followed by Plant A to identify the potentially significant seismic failures that considers the combined impact of the sets of failures. The lack of a systematic approach to identify changes indicated in the above cited F&O and/or the lack of inclusion of the changes in the SPRA during the case study has the potential of changing the categorization from the SPRA and therefore, the insights from the case study for Plant A supporting the licensees proposed approach.

i. Confirm that the changes made to the Plant A SPRA to disposition F&O 3-1 were included in the SPRA used for the case study supporting the licensees proposed approach. If the changes were not included, justify the validity and applicability of the insights from the Plant A case study given that the changes can impact the insights and/or generate new insights.

ii. Justify that the approach used to disposition F&O 3-1 for the Plant A SPRA addresses the concern of the F&O such that additional changes to the SPRA would not change the insights from the SPRA, and therefore, the case study for Plant A supporting this application.

1b. Plant A Response Response 1b.i:

Yes. Changes made to the Plant A SPRA to disposition F&O 3-1 were included in the SPRA used for the case study supporting the licensees proposed approach.

Response 1b.ii:

The systematic approach used to disposition F&O 3-1 supports that additional cost-beneficial changes to the SPRA would not change insights from either the SPRA or the case study for Plant A.

As part of the evaluation and disposition of F&O 3-1, multiple sensitivity studies were performed after the peer review to quantify the integrated risk impacts of numerous improvements such as human reliability analysis (HRA) refinement, credit for FLEX equipment and actions, and refinement of fragility calculations. Appendix K.6 and Attachment 6 to Appendix K of the SPRA Quantification Notebook for Plant A [2] document the sensitivity cases performed to support resolution of F&O 3-1. Review of the integrated sensitivity studies, which helped determine the combinations of integrated changes that supported potential cost beneficial changes in the SPRA model development, constitutes a Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 9 of 46 systematic approach to identify the potentially significant seismic PRA enhancements to incorporate into the SPRA model and results that were used as input to the case study.

Appendices K.6 through K.8 of the SPRA Quantification Notebook for Plant A discuss the quantification process to incorporate the SPRA model enhancements to support evaluation and disposition of F&O 3-1.

c. Based on the information available to the staff, Plant A committed to updating its internal events PRA model for the risk-informed categorization of SSCs to (1) account for the requirement for two Emergency Diesel Generator (EDG) cooling fans during periods when the outdoor temperature at the site are above the design temperature of 80°F, and (2) remove credit for in-vessel core melt arrest at high reactor pressure vessel (RPV) pressure conditions. The staff notes that (1) seismic events result in the likely loss of offsite power the cooling fan success criteria results in a failure mode for EDGs that can have non-negligible contribution at low seismic accelerations, and (2) credit for in-vessel core melt arrest at high RPV pressure conditions can impact the large early release sequences. As a result, both the updates cited above have the potential of impacting the categorization insights supporting this application from the Plant A case study.

i. Confirm that both the model updates cited above were included in the internal events PRA as well as the SPRA used to develop the insights from the Plant A case study. Alternately, provide justification, such as performing a sensitivity study that simultaneously includes both the updated modelling items cited above, that exclusion of these updates from either the FPIE or the SPRA or both would not change the insights from the Plant A case study.

ii. If justification for minimal impact on insights from the Plant A case study cannot be provided, then then provide updated insights and discuss their consideration in the proposed approach.

1c. Plant A Response The Plant A response is based on a similar response provided for the NTTF 2.1 Seismic PRA submittal for Plant A. [1]

The Plant A SPRA model did not incorporate either of the following two (2) commitments identified in RAI #1c:

• Update the PRA model to account for the requirement for two Emergency Diesel Generator (EDG) cooling fans during periods when the outdoor temperature is at or above Plant A design temperature of 80°F.

• Remove credit for core melt arrest in-vessel at high reactor pressure vessel (RPV) pressure conditions.

A sensitivity study was performed for the Plant A SPRA to incorporate both of the above two (2) commitments to evaluate the potential impact on CDF and LERF importance values.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 10 of 46 The results of the sensitivity case support no new insights with respect to the identification of any unique HSS SSCs from the SPRA that are not identified by the corresponding FPIE or Fire PRAs.

SPRA Model Changes for Sensitivity Case Room cooling is provided by two (2) fans (i.e., one primary fan and one supplemental fan) for each of the four (4) EDGs as follows:

• E1 EDG: Primary supply fan 0AV64, and supplemental cooling fan 0AV91

• E2 EDG: Primary supply fan 0BV64, and supplemental cooling fan 0BV91

• E3 EDG: Primary supply fan 0CV64, and supplemental cooling fan 0CV91

• E4 EDG: Primary supply fan 0DV64, and supplemental cooling fan 0DV91 For the base Plant A NTTF 2.1 SPRA model, 1 of 2 EDG room cooling fans is required to meet the success criteria for adequate EDG room cooling.

The changes incorporated for this SPRA sensitivity case are consistent with the changes being incorporated to address the commitments as part of the periodically scheduled 2018 Plant A Full Power Internal Events (FPIE) PRA model update.

Sensitivity Case Results The combined sensitivity case results are provided in the following tables:

• Table RAI#1c-1: Unit 3 Sensitivity Case SSC Fragility CDF Importance Measures

• Table RAI#1c-2: Unit 3 Sensitivity Case Operator Action CDF Importance Measures

• Table RAI#1c-3: Unit 3 Sensitivity Case SSC Fragility LERF Importance Measures

• Table RAI#1c-4: Unit 3 Sensitivity Case Operator Action LERF Importance Measures The shaded row in Table RAI#1c-1 indicates an SSC fragility group that was below the FV=5E-3 threshold in the base Plant A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case. The SSC fragility group that increased above this threshold is associated with the four (4) EDG Supplemental Supply Fans 0(A-D)V91 (i.e.,

fragility group S-DGFN2-). For fragility group S-DGFN2-, the sensitivity case results show an SCDF FV = 1.1E-2 and an SLERF FV <5E-3. The change in the success criteria for the EDG room cooling is the key reason why fragility group S-DGFN2- becomes risk significant for the sensitivity case.

For the other risk significant contributors in Table RAI#1c-1, the relative rankings for the top contributors did not change compared to the Plant A NTTF 2.1 SPRA submittal. However, two (2) fragility groups have FV values that decreased below 5E-3 such that they are not shown on Table RAI#1c-1:

• Fragility group S-DGPA1- D/G Room Supply Temp Control Panel 0(A-D)C479.

The SCDF FV decreased from 7.26E-3 for the NTTF 2.1 SPRA model to 3.12E-3 for the sensitivity case. For the sensitivity case, with EDG Supplemental Supply Fans 0(A-D)V91 (i.e., fragility group S-DGFN2- with Am=0.44g) now having an increased contribution to EDG failure over the entire seismic hazard range, the relative risk Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 11 of 46 contribution of the D/G Room Supply Temp Control Panel fragility reduced (i.e.,

decrease in FV).

• Fragility group S-CC342A- Correlated Relay Chatter Group 342A (SI-Overcurrent relays) (All 4KV Busses - Unrecoverable). The SCDF FV decreased slightly from 5.02E-3 for the NTTF 2.1 SPRA model to 4.97E-3 for the sensitivity case.

Tables RAI#1c-2, 1c-3, and 1c-4 do not identify any other new risk significant SSCs or operator actions compared to the Plant A NTTF 2.1 SPRA submittal. Similar to the results shown in Table RAI#1c-1, due to minor changes in the FV values, the rankings for the top contributors shifted slightly.

Tables RAI#1c-1, 1c-2, 1c-3, and 1c-4 are based on the sensitivity case results for Unit 3.

The sensitivity case results for Unit 2 did not change the conclusions from those provided for Unit 3. Therefore, the results for Unit 2 are not explicitly provided.

Discussion For the Plant A NTTF 2.1 SPRA model where 1 of 2 EDG cooling fans are required, both the primary supply fans 0(A-D)V64 and the supplemental cooling fans 0(A-D)V91 are not risk significant.

• The primary supply fans 0(A-D)V64 are seismically correlated and have a relatively high seismic capacity (Am=1.21g PGA, based on a site specific representative fragility calculation).

• The supplemental cooling fans 0(A-D)V91 are seismically correlated and have a much lower seismic capacity (Am=0.44g PGA, based on a site specific representative fragility calculation. The relatively low Am=0.44g for the supplemental fans does not have a significant risk impact on the Plant A NTTF 2.1 SPRA model results because of the relatively high Am=1.21g seismic capacity of the primary fans (which are sufficient by themselves in the base analysis of the submittal).

Given the revised 2 of 2 success criteria associated with the commitment for EDG cooling if outside air temperature is >80°F, the relatively low Am=0.44g for the supplemental fans supports that they would be risk significant. The four (4) EDG supplemental fans are seismically correlated. Therefore, if outside air temperature is >80°F, seismic correlated failure of the EDG supplemental fans with Am=0.44g is modeled to fail all four (4) EDGs has a high likelihood to lead to a station blackout event.

The results of the supplemental cooling fans 0(A-D)V91 being risk significant for this sensitivity case is likely conservative for the following issues:

• The relatively low Am=0.44g for the supplemental fans is based on a site specific representative fragility calculation. A detailed fragility calculation for EDG supplemental fans 0(A-D)V91 was not performed for the Plant A NTTF 2.1 SPRA model because they were not risk significant with respect to the base case EDG cooling requirements (i.e., 1 of 2 EDG cooling fans). It is expected that if a refined fragility calculation was performed the fragility would increase.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 12 of 46

• The criteria for the outside air temperature of 80°F is based on the design basis, which is likely conservative from a PRA perspective. If a realistic room heatup calculation was performed, the allowed outside temperature for requiring 2 of 2 EDG coolers would likely be >80°F, such that the conditional probability for requiring 2 of 2 EDG coolers could be less than the 8E-2 value evaluated for 80°F.

The results of the sensitivity study support that the supplemental cooling fans 0 (A-D)V91 could be identified as risk significant based on the revised success criteria. However, a more realistic evaluation of the data inputs for the EDG cooling fans (e.g., detailed fragility calculation for the supplemental cooling fans, realistic room heatup calculation) may indicate that the supplemental cooling fans 0 (A-D)V91 are not risk significant consistent with the Plant A NTTF 2.1 SPRA results.

Note:

As noted above, for Plant A the EDG Supplemental Cooling Fans 0(A-D)V91 were not modeled in the SPRA, FPIE or FPRA at the time of the EPRI SPRA HSS study (Seismic Alternative). Per the Plant A SPRA sensitivity study above, these fans will be HSS. The pending Plant A FPIE PRA preliminary results show these fans as HSS also.

Plant A staff investigated to determine if the fans would be categorized as HSS via other 50.69 screening criteria. Plant A staff concluded that two 50.69 screening criteria would result in these SSCs being categorized as HSS. They are (1) Core Damage Defense-in-Depth and (2) Shutdown risk. The basis for these HSS categorizations is that the EDG supplemental cooling fans support the EDGs and without these fans the EDGs will not function if the temperature is above 80 degrees. EDGs are required in the Core Damage defense-in-depth analysis to mitigate an accident, and for Shutdown risk because they support the primary/ first alternative method to achieve a Key Safety Function (Power Availability).

In addition, removing credit for core melt arrest in-vessel at high reactor pressure vessel (RPV) pressure conditions impacts the SLERF results in Tables RAI#1c-3 and 1c-4, but not the SCDF results in Tables RAI#1c-1 and 1c-2. Tables RAI#1c-3 and 1c-4 do not identify any new risk significant SSCs or operator actions compared to the Plant A NTTF 2.1 SPRA submittal. Although there are minor changes in the FV values, the rankings for the top contributors in Table RAI#1c-3 did not change and the rankings in Table RAI#1c-4 only shifted slightly compared to the Plant A NTTF 2.1 SPRA submittal.

Refer to the response to RAI 2a for additional sensitivity studies to address the potential impact on the risk insights for the Plant A case study when accounting for other key assumptions and sources of uncertainty in addition to those identified in RAI 1c.

Attachment 1 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 13 of 46 TABLE RAI#1c-1 RAI#1c REVISION TO SUBMITTAL TABLE 5.4-3: PLANT A U3 SCDF FRAGILITY FVs Base FRAGILITY Submittal GROUP ID FRAGILITY GROUP DESCRIPTION FV TOTAL Am (g) r u Failure Mode Fragility Method FV Rank OSP Offsite Power 9.81E-01 0.3 0.3 0.5 Functional Representative 1 S-DCBT1- DC Batteries 2(A-D)D01, 3(A-D)D01 1.18E-01 0.73 0.28 0.52 Anchorage SOV 2 S- Conowingo Hydroelectric Plant (OSP) 5.53E-02 0.3 0.3 0.5 Functional Representative 3 CNWG2-S-CEPA1- Panel 20C003, 20C004C, 30C003, 30C004C, 3.75E-02 0.82 0.28 0.37 Anchorage SOV 4 00C29(A-D)

S-DGFN2- EDG Supplemental Supply Fans 0(A-D)V91 1.13E-02 0.44 0.24 0.3 Functional Representative N/A S-CC359A- Correlated Relay Chatter Group 359A (52B- 1.12E-02 0.98 0.30 0.43 Functional SOV 5 TD5 relays) (All EDGs - Unrecoverable)

S-DCBS4- DC Panel 20D24, 30D21 1.02E-02 0.86 0.28 0.52 Anchorage SOV 6 Notes to Table RAI#1c-1:

(1) This table lists SSC fragility groups with a FV (with respect to the U3 SCDF of this RAI sensitivity calculation) value > 5E-3. Shaded rows indicate SSC fragility groups that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case.

(2) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for SSC fragilities are the weighted sum of the individual SSC FV values calculated for each of the individual hazard intervals.

(3) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 14 of 46 TABLE RAI#1c-2 RAI#1c REVISION TO SUBMITTAL TABLE 5.4-5: PLANT A U3 SCDF OPERATOR ACTION FVs Base Submittal OPERATOR ACTION ID OPERATOR ACTION DESCRIPTION FV TOTAL FV Rank AHU--CADDXI3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' 3.31E-02 2 AHUBTL-RDXI3 OPERATORS FAIL TO VALVE IN N2 BOTTLES AFTER 3.10E-02 1 ACCUMULATOR DEPLETION (EARLY)

AHU--CADDXD3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' - 2.91E-02 4 DELAYED; CONDITIONAL AHUBTL-RDXD3 OPS FAILS TO VALVE IN N2 BOTTLES AFTER ACCUM DEPLETION 2.75E-02 3 (LATE; CONDITIONAL)

QHUFXL13DXI3 OPERATOR FAILS TO ALIGN FLEX GENERATOR TO LC E134 AND LC 1.59E-02 5 E334 QHULS-ACDXI3 DEEP DC LOAD SHED WHEN ELAP DECLARED (STEPS FOR RCIC) 1.12E-02 7 EHURLY4KDXI3 OPERATOR FAILS TO MITIGATE RELAY CHATTER FOR 4KV BUSES 1.03E-02 6 (SEISMIC)

Table RAI#1c-2:

(1) This table covers independent and dependent post-initiator operator action HEPs with a FV (with respect to the U3 SCDF of this RAI sensitivity calculation) value

> 5E-3. Note that no dependent HEPs appear; all dependent HEPs are below FV=5E-3 in this sensitivity (same as the base PLANT A NTTF 2.1 SPRA).

(2) No operator actions that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model increased above this threshold for this sensitivity case.

(3) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for the HEPs are the weighted sum of the individual HEP FV values calculated for each of the individual hazard intervals.

(4) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

(5) For this sensitivity case, the FV for two (2) operator actions decreased below 5E-3 compared to the base PLANT A NTTF 2.1 Seismic submittal and are not shown in this table. The two (2) operator actions are:

• OPERATOR FAILS TO CROSS TIE 4KV EMERGENCY BUSES (basic event EHU-SE11DXI0). The increase in risk significance for seismic failure of the supplemental fans results in a relative decrease of the risk contribution of scenarios where operator cross tie of the emergency buses (e.g., to support cross tie of power from the EDGs) is beneficial.

• OPERATOR FAILS TO MANUALLY INITIATE SUPPLEMENTAL FAN (basic event KHUDGFANDXI0). There is a decrease in risk significance due to credit for automatic initiation of the supplemental fans for the sensitivity case.

Attachment 1 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 15 of 46 TABLE RAI#1c-3 RAI#1c REVISION TO SUBMITTAL TABLE 5.5-3: PLANT A U3 SLERF FRAGILITY FVs Base FRAGILITY FV Am Failure Fragility Submittal FV GROUP ID FRAGILITY GROUP DESCRIPTION TOTAL (g) r u Mode Method Rank OSP Offsite Power 9.05E-01 0.3 0.3 0.45 Functional Representative 1 SCRAM RPV Internals (Scram) 1.86E-01 1.35 0.28 0.32 Anchorage CDFM 2 S-DCBT1- DC Batteries 2(A-D)D01, 3(A-D)D01 1.05E-01 0.73 0.28 0.52 Anchorage SOV 3 S-CEPA1- Panel 20C003, 20C004C, 30C003, 30C004C, 00C29(A-D) 5.32E-02 0.82 0.28 0.37 Anchorage SOV 4 S-CNWG2- Conowingo Hydroelectric Plant (OSP) 4.93E-02 0.3 0.3 0.45 Functional Representative 5 BOC Break Outside Containment 3.45E-02 2.69 0.35 0.4 Anchorage CDFM 6 SML Seismic Induced Medium LOCA 3.16E-02 2.69 0.35 0.4 Anchorage CDFM 7 S-DCBS4- DC Panel 20D24, 30D21 2.53E-02 0.86 0.28 0.52 Anchorage SOV 8 S-PCI2 Primary Containment Isolation (Inboard and Outboard 2.19E-02 2.18 0.24 0.32 Functional Representative 9 MSIVs)

S-CNCT1- Condensate Storage Tank 20T010, 30T010 1.54E-02 0.5 0.24 0.32 Anchorage CDFM 10 S-DCBS10- 250 VDC Bus 30D11 1.40E-02 0.51 0.24 0.32 Anchorage Representative 11 S-SGTK1- SGIG Nitrogen Tank 9.92E-03 0.78 0.24 0.26 Anchorage CDFM 12 S-CC190A- Correlated Relay Chatter Group 190A (52B-151N relays) 8.19E-03 0.82 0.3 0.39 Functional SOV 13 (EDGs A and D - Recoverable)

Notes to Table RAI#1c-3:

(1) This table lists SSC fragility groups with a FV (with respect to the U3 SLERF of this RAI sensitivity calculation) value > 5E-3. Shaded rows indicate SSC fragility groups that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model but increased above this threshold for this sensitivity case. No such fragility groups increased above the threshold for this sensitivity case.

(2) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for SSC fragilities are the weighted sum of the individual SSC FV values calculated for each of the individual hazard intervals.

(3) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 16 of 46 TABLE RAI#1c-4 RAI#1c REVISION TO SUBMITTAL TABLE 5.5-5: PLANT A U3 SLERF OPERATOR ACTION FVs Base Submittal OPERATOR ACTION ID OPERATOR ACTION DESCRIPTION FV TOTAL FV Rank RHUBLKSTDXI3 OPERATOR FAILS TO MANUALLY START RCIC (BLACK START) - 9.95E-02 1 SEISMIC PRA VERSION AHUBTL-RDXI3 OPERATORS FAIL TO VALVE IN N2 BOTTLES AFTER 3.87E-02 2 ACCUMULATOR DEPLETION (EARLY)

AHUBTL-RDXD3 OPS FAILS TO VALVE IN N2 BOTTLES AFTER ACCUM DEPLETION 3.75E-02 3 (LATE; CONDITIONAL)

AHU--CADDXI3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' 3.06E-02 4 AHU--CADDXD3 OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 3 INS 'B' - 2.91E-02 5 DELAYED; CONDITIONAL 3CZOP-SLCLWL- OPERATORS FAIL TO INJECT SLC WITH BORON ON LOW WATER 2.05E-02 8 H-- LEVEL EHU-SE11DXI0 OPERATOR CROSS TIES 4KV EMERGENCY BUSES 2.02E-02 6 EHURLY4KDXI3 OPERATOR FAILS TO MITIGATE RELAY CHATTER FOR 4KV BUSES 1.59E-02 7 (SEISMIC)

RHUCSTSPDXI3 OPERATOR FAILS TO SWAP RCIC SUCTION FROM CST TO 1.52E-02 9 SUPPRESSION POOL QHUFXL13DXI3 OPERATOR FAILS TO ALIGN FLEX GENERATOR TO LC E134 AND LC 1.47E-02 10 E334 EHULS-ACDXI3 INITIAL LOAD SHED PER SE-11, ATT. T (STEPS FOR RCIC) 1.07E-02 11 QHULS-ACDXI3 DEEP DC LOAD SHED WHEN ELAP DECLARED (STEPS FOR RCIC) 1.01E-02 13 EHURLYDGDXI3 OPERATOR FAILS TO MITIGATE RELAY CHATTER for EDGs 8.19E-03 12 (SEISMIC)

Table RAI#1c-4:

(1) This table covers independent and dependent post-initiator operator action HEPs with a FV (with respect to the U3 SLERF of this RAI sensitivity calculation) value > 5E-3. Note that no dependent HEPs appear; all dependent HEPs are below FV=5E-3 in this sensitivity (same as the base PLANT A NTTF 2.1 SPRA).

(2) No operator actions that were below the FV=5E-3 threshold in the base PLANT A NTTF 2.1 SPRA model increased above this threshold for this sensitivity case.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 17 of 46 (3) Fussell-Vesely (FV) importance measures calculated using EPRI ACUBE software to determine individual basic event risk importance values from cutset results.

The FV values for the HEPs are the weighted sum of the individual HEP FV values calculated for each of the individual hazard intervals.

(4) The term FV is used here but the ACUBE software actually produces the Criticality Importance (CI) risk measure in place of FV. The CI and FV measures are very close numerically such that any minor difference in their values is non-significant for typical decision-making purposes Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 18 of 46 For Plant C:

d. Based on information available to the staff, it appears that the modeling of low leakage shutdown seals (SDS) is different between Plant Cs FPIE and SPRA. Specifically, the approach to modeling SDS behavior, and consequently, plant response, under asymmetric steam generator cooling conditions appears to have been performed differently. The difference in modeling can also extend to the Plant C Fire PRA. It is unclear whether modeling of SDS is consistent in Plant C PRAs and how the potential differences between PRA models may affect the insights developed from the case study using Plant C.

i. Provide justification, such as performing a sensitivity study with consistent modeling of SDS across all PRAs used for Plant C case study, that the insights developed from that case study (i.e., SSCs related to limited seismic event specific failure modes are identified that are HSS only from the SPRA and the remainder of the HSS SSCs from SPRA are captured by FPIE and/or Fire PRA) are not impacted by the difference in modeling the SDS behavior noted above between the Plant C FPIE, SPRA, and Fire PRA.

ii. If justification for minimal impact on insights from the Plant C case study cannot be provided, then provide updated insights and discuss their consideration in the proposed approach.

1d.i. Plant C Response A sensitivity study was performed for Plant C using PRA models having consistent modeling of SDS across all PRAs. The focus of the sensitivity study was to compare the results provided in Table 3-9 of the EPRI Task Report 3002012988 [13] for Plant C with the sensitivity study results to determine if the IEPRA and Fire PRA models containing asymmetric cooling impact Plant C insights.

The HSS determination from the sensitivity study is consistent with the HSS determination mentioned in the EPRI report for Plant C. This shows that the difference in modeling the SDS behavior among the Plant C FPIE, SPRA, and Fire PRA models did not impact the HSS determination for Plant C SSCs.

Plant C Response 1d.ii Not applicable because insights did not change.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 19 of 46 For Plant D:

e. According to the guidance in RG 1.200, Revision 2, peer reviews against endorsed standards, accounting for staffs regulatory positions on those standards, and using endorsed or accepted peer review guidance, is an acceptable approach to demonstrate that the PRA is adequate to support a risk-informed application. Section 3.5, Plant D Trial Categorization Evaluation, of the EPRI report provides information about the case study performed using the SPRA and FPIE PRA for Plant D. However, information regarding the peer reviews performed and the results therefrom for those PRAs is unavailable. Therefore, the staff does not have an adequate basis to determine the technical acceptability of the PRAs used for the Plant D case study.

i. Provide information about the status of the finding level F&Os from the peer reviews for the FPIE and SPRA to support the technical acceptability of those PRAs for the Plant D case study supporting this application.

ii. Provide justification that dispositions of any open F&Os do not impact the insights from the Plant D case study and/or generate new insights. If justification for minimal impact on insights from the Plant D case study cannot be provided, then provide updated insights and discuss their consideration in the proposed approach.

Plant D Response There were a total of seven open findings for the internal events PRA and one open finding for the Seismic PRA for Plant D. Of those eight findings, four of them either deal with the uncertainty analysis, which is not used to generate importance measures, or are documentation issues with no numerical effects. The remaining four findings were reviewed for potential impacts to the PRA model.

One finding has to do with not applying a Joint HEP (human error probability) floor value when the model was run. A sensitivity was run which applied the floor value to the Joint HEPs and this resulted in no change to CDF and LERF cutsets, meaning the importance measures are unaffected. Thus, the case study results are not impacted.

The second finding addresses the operator actions credited for post core damage sequences in the LERF analysis, and whether not crediting certain actions resulted in over conservatism. A review of each of the HEPs used in the LERF analysis was performed to determine which operator actions, if not credited, could result in over conservatism in the model. Of the HEPs that were reviewed, only manual operation of the nitrogen backup system was found to have an impact on the results. A sensitivity was performed for the internal events PRA model to include credit of the manual operation of the nitrogen backup system using an appropriate screening value and the associated change in LERF was reanalyzed to determine if any importance measures had changed. Crediting this HEP resulted in additional components identified as HSS for the internal events PRA model, but no components dropped out of HSS classification. For the Seismic PRA model, feasibility of crediting manual operation of Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 20 of 46 the nitrogen backup system could not be justified, therefore an equivalent sensitivity was not performed. Therefore, there were no impacts to the case study results.

The third finding addresses how internal events operator actions credited in the internal flood PRA (e.g. non flood-response actions) required within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of an internal flooding event were modified to account for flooding. A review was performed on the operator actions within the internal events PRA model to ensure that flooding impacts were appropriately accounted for. It was determined that the existing analysis adequately addressed the feasibility of impacts due to flooding, and no additional adjustments were required for general response operator actions required within 60 minutes of a flood. The Seismic PRA re-confirmed feasibility for all credited operator actions and accounted for seismically induced flooding impacts. Therefore, no sensitivity was required.

Consequently, the issues addressed by this F&O has no impact to the case study results.

The fourth finding addresses not crediting secondary side isolation of a steam generator tube rupture following core damage. A sensitivity was performed which applied a 0.1 recovery factor to the applicable SGTR sequences to evaluate the impact to LERF. It was determined that this sensitivity resulted in no change to the LERF cutsets, meaning the importance measures we not affected. Therefore, the case study results are not impacted.

f. The discussion in Section 3.5 for Plant D, states that Plant D has FLEX equipment explicitly modeled in their PRAs, including their SPRA. The NRC memorandum dated May 30, 2017, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269), provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision making in accordance with the guidance of RG 1.200, Revision 2. The EPRI report as well as information available to the staff does not provide any discussion on the modeling approach, including human reliability analysis and failure probabilities, for the FLEX equipment in PRAs for Plant D used to develop the insights.

i. Provide details of the methodology used to assess the failure probabilities of FLEX equipment credited in the PRAs that is dissimilar to other plant equipment credited in those PRAs (i.e., SSCs with sufficient plant-specific or generic industry data). Include a justification explaining (1) the approach for estimating parameter values, (2) the potential use of safety related equipment failure probabilities, and (3) consistency of the approach with the relevant SRs in the 2009 ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2. One way to provide the justification for use of safety related equipment failure probabilities is to perform a sensitivity study that increases the failure probability for modeled FLEX equipment that is dissimilar to other plant equipment credited in those PRAs used for Plant D case study to determine the impact on the insights from the Plant D case study.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 21 of 46 ii. If safety related equipment failure probabilities are used for FLEX equipment credited in the PRAs that is dissimilar to other plant equipment and justification for minimal impact on insights from the Plant D case study cannot be provided, then then provide updated insights and discuss their consideration in the proposed approach.

1f.i. Plant D Response With respect to Plant D, for both the internal events model and the Seismic model, only permanently installed FLEX components are credited. The failure probabilities used for modeled FLEX equipment were taken from similar type components already modeled in the base PRA model (such as the FLEX diesel generators used the emergency diesel generator data). In order to justify the use of the failure probabilities used within the model, a sensitivity analysis was performed to increase the failure probabilities of FLEX components to 3 times the original value. Because the FLEX components were already identified as HSS prior to the sensitivity analysis being performed, the sensitivity analysis did not produce any new insights relative to those components. The sensitivity analysis also did not result in any additional impacts to the case study comparison of internal events vs. seismic PRA importance results, other than those referenced in the response to RAI 3.A.

1f.ii. Plant D Response As mentioned in 1.f.i, there were no additional impacts identified by setting the failure probabilities of the FLEX components to 3 times the original values.

2. Section 3.3 of RG 1.200, Revision 2, identifies two aspects necessary to demonstrate the technical acceptability of the PRA. The second aspect is assurance that the assumptions and approximations used in developing the PRA are appropriate. Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, further discusses the second aspect and clarifies that:

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision- making associated with the application.

Revision 2 of RG 1.200 defines the terms key assumption and key source of uncertainty" in Section 3.3.2.

The EPRI report does not include information related to the identification of key assumptions and approximations for the PRAs used in each case study and the impact of the identified key assumptions and approximations on the insights derived from the corresponding case studies.

The NRC staff notes that information related to key assumptions and sources of uncertainty in the context of 10 CFR 50.69 categorization have been provided separately (ADAMS

Attachment 1 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 22 of 46 Accession No. ML17243A014 for Plant A, ADAMS Accession Nos. ML12248A035 and ML18052B342 for Plant C, and ADAMS Accession No. ML18334A363 for Plant D).

a. Confirm:

i. The applicability of the key assumptions and sources of uncertainty in the above cited documents to the corresponding case studies supporting this application. Provide the requested information separately for Plants A, C, and D.

2a.i. Plant A Response The key assumptions and sources of uncertainty cited in ADAMS Accession No. ML17243A014 for the internal events and fire PRA hazards for Plant A are applicable to the corresponding Plant A case study supporting this application. Additionally, addressing the follow up RAIs in relation to ML17243A014, per the Plant A response to RAI [14] and supplemental information provided to the NRC [15], identified additional items to be evaluated as a part of the Plant A 50.69 implementation. These additional items are also applicable to the Plant A case study and are discussed further in the response to RAI 2aii. In addition, since the Plant A seismic PRA key assumptions and areas of uncertainty were not included as a part of ML17243A014, they are addressed in the response to 2aii with respect to the 50.69 categorization process and the EPRI Study.

2a.i. Plant C Response The key assumptions and sources of uncertainty cited in ADAMS Accession Nos.

ML12248A035 and ML18052B342 for Plant C are applicable to the corresponding case studies supporting this application.

2a.i. Plant D Response The key assumptions and sources of uncertainty cited in ADAMS Accession No. ML18334A363 for Plant D are applicable to the corresponding case studies supporting this application.

ii. No additional key assumptions and sources of uncertainty have been identified that are relevant to the corresponding case studies supporting this application. Provide the requested information separately for Plants A, C, and D.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 23 of 46 Plant A response to 2a.ii For the internal events and fire PRA models, there are no additional key assumptions/uncertainties relevant to the EPRI case studies beyond the sources already noted in response to 2ai. The EPRI case studies represent an implementation of the NEI 00-04 PRA categorization process, i.e., determining whether an SSC would meet the criteria established in NEI 00-04 for HSS based on the results of each PRA model. Thus, the key assumptions and model uncertainties applicable to the EPRI case studies are as identified for the 50.69 application.

Table 2aii-1 provides a summary of the key assumptions and sources of uncertainty that were identified in the NTTF 2.1 seismic PRA submittal for Plant A [1] consistent with the guidance provided in NUREG-1855 [8]. Candidate sensitivity cases for the Plant A SPRA model were identified consistent with the methodology provided in NUREG-1855

[8] and the sensitivities performed for the Plant A FPIE PRA model.

The last two (2) columns of Table 2aii-1 provide a disposition of the key assumptions and sources of uncertainty with respect to the potential impact on the Plant A case study risk insights. The assessment of key assumptions and sources of uncertainty identified in ML17243A014 and subsequent RAI responses, as well as the assessment items identified in Table 2aii-1, are applicable to the results for Case A for the EPRI alternate seismic approach application Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 24 of 46 Table 2aii-1 Disposition of Key Assumptions/Sources of Uncertainty Summary of Treatment of Sources of Uncertainty per Potential Impact on Peer Review (From NTTF 2.1 SPRA Results (From PRA Element Submittal) [1] NTTF 2.1 Submittal) [1] 50.69 Impact Model Sensitivity and Disposition Seismic The [Plant A] SPRA Peer [Plant A] is a hard rock Potentially all The PSHA for Plant A is based on industry Hazard Review Team stated that the site. Any variation in SSCs evaluated consensus modeling approaches, so this is equations used to calculate uncertainty that may result during 50.69 not a significant source of uncertainty with mean amplification factor and from a different approach categorization. respect to the separation between aleatory associated variability do not to combining the aleatory variability and epistemic uncertainty in the maintain separation between variability and epistemic PSHA calculations.

aleatory variability and uncertainty is negligible epistemic uncertainty in the and more than offset by the This issue is not a significant source of PSHA calculations. variation in soil properties uncertainty for the EPRI 3002012988 used in the analysis of the Case Study application [13].

various structures.

Seismic The [Plant A] SPRA peer A sensitivity study was Potentially all The fragility calculations for Plant A are Fragilities review team stated that the performed to determine the SSCs evaluated based on industry consensus modeling understanding of the potential impact of using a during 50.69 approaches, so this is not a significant source appropriate reference larger reference earthquake categorization. of uncertainty with respect to the chosen earthquake should be as input to the SPRA. reference level earthquake. A sensitivity confirmed. The reference study was performed to determine the earthquake should reflect the potential impact of using a larger reference earthquake where most of the earthquake as input to the SPRA as part of seismic risk originates. The the NTTF 2.1 SPRA for Plant A [1]. The selection of the reference results of the sensitivity study supported a earthquake can affect the very minor impact on the SPRA results (e.g.,

realism in the seismic response <1% decrease in SCDF and ~1% decrease in due to non-linearities in the SLERF).

structures and soil/rock properties. This issue is not a significant source of uncertainty for the EPRI 3002012988 Case Study application [13].

Seismic PRA The [Plant A] SPRA peer Candidate sources of PSHA Impact PSHA Disposition Model review team had no issues with SPRA model uncertainty SPRA sources of uncertainty are identified for the Potentially all Sensitivity studies for the Plant SPRA model treatment and noted that the following: SSCs evaluated (e.g., use of the 16% lower bound or 84%

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 25 of 46 Table 2aii-1 Disposition of Key Assumptions/Sources of Uncertainty Summary of Treatment of Sources of Uncertainty per Potential Impact on Peer Review (From NTTF 2.1 SPRA Results (From PRA Element Submittal) [1] NTTF 2.1 Submittal) [1] 50.69 Impact Model Sensitivity and Disposition sources of uncertainty are during 50.69 upper bound seismic hazard fractiles) show discussed in Appendix I [2] of

• PSHA categorization. that the results are sensitive to changes in the the SPRA Quantification

• Accident hazard curve frequency values.

report. Appendix I of the Sequence SPRA Quantification report analysis (e.g., The use of the mean PGA hazard curve into considers the various technical Level 2) the Plant A SPRA model is based on industry aspects of the SPRA

• Core Cooling consensus modeling approaches, so this is development to identify key success not a significant source of uncertainty with modeling uncertainties to following respect to use of the mean PGA hazard curve investigate with sensitivity Containment for the base case quantification compared to studies. The following are key Failure or postulated use of other fractile hazard curves areas of uncertainties Venting (e.g., (e.g., 16% lower bound fractile or 84% upper identified: Very Small bound fractile). Use of the mean hazard LOCA) curve for the base SPRA model

- Seismic hazard curve

• SSC Fragilities quantification is a consensus modeling

- Equipment functionality

• Seismic HRA approach for current US industry SPRA after battery depletion models.

- Continued core cooling Section 5.7 of the Plant A following venting or NTTF 2.1 Submittal [1] This issue is not a significant source of primary containment discusses the sensitivity uncertainty for the EPRI 3002012988 failure case results for the above Case Study application [13].

- SSC fragilities sources of modeling

- Seismic human reliability uncertainty. Accident Accident Sequence Analysis Disposition analysis Sequence Analysis Impact The definition of an early radionuclide release can be a source of uncertainty during Potentially all a seismic event because the evacuation SSCs evaluated timing could be longer compared to the during 50.69 evacuation timing in the base FPIE Level 2 categorization, in PRA model. A longer time for the definition particular those of early could result in a wider range of with a accident scenarios that could contribute to Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 26 of 46 Table 2aii-1 Disposition of Key Assumptions/Sources of Uncertainty Summary of Treatment of Sources of Uncertainty per Potential Impact on Peer Review (From NTTF 2.1 SPRA Results (From PRA Element Submittal) [1] NTTF 2.1 Submittal) [1] 50.69 Impact Model Sensitivity and Disposition contribution to the the LERF end state. The Plant A definition Level2 Large, for early is assumed to be the same as the Early Release base FPIE Level 2 PRA model. This Frequency modeling assumption is consistent with the (LERF). majority of current US industry SPRA models. The LERF modeling for Plant A is based on industry consensus modeling approaches, so this is not a significant source of uncertainty with respect to the chosen definition for early release timing.

This issue is not a significant source of uncertainty for the EPRI 3002012988 Case Study application [13].

Core Cooling Core Cooling Success Criteria Following Success Criteria Containment Failure or Venting Disposition Following Containment For Plant A, long term core cooling from Failure or Venting CRD makeup following containment failure Impact or venting is assumed precluded if a seismic induced Very Small LOCA occurs. There is SSCs associated uncertainty in the flow rate associated with a with Loss of seismically induced Very Small LOCA. The Containment Heat EPRI SPRA Implementation Guide [10]

Removal identifies that a nominal constant leakage scenarios. rate of 50 gpm may be assumed. A leakage rate of 50 gpm would be sufficient to preclude credit for CRD makeup for long term scenarios following containment failure or venting. However, given that the estimated flow rate is identified in the EPRI Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 27 of 46 Table 2aii-1 Disposition of Key Assumptions/Sources of Uncertainty Summary of Treatment of Sources of Uncertainty per Potential Impact on Peer Review (From NTTF 2.1 SPRA Results (From PRA Element Submittal) [1] NTTF 2.1 Submittal) [1] 50.69 Impact Model Sensitivity and Disposition SPRA Implementation Guide as a reasonable consensus modeling approach, this is not a significant source of uncertainty with respect to the core cooling success criteria.

This issue is not a significant source of uncertainty for the EPRI 3002012988 Case Study application [13].

SSC Fragilities SSC Fragilities Disposition Impact The fragility calculations for Plant A are based on industry consensus modeling Potentially all approaches, so this is not a significant source SSCs evaluated of uncertainty with respect to the 50.69 during 50.69 categorization. However, sensitivity studies categorization. were performed to address potential uncertainties for the NTTF 2.1 submittal (e.g., reference level earthquake, fragility for Normal Offsite AC power, seismic correlation assumptions). The sensitivity studies supported minor sensitivity to realistic changes to the fragility values.

This issue is not a significant source of uncertainty for the EPRI 3002012988 Case Study application [13].

Seismic HRA Seismic HRA Disposition Impact Sensitivity studies for the base FPIE PRA Potentially all model (e.g., use of 5% and 95% HEP values)

SSCs evaluated shows that the results are sensitive to HRA model and parameter values.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 28 of 46 Table 2aii-1 Disposition of Key Assumptions/Sources of Uncertainty Summary of Treatment of Sources of Uncertainty per Potential Impact on Peer Review (From NTTF 2.1 SPRA Results (From PRA Element Submittal) [1] NTTF 2.1 Submittal) [1] 50.69 Impact Model Sensitivity and Disposition during 50.69 categorization. The base FPIE PRA model and the subsequent SPRA model are based on industry consensus approaches for its HEP calculations [11], so this is not considered a significant source or uncertainty.

The FPIE sensitivity studies assuming 95%

values indicate sensitivity to human performance. However, use of the 95%

HEPs is not considered realistic given the consistent application of a consensus HRA approach.

The SPRA for Plant A included sensitivity studies for other sensitivities to human performance that are unique to the SPRA (e.g., sensitivity to credit for operator action to recover from seismic induced relay chatter events). The SPRA results were not significantly impacted by the relay chatter sensitivity cases.

This issue is not a significant source of uncertainty for the EPRI 3002012988 Case Study application [13].

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 29 of 46 Given that the FPIE and FPRA model key uncertainties may also affect the results of the Plant A SPRA, the impact of the sources of uncertainty previously identified in for the FPIE and fire PRA on the SPRA model were reviewed.

The first two key assumptions and areas of uncertainty identified by Plant A were the same two Internal Events implementation items discussed in the response to RAI 1c for Plant A. For clarification these implementation items are shown again below.

a) Update the PRA model to account for the requirement for two Emergency Diesel Generator (EDG) cooling fans during periods when the outdoor temperature is at or above Plant A design temperature of 80°F b) Remove credit for core melt arrest in-vessel at high reactor pressure vessel (RPV) pressure conditions.

The third and fourth key assumptions and areas of uncertainty were identified by reviewing the follow up RAIs from the Plant A 50.69 license amendment request submittal. These areas of uncertainty are:

c) Uncertainty associated with the success of RHR when the reactor is in suppression pool cooling mode because of the potential for a pipe rupture following a water hammer.

d) Uncertainty associated with the success of the HPCI and RCIC turbines while passing liquid.

The key assumptions and areas of uncertainty associated with Plant A fire PRA could also potentially have an impact on the EPRI Plant A study.

The impact of the items identified above is further discussed in response to 2bi.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 30 of 46 2a.ii. Plant C Response Plant C has not identified additional key assumptions or sources of uncertainty that are relevant to the Plant C case study results beyond those noted in the reports cited in ADAMS Accession Nos. ML12248A035 and ML18052B342.

The uncertainty evaluation is updated as part of periodic model maintenance for Plant C.

2a.ii. Plant D Response The EPRI Case Studies are equivalent to the quantitative PRA results portions of the NEI 00-04 categorization process for 50.69. For each hazard PRA, the PRA basic event importance measure results have been reviewed for each component to determine the overall PRA importance of the modeled components, and the results used to compare which components are HSS from each PRA. Therefore, the EPRI Case Study application does not introduce new potential key sources of uncertainty or new modeling assumptions beyond those pertinent to the 50.69 application.

The uncertainty evaluation is updated as part of periodic model maintenance for Plant D.

b. Discuss:

i. The potential impact on the case study insights from the key assumptions and key sources of uncertainty identified in the above cited documents as well as the response to item (a) of this request. Provide the requested information separately for Plants A, C, and D.

2b.i Plant A Response To determine the impact of the additional items identified in response to question 2aii, Plant A performed two additional sensitivity studies. Similar to the study performed by Plant A in response to question 1c, the first sensitivity study evaluated the impact of including the two internal events model implementation items (items a and b listed in the response to question 2aii). The second sensitivity study evaluated the impact of including items a through d listed in the response to question 2aii.The sensitivity studies were performed using both the SPRA and Internal Events PRA models. The fire model was not quantified as it was determined that it would not provide any additional insights to the results of the sensitivity studies.

The results of the first sensitivity study showed that one fragility group became HSS in the seismic model. This is the same fragility group that was identified in the Plant A response to question 1c and was the fragility group that models the failure of the supplemental EDG fans.

The results of the second sensitivity study showed that two fragility group became HSS in the seismic model. The first fragility group was the same EDG supplemental fan fragility group identified in the first sensitivity study, while the second fragility group identified represents correlated relay failures for the B and C EDGs.

Attachment 1 Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 31 of 46 However, using the same methodology of mapping components to basic events presented in the EPRI Study, the review of the internal events results for the two sensitivity cases also showed that the components associated with the two new HSS fragility groups identified were also HSS from the internal events model, thus bounding the insights of the seismic PRA model.

In the Plant A Case Study, the fire PRA was used to bound one HSS fragility group (S-ACPA1). However, the results of the NTTF 2.1 seismic PRA submittal [1] show that this fragility group became LSS, thus no longer requiring the fire PRA to bound the insights of the seismic PRA model.

Additionally, based on the outcome of the two sensitivity studies performed, it can also be concluded that the potential impact of the fire PRA key assumptions and areas of uncertainty identified in response to question 2aii does not affect the insights gained from the Plant A case study used in the EPRI report. This is because, in these sensitivity studies, the results of internal events model PRA bound the results of the seismic PRA, i.e., there are no seismic PRA-related HSS components that are not also HSS in the internal events PRA; and the fire PRA key assumptions and areas of uncertainty only impact the results of the fire PRA model.

2b.i. Plant C Response As stated in ADAMS Accession Nos. ML12248A035 and ML18052B342 for Plant C, additional sensitivity studies beyond what have been identified in NEI 00-04 have not been identified. As noted in the responses to Parts 2.a.i and 2.a.ii of this question, the previously identified key assumptions and uncertainties are applicable to Plant C, and no additional sources have been identified for Plant C.

2b.i. Plant D Response For Plant D, there is no impact to the case study insights performed based on the key sources of uncertainty identified in attachment 6 of ML18334A363. As mentioned in 2.a.ii, no other sources of uncertainty were identified as key outside of those listed in ML18334A363.

ii. How the potential impact will be considered in the proposed alternate seismic approach.

2b.ii Plant A Response As discussed in the responses to Parts a and b of this question, there is no impact on the proposed alternate seismic approach due to key assumptions and areas of uncertainty identified for case study A.

2b.ii. Plant C Response As discussed in the responses to Parts a and b.i of this question, no additional sources have been identified for consideration for Plant C.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 32 of 46 2b.ii. Plant D Response As discussed in the responses to Parts a and b of this question, no potential impacts have been identified for Plant D.

3. Mapping of HSS SSCs between SPRA and FPIE as well as Fire PRA is an important aspect of the four case studies. The risk insights derived from the case studies are dependent on such mapping. The mapping performed for each case study is discussed in Sections 3.2 through 3.5 in the EPRI report. The following requests are related to the mapping performed to arrive at the risk insights. As applicable, the requested information should be provided separately for Plants A, C, and D.

a. The approach for determining the importance measures for SSCs from the SPRA for seismically-induced failures is discussed for case study Plants A, C, and D in Sections 3.2, 3.4, and 3.5, respectively, of the EPRI report. However, there is no discussion of how the importance measures for seismically-induced and random failures were combined to generate the final importance measure for use in developing the categorization insights.

For case study Plants A, C, and D:

i. Provide details, with justification, of how the seismically-induced and random failures were combined.

ii. If such a combination was not performed, justify that the insights developed from the case studies supporting this application are not impacted and new insights are not generated for this application.

3a.i. Plant A Response For the Plant A case study, the SSC FV importance values of seismic and non-seismic failures based on the SPRA results were not explicitly summed.

The SSC FVs for non-seismic failures based on the SPRA results were shown to be relatively low (e.g., FV less than 7E-4). The seismic fragility group FVs that were near the 5E-3 threshold for HSS were visually reviewed to reasonably determine that the combination of the seismic and non-seismic failure FVs would not result in any additional SSCs becoming HSS in the SPRA.

3a.ii. Plant A Response To support this response to RAI #3ai, a more detailed review has been performed to sum the SSC FVs of seismic and non-seismic failures for seismic fragility group FVs near the 5E-3 threshold for HSS. The results of this more detailed review do not alter the previous conclusions from the Plant A case study that the combination of the seismic Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 33 of 46 and non-seismic failure FVs would not result in any additional SSCs becoming HSS in the SPRA.

3a.i. Plant C Response For Plant C, seismically-induced and random failures were not analytically combined for the purpose of the EPRI study. Where random failures alone made a component HSS, those components were identified in Section 3.4, and are listed in Table 3-9 of the EPRI report.

3a.ii. Plant C Response An analytical evaluation was performed to confirm the results of Plant C that were presented in the EPRI Table 3-9. The evaluation combined the importance for seismically-induced and random failures. Table 3-9 was revised to clarify that entries with random failure modes should have N/A for the Fragility Group and to add an entry for the structures since they were determined to be HSS in the SPRA for Plant C.

The results show that no additional components were identified as HSS after combining seismically-induced failures and random failures. Thus, the insights developed from Plant C are not impacted by the lack of combining seismically-induced and random failure importance measures. Section 3.4.3 of EPRI 3002012988 [13] has been revised to remove text referring to use RAW > 20 criteria (see mark-ups in Attachment 2).

3a.i. Plant D Response Plant D did not combine seismically-induced and random failures in their study for EPRI 3002012988 [13].

3a.ii. Plant D Response When the case study was previously performed for Plant D, the only components determined to be High Safety Significant (HSS) were included within the risk significant fragility groups. If a fragility group was risk significant, all components within that fragility group were considered risk significant. The RAI is questioning whether additional components could also be HSS when combining the random failures with the seismic failures. In order to address this RAI, a sensitivity was performed that investigated if any risk significant random failures are not already included within the risk significant fragility groups.

In the sensitivity study, some additional components were found to be risk significant due to the contribution of the random failures. These additional components were not identified as HSS by the internal events model, but are expected to be identified as HSS by other means throughout the categorization process. The EPRI report will be updated to reflect the additional components that are HSS. Table 3-11 of the EPRI report has been marked-up to include components in the SPRA that are HSS. In addition, Section 3.6.5 has been added to the EPRI report via mark-ups to provide a discussion of defense-in-depth as a new category for HSS in Table 3-11. The mark-ups are provided in Attachment 2. The mark-ups will be incorporated into a subsequent EPRI publication.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 34 of 46

b. In several cases passive components such as tanks are mapped to operator actions such as those involving manipulation of valves to align the valves to the tank. An example of such mapping is the condensate storage tank (CST) for Plant A. While operator actions to manipulate valves does constitute an implicitly modeled component according to the NEI 00-04 guidance, it represents a component (i.e., valve) distinct from the passive component (e.g., tank) being mapped in the case studies. Categorization following the guidance in NEI 00-04 is performed on a component basis. Therefore, it is unclear whether the mapping discussed above was performed correctly by subsuming a HSS SSC that is uniquely identified by the SPRA.

For case study Plants A, C, and D, justify the mapping of HSS SSCs from the SPRA to different as well as distinct components in the FPIE and/or Fire PRA to support the insights derived from the case studies. Alternatively, update the insights derived from the case studies as identified in Section 3.6, Summary of Sensitivity Study Insights, of the EPRI report and discuss their consideration in the proposed approach.

3b. Plant A Response For Plant A, the use of explicit random failures and operator action failures are two of the possible methods that can be used to evaluate the importance of passive components in the Internal Events and Fire PRAs.

For example, the Plant A condensate storage tank (CST) was identified as high safety significant from the seismic PRA. Since the CST is a passive component with a low probability of failure the explicit rupture failure mode does not drive the importance of the CST in the Full Power Internal Events model or the Fire PRA model. However, that does not mean the CST inventory is not important for these models. To capture the importance of the CST a manual action to refill the CST was identified as an event to capture the overall importance of the CST. This action does require valve manipulation, but it also requires the CST to be operable and capable of being refilled. Failure of the valve or the CST itself would fail the action of refilling the CST inventory. For these reasons it is appropriate to map the manual action basic event to the CST, in addition to the explicit rupture failure mode, to determine the importance of the CST from the Internal Events and Fire PRA models.

Additionally, if the manual action was not mapped to the CST itself and only the valve, the CST would still be categorized as HSS by function association to the valve and CST and most likely as well as by other aspects of categorization such as Passive and Defense in Depth.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 35 of 46 3b. Plant C Response The following information provides justification for mapping HSS SSCs from the SPRA to different as well as distinct components in the FPIE and/or Fire PRA for Plant C.

Direct Mapping (Explicit Modeling):

A large majority of SPRA basic events are directly aligned with the basic events in the IE PRA or Fire PRA model. Thus, mapping of basic events to components in the SPRA that are also modeled in the internal and fire PRAs is consistent.

Indirect Mapping (Implicit Modeling):

There are a few SSCs in the Plant C SPRA that are not directly included in the IE PRA or Fire PRA model. In some cases, subcomponents are not directly modeled in the IE PRA or Fire PRA models. For example, the trip and throttle valve for the AFW pump is modeled in the IE PRA. Seismic-induced relay chatter could cause the valve to close, stopping the pump. The relay was considered part of the valve boundary in the IE PRA, so it was not directly modeled. For the SPRA, the relay was directly modeled to spuriously close the valve. For the purpose of EPRI report, importance of the relay is mapped to the importance of the AFW pump trip and throttle valve. Another example is DG exhaust silencers. The silencers are not modeled in the IE PRA or Fire PRA model as separate components since they are passive; however, they are considered part of DG boundary for IE PRA and Fire PRA. The silencers are modeled in the seismic PRA.

For the purpose of the EPRI report, importance of DG silencers is mapped to the importance of DGs.

SSCs Specific to Seismic PRA Only:

A few components only appear in the SPRA because they do not have a credible failure mode in the IE PRA, Fire PRA, or have been screened out for other reasons. Some of these components were determined to be HSS in the Plant C SPRA model. For example, chilled water is not required as a mitigating system for the Plant C. However, seismic failure of the chilled water chiller anchorages could break the service water piping connections, resulting in the failure of ultimate heat sink. Based on the screening criteria of the internal flooding PRA, the chiller pipe rupture scenarios were screened out as non-significant contributors and are not modeled in the internal flooding PRA.

However, the SPRA does model the potential flooding failures from the chillers.

3b. Plant D Response Plant D did not map any passive components to operator actions. The operator actions and passive components credited in the model were modeled explicitly.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 36 of 46

c. Tables 3-8 and 3-10 of the EPRI report contain discussions of the mapping of passive or implicitly modeled SSCs for case study Plants C and D. The discussion indicates that the seismic fragility groups that model building failures were mapped to basic events in the FPIE PRA that represent failure of the SSCs within the building, typically the common cause failure (CCF) of the SSCs. However, the mechanics of such mapping as well as the consequences are unclear. Further, the report (Sections 3.2.5, Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant SSCs, and Table 3-4) lacks a discussion of the approach used to map building failures for Plant A. Given that buildings have multiple SSCs within them, seismically-induced building failure would impact each SSC in buildings. However, review of Tables 3-9 and 3-11 of the EPRI report indicates that building failures were not HSS and therefore, did not need to be mapped to any SSCs in the FPIE.

It is unclear whether mapping seismically-induced building failure event in a SPRA to one SSC which is found to be HSS (via either individual or CCF event) from the FPIE PRA was used for case study Plants A, C, and D. Further, if such mapping was used, it is unclear whether such an approach would capture the impact of building failure on the remaining SSCs, especially if such SSCs are of low safety significance (LSS).

i. Clarify whether mapping seismically-induced building failure event in a SPRA to one SSC which is found to be HSS (via either individual or CCF event) from the FPIE PRA was used for any or all of case study Plants A, C, and D.

ii. If such mapping was not used for any or all of case study Plants A, C, and D, explain intent of the discussion of such mapping in Tables 3-8 and 3-10 of the EPRI report in the context of the insights from the case studies and the proposed alternate seismic approach.

iii. If such mapping was employed for any or all of case study Plants A, C, and D, discuss how a SSC (or SSCs) within a building under consideration was identified for mapping the seismically induced building failure given that buildings have multiple SSCs within them, all of which may not have CCF basic events in FPIE and some of which may be LSS.

iv. If such mapping was employed for any or all of case study Plants A, C, and D, discuss the approach used to map building failures for Plant A. Justify any differences in the approach followed by Plant A as compared to Plants C and D. The justification should include the impact of the differences, if any, on the risk insights derived from the case studies.

3c.i. Plant A & D Response No seismically-induced building failure events in the SPRA meet HSS criteria established in NEI 00-04 or EPRI 3002012988 [13]. This is attributed to relatively high Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 37 of 46 seismic capacity values, i.e. median fragility (Am) for buildings. So, the mapping to an FPIE PRA basic event is not applicable.

A new Section 3.6.6 is being added to the EPRI report to discuss categorization of civil structures per mark-ups provided in Attachment 2. The mark-ups will be incorporated into a subsequent EPRI publication. The mark-ups include the removal of building failures in Table 3-10 since they are not applicable to Plant D. The corresponding Table 3-4 for Plant A does not address building failures and will remain as such since no HSS Building failures were identified.

3c.ii-iii. Plant A & D Response Based on the response to 3.c.(i), mapping is not applicable.

3c.i. Plant C Response Plant C uses the following approach to model building failures in the SPRA.

A building is considered to be a unique SSC. Its importance is not tied to other SSCs for the purpose of calculating importance measures. Plant C does not have a practice of mapping importance of seismically-induced building failure event in a SPRA to one SSC which is found to be HSS (via either individual or CCF event) from the FPIE PRA.

Plant C uses a logic modeling approach to either 1) map building failure to the most obvious component(s) within the building or 2) model building failure direct to core damage or large early release. For example, when modeling failure of the EDG building, the most obvious components to map the EDG building failure would be to the basic events associated with the EDGs fail to start. The Auxiliary Building, Control Building, and Containment were all modeled as direct to core damage and large early release.

It should be noted that this mapping approach does not change the resulting importance measures of the mapped and unmapped components.

An alternate approach is to map all components within the building to the building failure.

However, this alternate approach would not change the resulting importance measures of the mapped and unmapped components and was not applied in the Plant C seismic PRA.

Derivation of building importance for the EPRI report:

When determining importance of buildings, Plant C did not map a building failure to all of the components located inside the building. As stated above, Plant C mapped building failure to a select few most obvious component(s) within the building. For Plant C, all seismic class I buildings (e.g., containment, auxiliary building, control building, emergency diesel generator building, fuel handling building, AFW pump house, nuclear safety cooling wter towers, RWST, and CST) would be determined to be HSS in accordance with categorization process that Plant C follows.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 38 of 46 3c.ii. Plant C Response The corresponding Table 3-8 for Plant C is retaining and editing the entry for building failures since Plant Cs EPRI study results include SPRA HSS building(s). Mark-ups for Table 3-8 in the EPRI report are provided in Attachment 2.

3c.iii. Plant C Response An approach used by Plant C to map the seismically-induced building failure is not dependent on a component being HSS in the FPIE PRA. In addition, Plant C does not map seismically-induced building failure to all components present in the building.

Instead, Plant C uses an approach described in Part 3.c.i of this question where building failure is mapped to the most obvious component(s) present inside the building or mapped direct to core damage and/or large early release if the failure is catastrophic.

In addition to the above considerations, it should be noted that a building is considered its own component, having unique tag number. So from the perspective of NEI 00-04 categorization process, the building importance and the importances of components within the building should not be combined. The assumption of direct core damage and large early release impact accounts for any potential common impacts of building failure on multiple components within the building.

3c.iv. Plant A Response Plant A did not map any building failures since none of the building failures at Plant A met the criteria for HSS.

For clarification, building failures were not mapped to every SSC housed within them.

Mapping building failures directly to every SSC housed within them would result in creating an overly large and detailed fault tree model that would impact the feasibility to quantify the SPRA model in a practical manner. Instead, surrogate SSC basic events were chosen to map building failures on a train or system level (e.g., basic events for pump fails to run or CCF of pumps to run).

d. The discussion in Tables 3-6 and 3-8 of the EPRI report indicates that containment penetrations are mapped to the plant damage state in the FPIE that represents direct LERF caused by containment bypass. Therefore, it appears that the mapping is performed to the end state and not to SSCs. It is unclear how the mapping can capture the safety significance of the impacted SSCs such as electrical and mechanical containment penetrations, fuel transfer tubes, and containment hatches. Further, it is unclear how containment penetration failures for Plants A and D were mapped.

i. Discuss, with justification, how the HSS categorization of SSCs relevant to containment penetration failures from the SPRA is captured by the mapping to the end state.

ii. Discuss the approach used to map containment penetration failures for Plants A and D.

Justify any differences in the approach followed by Plants A and D as compared to Plant Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 39 of 46 C. The justification should include the impact of the differences, if any, on the risk insights derived from the case studies.

3d.i/3d.ii Summary Response A new Section 3.6.5 is being added to the EPRI report to discuss use of the NEI 00-04 Defense-in-Depth criteria per mark-ups provided in Attachment 2.

The mark-ups will be incorporated into a subsequent EPRI publication. Table 3-4 of the EPRI report for Plant A does not address containment penetrations and will remain as such since no HSS containment penetrations were identified.

The mark-ups include the removal of containment penetrations in the corresponding Table 3-8 for Plant C since they are not applicable to Plant C. The corresponding Table 3-10 for Plant D will add an entry for containment penetrations since Plant Ds EPRI study results include SPRA HSS containment penetration(s). Mark-ups for Table 3-10 are provided in Attachment 2.

3d.i. Plant A Response No seismically-induced containment penetration failure events in the SPRA meet HSS criteria established in NEI 00-04 or EPRI 3002012988 [13] for plant A. This is because containment penetrations are considered seismically rugged with relatively high seismic capacity values, i.e. median fragility (Am). So, the mapping to an FPIE PRA basic event is not applicable.

3d.ii. Plant A Response Based on the response to 3.d.(i), mapping is not applicable.

3d.i. Plant C Response For Plant C, containment penetrations, such as electrical and mechanical penetrations, hatches and fuel transfer tubes are considered to have high capacity, or their failures are modeled within the seismic PRA to represent failure of containment.

The seismic induced failure of containment isolation valves is mapped to basic events in the Level 2 PRA Containment Isolation fault tree logic and not to the end state. The Plant C SPRA does model seismic induced failure of containment isolation valves that could result in a containment bypass and LERF.

3d.ii. Plant C Response Not applicable to Plant C.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 40 of 46 3d. Plant D Response For Plant D, a bounding fragility was calculated for components that would cause a containment penetration failure. Failure of this fragility group would lead directly to a large

(>2 in) containment isolation failure. The containment penetration group was found to be risk significant in the SPRA, therefore, all penetrations would be categorized as HSS. Table 3-11 of the EPRI report has been marked-up to include an entry for containment penetrations that are HSS. In addition, Section 3.6.5 has been added to the EPRI report via mark-ups to provide a discussion of defense-in-depth as a new category for HSS in Table 3-

11. The mark-ups are provided in Attachment 2. The mark-ups will be incorporated into a subsequent EPRI publication.

7. Paragraphs 50.69(c)(1)(i) and (ii) require a licensees PRA to be of sufficient quality and level of detail to support the SSC categorization process, and that all aspects of the integrated, systematic process used to characterize SSC importance must reasonably reflect the current plant configuration and operating practices, and applicable plant and industry operational experience. The guidance in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, (ADAMS Accession No. ML052910035), specifies sensitivity studies to be conducted for each PRA model. The sensitivity studies are performed to ensure that assumptions associated with these uncertainty parameters (e.g., human error, common cause failure, and failure probabilities) do not mask the SSC(s) importance.

LAR Section 4.1 identifies RG 1.174, Revision 2 (ADAMS Accession No. ML100910006), as an applicable regulatory requirement/criterion. RG 1.174 has been updated to Revision 3, dated January 2018 (ADAMS Accession No. ML17317A256). Regulatory Guide 1.174, Revision 3, cites NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (ADAMS Accession No. ML17062A466), as related guidance. In Section B of RG 1.174, Revision 3, the guidance acknowledges specific revisions of NUREG-1855 to include changes associated with expanding the discussion of uncertainties. LAR Section 3.2.7 states that the detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855, March 2009, Revision 0 (ADAMS Accession No. ML090970525) and Section 3.1.1 of EPRI Technical Report (TR)-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments. The NRC staff notes that for the FPIE (includes internal flooding) and Fire PRA models only one and sixteen sources of uncertainty were identified, respectively.

NUREG-1855 has been updated to Revision 1 as of March 2017 (ADAMS Accession No. ML17062A466). The NRC staff notes that NUREG-1855, Revision 1, provides guidance in stages A through E for how to treat uncertainties associated with PRA models in RI decision-making. Revision 1 of NUREG-1855 cites EPRI TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainties.

Additionally, Section 3.3.2 of RG 1.200 Revision 2 defines key assumptions and sources of uncertainty as follows:

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 41 of 46 A key assumption is one that is made in response to a key source of model uncertainty in the knowledge that a different reasonable alternative assumption would produce different results, or an assumption that results in an approximation made for modeling convenience in the knowledge that a more detailed model would produce different results. For the base PRA, the term different results refers to a change in the risk profile (e.g., total CDF and total LERF, the set of initiating events and accident sequences that contribute most to CDF and to LERF) and the associated changes in insights derived from the changes in the risk profile. A reasonable alternative assumption is one that has broad acceptance within the technical community and for which the technical basis for consideration is at least as sound as that of the assumption being challenged.

A key source of uncertainty is one that is related to an issue in which there is no consensus approach or model and where the choice of approach or model is known to have an impact on the risk profile (e.g., total CDF and total LERF, the set of initiating events and accident sequences that contribute most to CDF and to LERF) such that it influences a decision being made using the PRA. Such an impact might occur, for example, by introducing a new functional accident sequence or a change to the overall CDF or LERF estimates significant enough to affect insights gained from the PRA.

Based on the information provided in the LAR, the NRC staff request the following information to confirm the key assumptions and sources of uncertainty provided for the 50.69 risk-informed application in Attachment 6 of the LAR were properly assessed from the base PRAs that have received peer reviews. The NRC staff requests that the licensee provide the following:

a. A brief description of the process and the criteria used to identify, from the initial comprehensive list of uncertainties and assumptions for the base PRA model(s)

(including those associated with plant specific features, modeling choices, and generic industry concerns), the application specific key assumptions and sources of uncertainties provided in LAR Attachment 6. Describe how the key assumptions and sources of uncertainty are determined consistent with the definitions in RG 1.200 Revision 2.

7a. Response The PRA key assumptions and sources of uncertainty are determined consistent with the definitions in RG 1.200 Revision 2 [12].

For both the Calvert Cliffs Full Power Internal Events (FPIE) PRA model (includes internal floods) and the internal Fire PRA model (FPRA), a description of the process and criteria used to identify key assumptions and sources of uncertainty are described below.

For each ASME PRA element as defined in American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009 and qualified by RG 1.200, Revision 2 (e.g. Initiating Events, System Analysis, Accident Sequences, Ignition Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 42 of 46 Frequency, Equipment Selection, etc.) potential key assumptions and uncertainties are identified during that PRA elements analysis phase. For example, the Calvert Cliffs PRA Accident Sequence Notebook includes a section identifying assumptions and sources of uncertainty.

As part of the model uncertainty analyses, the potential key assumptions and uncertainties, identified for each ASME PRA element, are reviewed to identify those uncertainties and assumptions which may have the potential to affect the results in order to determine that reasonable alternative assumptions, if available, do not affect the decision. These key assumptions and uncertainties are further reviewed and aggregated in the Calvert Cliffs PRA Uncertainty Assessment Notebooks. The comparison of the parametric (propagated) mean CDF and LERF values to the point estimate CDF and LERF values shows that the point estimate values are reasonable representations of the propagated mean values. Point estimate CDF and LERF values can be used for this application.

Also, as part of the model uncertainty analysis, each applicable model uncertainty item that is shown in Table A-1 of EPRI TR-1016737 [3], was captured and assessed in the Uncertainty Assessment notebook.

Each potential key assumption and uncertainty as identified in the Uncertainty Notebooks was assessed and characterized for impact on applications in general. The key assumptions and uncertainty were characterized as:

• Using consensus approaches,

• Introducing model conservatisms,

• Assessing as not having significant numerical impact to applications,

• Considering other valid criteria.

Eighteen sensitivity cases were also performed as part of the model uncertainty analysis, notably for impact of the plant-specific human error probabilities (HEPs) and common cause factor (CCF) values. As part of this analysis, human error was identified as a candidate key source of model uncertainty.

For the Calvert Cliffs 50.69 LAR analysis, the assumptions and uncertainties and their characterizations in the FPIE and FPRA Uncertainty Assessment Notebooks were further reviewed specific to this application.

Parametric uncertainties of basic events and initiating events are captured in the PRA analyses notebooks (e.g. Initiating Event (IE), Internal Flood (IF), and Data (DA) and, Ignition Frequencies (IGN)). The parametric uncertainties of events are typically a mean value, a statistical distribution type (e.g. Beta, lognormal, etc.) and parameters for mean value, shape, and scale that define the distribution. As part of the PRA uncertainty Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 43 of 46 analysis, a Monte Carlo sampling process is also generated to identify a reasonable mean, median, 5%, and 95% distribution values for CDF and LERF using the point estimate quantified cutsets. Correlation between events is accounted for in the Monte Carlo process.

The response to RAI 7c provides information on additional analysis performed as a result of a review of NUREG-1855 Revision 1 [9].

b. Provide a summary list of any new key assumptions and sources of uncertainty that have been identified for the application as a result of resolving question 7.a and discuss how each newly identified key assumption and uncertainty will be dispositioned in the categorization process. The discussion should clarify whether the licensee is following the guidance in Section 5 of NEI 00-04 by performing sensitivity analysis or other accepted guidance such as NUREG-1855.

7b. Response No new key assumptions and sources of uncertainty have been identified for the application as a result of resolving question 7a. Uncertainty evaluations associated with the risk categorization process are addressed using the processes discussed NEI 00-04.

The 50.69 categorization analysis includes performing sensitivity studies on human error rates, common cause failures, and maintenance unavailabilities to ensure that assumptions of the PRA are not masking the importance of an SSC. As discussed in the response to RAI 7a above, HEPs were identified as a candidate key source of model uncertainties for this application.

c. Confirm that the process described in question 7.a is consistent with NUREG-1855, Revision 1, or other NRC-accepted methods (e.g., NUREG-1855, Revision 0). If deviating from the current guidance provided in NUREG-1855, Revision 1, provide a basis to justify the methods use in the 10 CFR 50.69 categorization process (e.g., exclusion/consideration of EPRI TR-1026511).

7c. Response For this application, the initial process for assessing key sources of assumptions and uncertainties was performed consistent with NUREG-1855, Revision 0 [8]. The response to RAI 7a provides a brief description of this process.

Subsequently and in response to this RAI, NUREG-1855, Revision 1 [9], was reviewed to assess the process and the criteria used to identify the application specific key assumptions and sources of uncertainty provided in LAR Attachment 6. Stage E (Assessing Model Uncertainties) of the NUREG provides guidance on identifying key model uncertainties.

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 44 of 46 Substep E-1.1 of NUREG 1855, Revision 1 [9] recommends a review of the supporting requirements (SR) in the ASME/ANS PRA standard. This is consistent with the Calvert process for identifying potential key assumptions and sources of uncertainties during the PRA development phase, as described in the response to RAI 7a.

Substep E.1.1 also identifies EPRI reports 1016737 [3] and 1026511 [7] as guidance and examples of generic sources of model uncertainties and related assumptions. As discussed in the response to RAI 7a, EPRI 1016737 [3] was used for a systematic review of generic sources of internal events (including internal floods) sources of uncertainty.

For the Calvert Cliffs Fire PRA model, the review of NUREG-1855, Revision 1 [9],

identified the need to systematically assess the generic fire PRA uncertainties in Appendix B of EPRI TR-1026511 [7]. This additional assessment of key sources of fire generic uncertainties has now been performed, consistent with the definitions in RG 1.200 Revision 2. No new potential key sources of model uncertainty or assumptions were identified because of this review).

Substep E-1.2 of NUREG 1855, Revision 1 [9], identifies a process for identifying sources of model uncertainty and related assumptions that are relevant to the base PRAs, but may be screened from further consideration because they are irrelevant to the application. For the internal events (including internal flood) and fire PRA models, no such screening was performed for this 50.69 application. Each unscreened base PRA model uncertainty and related assumption were initially considered as potentially relevant, and each was assessed for potential impact on the 50.69 application.

Substep E-1.3 of NUREG 1855, Revision 1 [9], states that the potential impact of each identified source of model uncertainty must be determined. This determination was performed as described in the response to RAI 7a. The potential impact was also assessed as part of the additional assessment performed for the review of generic fire uncertainties in EPRI TR-1026511 [7].

Substep E-1.4 of NUREG-1855, Revision 1 [9], discusses a qualitative screening of model uncertainties and related assumptions, based on the use of consensus models.

As discussed in the response to RAI 7a, the use of consensus models was one approach used to characterize model uncertainties and related assumptions. This characterization was then used to assess if the uncertainty was a potential key uncertainty.

Substep E-1.5 of NUREG-1855, Revision 1 [9], discusses identification and characterization of model uncertainties and related assumptions associated with model changes. This application has not introduced model changes to the PRA. Calvert Cliffs PRA model updates are performed consistent with NRC-endorsed version of the Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 45 of 46 ASME/ANS PRA standard in accordance with the latest revision of NRC Regulatory Guide 1.200 [12].

References:

1. Exelon Generation Company, LLC letter to USNRC, Seismic Probabilistic Risk Assessment Report, Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident, dated August 28, 2018 (RS-18-098) (ML18240A065)

2. PB-PRA-020.006, PBAPS Seismic PRA Quantification Notebook, Rev. 0

3. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Palo Alto, CA: November 2008.

4. Deleted.

5. Deleted.

6. Deleted

7. EPRI TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applicatoins with a Focus on the Treatment of Uncertainty, EPRI, Palo Alto, CA, December 2012.

8. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Rev. 0, March 2009.

9. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Rev. 1, March 2017.

10. Electric Power Research Institute, Seismic PRA Implementation Guide, Report 3002000709, December 2013.

11. Electric Power Research Institute (EPRI), An Approach to Human Reliability Analysis for External Events with a Focus on Seismic, Report 3002008093, Palo Alto, CA, December 2016.

12. Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

13. Electric Power Research Institute (EPRI), Alternative Approaches for Addressing Seismic Risk in 10CFR50.69 Risk-Informed Categorization, Report 3002012988, Palo Alto, CA, July 2018.

14. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, "Peach Bottom Atomic Power Station, Units 2 and 3, Renewed Facility Operating License Nos. DPR-44 and DPR-56, NRC Docket Nos. 50-277 and 50-278, Response to RAI for Application to Adopt 10 CFR 50.69 Risk-informed categorization and treatment of SSCs," May 7, 2018 (ADAMS Accession No. ML18128A009).

Response to Request for Additional Information Nos 1, 2, 3, and 7 in Support to License Amendment Request to Adopt 10 CFR 50.69 Page 46 of 46

15. Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, "Peach Bottom Atomic Power Station, Units 2 and 3, RFOL Nos. DPR-44 and DPR-56, NRC Docket Nos. 50-277 and 50-278, Supplemental Information to Support Application to Adopt 10 CFR 50.69 Risk-informed categorization and treatment of SSCs for NPPs," June 6, 2018 (ADAMS Accession No. ML18157A260).

Attachment 2 EPRI 30002012988 - 50.69 Seismic Alternative markups

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS.

The SPRA also models non-seismic failures (e.g., failure to start, run) of SSCs that can impact mitigating functions.

The results from the SCDF and SLERF quantification and importance show that 36 fragility groups and two non-seismic failure basic events are considered HSS. Table 3-9 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table.

3.4.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

These SSC failures are modeled as basic events in the FPIE model. There are over 6000 basic events in the unit 1 FPIE PRA that model over 1500 SSCs. The FPIE PRA is quantified using the EPRI PRAQuant software [22] to obtain the CDF and LERF cutsets. The truncations selected for these meet the PRA Standard for acceptable truncation. For CDF, a truncation of 1.0E-13 was used, while a truncation of 1.0E-15 was used for LERF. The importances are obtained from the cutsets directly (i.e. ACUBE is not used). A component is considered HSS if the sum of the CDF (LERF) F-Vs of the failure modes for the component is greater than 5.0E-03, or if any failure mode CDF (LERF) RAW is greater than 2.0. A common cause failure basic event is considered HSS if the CDF (LERF) RAW is greater than 20.

3.4.4 Fire PRA High Safety Significant Evaluation The Fire PRA uses the FPIE model accident sequences. Fire scenarios were postulated and the equipment and cable failures were propagated through the appropriate accident sequences during the quantification process. The FRANX software [23] and the FTREX [26] quantification engine were used to quantify each fire scenario. FRANX software quantifies a CCDP or a conditional large, early release probability (CLERP) using the Minimal Cutset Upper Bound calculation. The CCDP or CLERP is combined with the product of the fire scenario ignition frequency, NSP and severity factor (SF) to calculate a CDF or LERF.

The FRANX function to create a one top model was used. The one top model was quantified using the EPRI PRAQUANT software and the FTREX quantification engine to obtain a single cutset file which is used for fire risk results, importance measures, and uncertainty evaluation.

The FRANX software interacts with EPRIs CAFTA software suite, which is utilized by the FPIE PRA model. FTREX is the quantification software used for Units 1 and 2 Fire PRA, consistent with the FPIE model. The truncation values for CDF and LERF were 1E-12 and 1E-12 respectively. Similar to internal events the component importances were evaluated using the methodology described in section 3.2.3. The determination of HSS or LSS from the Fire PRA can be found in table 3-1 of this report.

3-31

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Table 3-8 Plant CB Passive or Implicitly Modeled SSCs Scope Description Buildings Building failures are not typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing keythe SSCs within the building or as leading directly to core melt or large early release. Therefore, in the comparison with the FPIE PRA or, Fire PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE and Fire PRA that model failure of the SSCs within the building (typically the CCF of the SSCs).

See Section 3.6.6 for additional discussion of categorization of Civil Structures.

Containment penetrations Containment penetrations except for containment isolation such as electrical and valves, are typically not modeled in the FPIE and Fire given mechanical penetrations, their relatively low probability of random failure. The SPRA fuel transfer tube, and models failure of the containment building, which includes containment hatches electrical and mechanical penetrations, the hatches, and fuel transfer tube. Failure of these result in direct LERF due to containment bypass.

Relays The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (e.g., starting/stopping of pumps, opening/closing of valves). Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE and Fire PRA.

Piping Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3.4.6 Analysis and Conclusions As shown in Table 3-9, most SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE and/or the Fire PRA. The 28 seismic fragility groups in the SPRA model over 63 SSCs, of which 23 are also HSS in the FPIE and/or Fire PRA. Eight have non-seismic failure mechanisms (marked as Random Failure in Table 3-9) that are HSS in the SPRA and are also HSS in the FPIE and/or the Fire PRA.

There are five seismic fragility groups that are HSS in the SPRA but not for the other considered risk categories (FPIE PRA, Fire PRA, Implicit Modeling, Passive Categorization). These five fragility groups represent correlated seismic failures or seismic induced internal flooding failures. These insights contributed to the creation of the approach described in Section 2.3.1 to account for the possibility of seismically correlated failures or seismic interaction related failures.

3-33

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 Sensitivity Study Results for Plant C Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Implicit Fire PRA Passive Failure Review Modeling Seismic Description Fragility of Fragility Component Mode of Cat.

System Group Group Description Component ID SSC Comments S_1ACBS-120 VAC 120 VAC 1ACBSQ3VI1 - Functional 120PN-Panel CB 180 Vital Panel 1ACBSQ3VI4 (After)

CB180 S_1ACIV-AC Inverter Vital AC 1ACIVY3IA1 - Functional 120-CB180 Inverter 11807Y3ID4 (After)

CB180 SFTY S_1ACSD SF Sequencer 1ACSDU3001 - Functional Features

-SEQ Board 1ACSDU3002 (After)

Sequencer Battery S_1DCBC Battery 1AFPMP4002 - Functional Charger

-CB180 Charger 1AFPMP4003 (After)

CB180 Emergency 125 VDC Power S_1DCBS- 125 VDC Functional MCC 1AD1M 1AFPMP4001 AC/DC MCC-AB MCC (After) and 1BD1M S_1DCBS- All 125 VDC 125 VDC Functional RL1AFW15129 MCC-ALL MCC MCC (After)

S_1DCBS- 125 VDC 1E 125 VDC 1CCTKT4001 - Functional PN- Distr. Panel -

Distr. Panel 1CCTKT4002 (After)

CB180-1E CB180 S_1DCBS- 125 VDC 125 VDC 1DCBCB3CAA - Functional SGR- Switchgear Switchgear 1DCBCB3CDB (After)

CB180 CB180 125 VDC S_1DCBY 125 VDC 1DCBCS3DCA - Functional Battery

-CB180 Battery 1DCBCS3DCB (After)

CB180 3-34

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Implicit Fire PRA Passive Failure Review Modeling Seismic Description Fragility of Fragility Component Mode of Cat.

System Group Group Description Component ID SSC Comments N/A5 N/A5 Incoming Incoming Random 1ACCBA 1AA02 FDR 1AA0205 1AA02 FDR Failure A0205--D BKR BKR N/A51AC N/A5Incomin Incoming Random CBBA030 g 1BA03 1BA03 FDR 1BA0301 Failure 1--D FDR BKR BKR N/A51DC N/A5125 125 VDC Emergency Random BYDD1B- VDC Battery Battery 1DCBCS3DD1 Power Failure

---F 1DD1B 1DD1B AC/DC N/A51RPC N/A5Reactor Reactor Trip BS6--- Trip Breaker Random Breaker A, 1RTA, 1RTB RTAD, A, Breaker Failure Breaker B RTBD B N/A51SW N/A5Breaker Breaker to A FN1-F01-- to A Train Train NSCW Random 11ACDCS3ABB

-X to F04- NSCW Fan Fan #1, #2, Failure

-X #1, #2, #3, #4 #3, #4 S_1AFPM Both AFW AFW Motor 1DCBSS3DCA - Functional

-MDP MDP Driven Pump 1DCBSS3DCC (After)

S_1AFPM AFW TURB 1DCBSQ3DA1 - Functional AFW TDP

-TDP Driven Pump 1DCBSQ3DD1 (After)

Relay for Relay for Auxiliary S_1AFW- AFW Pump AFW Pump 1DCBSS3DSA - Functional Feedwater AOV-RLY Turb Trip & Turb Trip & 1DCBSS3DSD (During)

Throttle VLV Throttle VLV N/A5AFW, AFW, N/A51AF TDAFW TDAFW Random XV015---- 11302U4015 Pump, Disch, Pump, Disch, Failure

-P Isolation Isolation 5

This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-35

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Implicit Fire PRA Passive Failure Review Modeling Seismic Description Fragility of Fragility Component Mode of Cat.

System Group Group Description Component ID SSC Comments Component S_1CCTK CCW Surge CCW Surge 1DCBYB3BYA -

Cooling Anchorage Correlated Failure drives the SSC to HSS

-4 Tank Tank 1DCBYB3BYA Water Diesel Diesel 1DGG4001 - Functional S_1DG Generator Generator 1DGG4002 (After)

DG AIR DG Vent S_1DGD Supply 1DGDM12050 - Functional Emergency Damper for M-VENT Damper for 1DGDM12054 (After)

Diesel Fans 1-4 Fans Generator 1DGFNB700200 DG BLDG DG BLDG S_1DGFN 0- Functional ESF Supply ESF Supply Correlated Failure drives the SSC to HSS

-FAN 1DGFNB700400 (After)

Fan Fan 0

Anchorage Containmen Flooding causes LUHS drives the SSC to S_1FC- Failure of CTB AUX t Heat 1ACUA7002000 Anchorage HSS. Considered as a flooding ACU-FLD ACU with Cooling Unit Removal interaction in the Correlation Review.

NSCW FLD Nuclear S_1SWFN fan-NUC 1NSCWW4001F Service NSCW Tower

-NSCW- SERV Cool 01 - Anchorage Cooling Fans FANS Tower 1NSCW4002F04 Water Auxiliary Component S_1XCTK ACCW Surge ACCW Surge 1XCTKT4001 Anchorage Correlated Failure drives the SSC to HSS Cooling -4 Tank Tank Water Seismic S_CB- Failure of CB 1CHLRC700100 Correlated anchorage failure of two Essential Chilled CHLR- ESF Chillers CB ESF 0-Anchorage trains of ESF Chillers leads to NSCW- Cause NSCW Chiller 1CHLRC700200 flooding such that LUHS drives the Water FLOOD Flood on CB 0 SSC to HSS 260 3-36

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Implicit Fire PRA Passive Failure Review Modeling Seismic Description Fragility of Fragility Component Mode of Cat.

System Group Group Description Component ID SSC Comments Residual N/A6 N/A6 RCS to RCS to RHR Random Heat 1LPMVH RHR Pump B Pump B 1HV8702A Failure Removal V8702A-D Suction MOV Suction MOV 1RCPOPV Pressurizer Pressurizer 1PORV0455,1PO Random Pressurizer 0455A-U, PORVs PORVs RV456 Failure 456-U Containment, Auxiliary Building, Control Building, HSS due to RAW criteria in the SPRA.

Category 1 Emergency Structures Civil Diesel Generator Structural See Section 3.6.6 for additional Structures Building, AFW discussion of categorization of Civil Pump House, Structures.

Nuclear Safety Cooling Water Towers 17 17 1 0 Totals 298 23 Seismic Fragility Groups 5 classified as HSS via overlapping 50.69 criteria 6

This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-37

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Table 3-10 Plant D Passive or Implicitly Modeled SSCs Scope Description Buildings Building failures are not typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing the SSCs within the building. Therefore, in the comparison with the FPIE PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE PRA that model failure of the SSCs within the building (typically the CCF of the SSCs).

Electrical Panels such as Failures of MCR panels are typically not modeled in the FPIE Main Control Room PRA because of their relatively low probability of random (MCR) Panels failure. The SPRA models failure of the panels as failing Operator actions that rely on the panels for indications and control of mitigating functions. Therefore, the seismic failure of the MCR panels fragility group was mapped to an HEP in the FPIE PRA.

Containment penetrations Containment penetrations except for containment isolation such as electrical and valves, are typically not modeled in the FPIE given their mechanical penetrations, relatively low probability of random failure. The SPRA model fuel transfer tube, and includes failure of the containment penetrations by modeling a containment hatches fragility group for containment penetrations, which includes electrical and mechanical penetrations, hatches, and the fuel transfer tube. Failure of these SSCs are modeled to result in direct LERF due to containment bypass.

Relays The FPIE PRA does model some relays for impacts on the functions of actuation systems (e.g., Safety Injection, Containment Depressurization). The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (e.g., starting/stopping of pumps, opening/closing of valves). Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE PRA.

Piping Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3.5.5.3 Seismic Fragility Groups and Common Cause Failure Nearly all of the seismic fragility groups in the SPRA model correlated failures of the SSCs they represent. That is, given the common design, location, installation, orientation, and function of the SSCs, it is expected that both trains SSCs will fail given the same ground motion during a seismic event. Therefore, the seismic fragility groups model common cause failure (CCF) of the SSCs during seismic events. In the mapping of the seismic fragility groups to the corresponding 3-40

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 Sensitivity Study Results for Plant D Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Breaker Norm FDR Chatter, Low CNTL & 1-BKR-212-SEIS_0-24 Chatter Voltage AUX Vent BD A001/10B-A Switchgear 1A1-A Breaker 480 V Chatter, Low Shutdown BD 1-BKR-212-SEIS_0-24 Chatter Voltage 1A1A Nor A001/1B-A Switchgear Feed Norm FDR Breaker FOR RX Chatter, Low 1-BKR-212-SEIS_0-24 MOV BD Chatter Voltage A001/8B-A 1A1-A (1-Switchgear MCC-213-A1)

Breaker Norm Supply Chatter, Low 1-BKR-212-AC Power SEIS_0-24 from 6.9KV Chatter Voltage A002/1B-A SD BD 1A-A Switchgear Breaker Norm FDR for Chatter, Low RX MOV BD 1-BKR-212-SEIS_0-24 Chatter Voltage 1A1-A (1- A002/8B-A Switchgear MCC-213-A1)

Breaker Norm FDR for Chatter, Low C&A Vent BD 1-BKR-212-SEIS_0-24 Chatter Voltage 1B1 (1-MCC- B001/10B-B Switchgear 215-B1) 1-BKR-212-Breaker B001/1B-B, Chatter, Low 1-BKR-212-SEIS_0-24 Norm Supply Chatter Chatter correlated failure Voltage B001/1B-B from 6.9KV Switchgear SD BD 1B-B 3-42

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Breaker Norm FDR for Chatter, Low RX MOV BD 1-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 1B1-B (1- B001/8B-B Switchgear MCC-213-B1) 1-BKR-212-Breaker B002/1B-B, Chatter, Low 1-BKR-212-SEIS_0-24 Norm Supply Chatter Chatter correlated failure Voltage B002/1B-B from 6.9KV Switchgear SD BD 1B-B Breaker Norm FDR for Chatter, Low RX MOV BD 1-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 1B2-B (1- B002/8B-B Switchgear MCC-213-B2)

Breaker Norm Supply AC Power Chatter, Low 2-BKR-212-SEIS_0-24 from 6.9KV Chatter Voltage B002/1B-B SD BD 2B-B Switchgear Breaker Norm FDR Chatter, Low CNTL & 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage AUX Vent BD A001/10B-A Switchgear 2A1-A Breaker 480 V Chatter, Low Shutdown BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2-A1A NOR A001/1B-A Switchgear FEED; Breaker Norm FDR for Chatter, Low RX MOV BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2A1-A (2- A001/8B-A Switchgear MCC-213-A1) 3-43

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Breaker Norm Supply Chatter, Low 2-BKR-212-SEIS_0-24 from 6.9KV Chatter Chatter correlated failure Voltage A002/1B-A SD BD 2A-A Switchgear Breaker Norm FDR for Chatter, Low RX MOV BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2A2-A (2- A002/8B-A Switchgear MCC-213-A2)

Breaker Norm FDR for Chatter, Low C&A Vent BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2B1-B (2- B001/10B-B Switchgear MCC-214-B1)

Breaker Nor Supply Chatter, Low 2-BKR-212-AC Power SEIS_0-24 from 6.9KV Chatter Chatter correlated failure Voltage B001/1B-B SD BD 2B-B Switchgear Breaker Norm FDR for Chatter, Low RX MOV BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2B1-B (2- B001/8B-B Switchgear MCC-213-B1)

Breaker Norm FDR for Chatter, Low RX MOV BD 2-BKR-212-SEIS_0-24 Chatter Chatter correlated failure Voltage 2B2-B (2- B002/8B-B Switchgear MCC-213-B2)

Breaker Norm FDR for Chatter, Low VIT BATT 0-BKR-236-SEIS_0-24 Chatter Voltage CHGR III (0- 0003-A Switchgear CHGR-236-3) 3-44

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Norm FDR for Breaker VITAL Chatter, Low 0-BKR-236-SEIS_0-24 BATTCHGR Chatter Voltage 0004A-B IV (0-CHGR-Switchgear 236-4)

Breaker Norm Supply Chatter, from 6.9KV 1-BKR-211-SEIS_0-25 medium Chatter COMMON 1716/16-A voltage SWG C switchgear Breaker Norm Supply Chatter, from 6.9KV 1-BKR-211-SEIS_0-25 medium Chatter COMMON 1728/16-B voltage SWG D switchgear AC Power 1-BKR-212-Breaker B001-B, 480V Chatter, Shutdown 1-BKR-212-SEIS_0-25 medium Chatter Chatter correlated failure XFMR 1B1 B001-B voltage (1-OXF-212-switchgear B1) 1-BKR-212-Breaker B002-B, 480V Chatter, Shutdown 1-BKR-212-SEIS_0-25 medium Chatter Chatter correlated failure XFMR 1B2 B002-B voltage (1-OXF-212-switchgear B2)

Breaker 1-BKR-211-Chatter, 6.9kV SDBD 1816/16-A, SEIS_0-25 medium Breaker 1816, Chatter Chatter correlated failure voltage 1828 1-BKR-211-switchgear 1828/16-B 3-45

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Breaker 1-BKR-211-ALT Supply Chatter, 1934/1-B, from 6.9KV SEIS_0-25 medium Chatter Chatter correlated failure Common 1-BKR-211-voltage SWG C, D 1932/1-A switchgear 1-BKR-212-Breaker A001-A, 480V 1-BKR-212-Chatter, Shutdown A001-A, SEIS_0-25 medium XFMR 1A1 Chatter Chatter correlated failure voltage (1-OXF-212- 1-BKR-212-switchgear A1), 1B2 (1- A002-A OXF-212-A2)

Breaker ALT Supply 2-BKR-211-Chatter, from 6.9KV 1938/1-B, 2-SEIS_0-25 medium Chatter Chatter correlated failure Common BKR-211-voltage SWG C, D 1936/1-A AC Power switchgear 6.9kV Supply Breaker to Chatter, Transformer 2-BKR-212-SEIS_0-25 medium Chatter Chatter correlated failure 2A1A (2- A001/A voltage BKR-212-A1-switchgear A) 480V Shutdown Trans 2A2-A 2-BKR-212-Breaker (2-OXF-212- A002-A, Chatter, A2-A) and 2-BKR-212-SEIS_0-25 medium Chatter Chatter correlated failure 2B1-B (2- B001-B, voltage OXF-212-B1- 2-BKR-212-switchgear B) and 2B2-B B002-B (2-OXF-212-B2-B) 3-46

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments 1-INV-235-0001-D, 120V AC 1-INV-235-AUX 480V Vital Inverter 0002-E, SEIS_3-1 Anchorage Inverter 1-I, 1-II, 1-III, 1-INV-235-1-IV 0003-F, 1-INV-235-0004-G 2-INV-235-0001-D, AC Power 120V AC 2-INV-235-AUX 480V Vital Inverter 0002-E, SEIS_3-1 Anchorage Inverter 2-I, 2-II, 2-III, 2-INV-235-2-IV 0003-F, 2-INV-235-0004-G 6.9KV Normal 1-BKR-211-Supply 1716/16-A, N/A7 N/A7 Breaker for Random Shutdown 1-BKR-211-Board 1728/16-B 0-BAT-236-0001-D, 0-BAT-236-125VDC Vital 0002-E, 125VDC DC Power SEIS_2-1 Battery I, II, Functional Vital Battery 0-BAT-236-III, IV 0003-F, 0-BAT-236-0004-G 7

This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-47

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments 0-CHGR-236-0001-D, 125V Vital 0-CHGR-236-125V Vital 0002-E, Battery DC Power SEIS_3-3 Battery Functional Charger I, II, 0-CHGR-236-Charger III, IV 0003-F, 0-CHGR-236-0004-G 1-GEN-082- EDGs would be treated as HSS in the EDG random 0001A-A, 50.69 defense-in-depth review.

N/A8 N/A8 failure to start Random and/or run 1-GEN-082- See Section 3.6.5 for additional 0001B-B discussion of defense-in-depth.

1-FAN-030-0447-A, Emergency Diesel 1-FAN-030-Generator 0449-B, Diesel 1-FAN-030-N/A8 N/A8 Generator Random 0451-A, Exhaust Fan 1-FAN-030-0453-B, 1-FAN-030-0459-A Component SEIS_19- CCS Surge CCS Surge 1-TANK-070-Cooling Anchorage 10 Tank A Tank A 0001 Water Onsite Refueling Refueling SEIS_19- 1-TANK-063-Water Water Storage Water Storage Anchorage 14 0046 Sources Tank Tank 8

This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-48

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments SIS Boron SIS Boron 1-TANK-063-SEIS_19-9 Injection Anchorage Injection Tank 0036 Tank 1-HTX-070-Component CCS Heat 0185, CCS Heat Cooling SEIS_20-1 Exchanger A, Anchorage Exchanger 1-HTX-070-Water B 0186 6900V STDN 1-PNL-211-A-AC Relay 6.9 Logic LOG REL A, SEIS_5-1 Functional Panel Relay Panel PNL 1A-A, 1B-B 1-PNL-211-B-B Aux 1-PMP-003-Aux 0118-A, Feedwater SEIS_11-6 Feedwater Anchorage Pump 1A-A, 1-PMP-003-Pump 1B-B 0128-B TD AFW Pump Room AFW Exhaust 1-FAN-030- Seismic fails both AC and DC Fans SEIS_17-4 125V DC Functional Fan 0214 together (correlated seismic failure)

EMERG EXH FAN Auxiliary Feedwater TD AFW Pump Room AFW Exhaust 1-FAN-030- Seismic fails both AC and DC Fans SEIS_17-4 120V AC Functional Fan 0217 together (correlated seismic failure)

EMERG EXH FAN AUX FW TDAFWP TURBINE 1-PNL-276-SEIS_5-17 Control FLOW Anchorage L381 Panels (BECKMAN DWG 797492) 3-49

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments Aux Aux 1-PNL-276-SEIS_5-18 Feedwater Feedwater Functional L381A Controls Control 1-TWS-067-0434-A, ERCW 1-TWS-067-Emergency ERCW Traveling 0445-B, Internal Events Ranking was based on Raw SEIS_24-1 Traveling Screen 1A-A, Anchorage individual component, but Internal Events Cooling 2-TWS-067-Screen 1B-B, 2A-A, RAW for Common cause of TWS is 23 Water 0439-A, 2B-B 2-TWS-067-0451-B Main Control Generator & 1-PNL-278-SEIS_5-10 Functional Room Panel Aux Power M001 120VAC PREFERRED Main Control 1-PNL-278-SEIS_5-10 POWER Functional Room Panel M007 RACK UNIT 1

MCR 0-PNL-278-Panels M026A-A, Main Control 0-PNL-278-SEIS_5-12 DSL Gen 1A- Functional Room Panel M026A A Main Cont RM 0-PNL-278-M026B-B, Main Control 0-PNL-278-SEIS_5-12 DSL GEN 1B- Functional Room Panel M026B B MAIN CONT RM 3-50

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments 0-PNL-278-M026C-A, Main Control 0-PNL-278-SEIS_5-12 DSL GEN 2A- Functional Room Panel M026C A MAIN CONT RM 0-PNL-278-M026D-B, Main Control 0-PNL-278-SEIS_5-12 DSL GEN 2B- Functional Room Panel M026D B MAIN CONT RM MCR Panels ERCW MAIN Main Control 0-PNL-278-SEIS_5-12 CNTL RN Functional Room Panel M027A PNL Main Control COMP COOL 0-PNL-278-SEIS_5-12 Functional Room Panel WATER PNL M027B FLEX is modeled in Internal events for 6900V 3MW 0-DG-360-SEIS_3M LOOSP but does not show up as 3MW FLEX FLEX Diesel 0003A, WFLEXD Anchorage important. See Section 3.6.4 for DGs Generator 3A, 0-DG-360-G 3B additional discussion of FLEX 0003B components.

480V FLEX is modeled in Internal events for FLEX/ESBO 0-DG-360- LOOSP but does not show up as SEIS_480 480V FLEX 225 KVA 000A, important. See Section 3.6.4 for FLEX VFLEXD Anchorage DGs DIESEL G

GENERATO 0-DG-360-000B additional discussion of FLEX R components.

FLEX is modeled in Internal events for 0-PNL-360- 0-PNL-360-LOOSP but does not show up as SEIS_FLE 480 V FLEX FP/A, 480V FP/A, Functional important. See Section 3.6.4 for XBUS DG Buses FLEX Fuse 0-PNL-360-Panel A, B additional discussion of FLEX FP/B components.

3-51

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites Component from Fragility Group that Governs the Fragility HSS in Risk Evaluations Correlation Seismic PRA FPIE PRA Fire PRARisk Passive Cat.

Implicit Failure Review Modeling Seismic Description Fragility of Fragility Component Component Mode of System Group Group Description ID SSC Comments 0-TANK-360- FLEX is modeled in Internal events for .

0113, 360- 0-TANK-360-0113, See Section 3.6.4 for additional SEIS_FLE FLEX Fuel 0213, 6900V XTANK Tanks 3MW FLEX Anchorage discussion of FLEX 0-TANK-360-DG Fuel oil 0213 components.LOSP but does not show up Storage Tank as important Turbine Driven TDAFW 1-PMP-003-N/A9 N/A9 Auxiliary Random Pump 0001A-S Feedwater Pump Seismically- Containment penetrations would be induced treated as HSS in the 50.69 defense-in-Containment SEIS_ Containment depth review.

Failure of Various Structural Penetrations CONPEN penetrations Containment See Section 3.6.5 for additional Penetrations discussion of defense-in-depth.

3128 4 0 1 352 Seismic Fragility Groups Totals 5964 classified as HSS via 24 overlapping 50.69 criteria, including 2 items addressed by defense-in-depth criteria 9

This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-52

Insert Appropriate Auto Text License Entry. If license is copyright, please delete Seismic PRA Insights and trial categorization Studies Conducted on High Seismic Hazard Sites guidance, it is assured that the performance assumed in the PRA for FLEX equipment is consistent with plant practices.

Further, in response to post-Fukushima actions, licensees are required to demonstrate that FLEX equipment is stored, tested, maintained and procedures are in place so that the FLEX equipment can fulfill their stated missions.

3.6.5 Defense-in-Depth Assessment NEI 00-04 [2] Sections 6.1 (Core Damage Defense-in-Depth) and 6.2 (Containment Defense-in-Depth) provides guidance for incorporating considerations to assure that defense in depth is preserved when categorizing an SSC as low safety significant.

With respect to core damage, the assessment considers both the level of defense-in-depth in preventing core damage and the frequency of the events being mitigated. This ensures that adequate defense-in-depth is available to mitigate design basis events given their likelihood of occurrence, including consideration of diverse and redundant trains and systems in the overall categorization process.

With respect to containment, the assessment considers SSCs that play a role in preventing large, early releases, such as interfacing systems LOCA (BWR and PWR), steam generator tube leak (PWR), containment isolation failures (BWR and PWR), and early hydrogen burns (ice condenser and Mark III containments). Containment defense-in-depth is also assessed for SSCs that play a role in preventing large containment failures (e.g., due to loss of containment heat removal).

3.6.6 Civil Structures NEI 00-04 [2] requires that both F-V and RAW importance measures be considered in 50.69 categorization. The RAW importance measure is calculated assuming the SSC (or basic event) is always failed. Although this is a useful importance measure for bounding discussions and for FPIE PRAs, in SPRAs RAW implies that the SSC has no seismic capacity and the RAW insights should be considered with some care when used in an SPRA.

When applied literally for Category 1 civil structures such as Reactor Buildings or Auxiliary Buildings that house critical systems and components, high RAW values can be expected because it implies that the structure is failed. The RAW metric can also be sensitive to cutset truncation depending upon the base probability of the basic event in question and the cutsets in which the basic event participates.

It is recognized that civil structures containing PRA credited equipment (e.g., Reactor Building) are likely important to safety because their failure can fail the credited equipment functions.

Therefore, if a licensee chooses to categorize structures under 50.69 using the guidance in this report, the recommended practice is to consider civil structures housing HSS SSCs to be HSS themselves, unless otherwise justified. Note that this does not imply that everything inside an HSS structure should then be considered HSS.

3-55

Attachment 3 List of Acronyms Page 1 of 2 AC Alternating Current ADS Automatic Depressurization System ADAMS Agencywide Documents Access and Management System AFW Auxiliary Feedwater Am Median Ground Acceleration Capacity (Fragility)

ANS American Nuclear Society ASME American Society of Mechanical Engineers CCF Common Cause Failure CDF Core Damage Frequency CDFM Conservative Deterministic Failure Margin CRD Control Rod Drive CST Condensate Storage Tank DA Data DC Direct Current EDG Emergency Diesel Generator (also shown as D/G or DG)

EPRI Electrical Power Research Institute FLEX Diverse and FLEXible Coping Strategies FPIE Full Power Internal Events (also shown as IEPRA)

FPRA Fire Probabilistic Risk Assessment FV Fussell-Vesely F&O Facts and Observations GPM Gallons per Minute HEP Human Error Probability HCPI High Pressure Coolant Injection HRA Human Reliability Analysis HSS High Safety Significance IE Initiating Event IF Internal Flood IGN Ignition Frequencies LAR License Amendment Request LERF Large Early Release Frequency LOCA Loss of Coolant Accident LSS Low Safety Significance NEI Nuclear Energy Institute NRC Nuclear Regulatory Commission (also shown as NUREG)

NTTF Near Term Task Force PCIV Primary Containment Isolation Valve PGA Peak Ground Acceleration PRA Probabilistic Risk Assessment PSHA Probabilistic Seismic Hazard Assessment RAW Risk Achievement Worth RG Regulatory Guide RAI Request for Additional Information RCIC Reactor Core Isolation Cooling

Attachment 3 List of Acronyms Page 2 of 2 RHR Residual Heat Removal RPV Reactor Pressure Vessel RWST Refuel Water Storage Tank SCDF Seismic Core Damage Frequency SDS Shutdown Seals SGIG Safety Grade Instrument Gas SGTR Steam Generator Tube Rupture SLERF Seismic Large Early Release Frequency SOV Separation of Variables SPRA Seismic Probabilistic Risk Assessment SSC Structures, Systems and Component SR Supporting Requirement