Text

License Amendment Request for One-Time Change to Technical Specification 3.8.4, DC Sources-Operating for Battery Replacement
	ML12229A146
Person / Time
Site:	McGuire, Mcguire
Issue date:	08/09/2012
From:	Repko R; Duke Energy Carolinas
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML12229A146 (101)
	v • d • e

Duke REGIS T.REPKO Vice President oEnergy McGuire Nuclear Station Duke Energy MG01 VP / 12700 Hagers Ferry Rd.

Huntersville, NC 28078 980-875-4111 980-875-4809 fax regis.repko@duke-energy.corn August 9, 2012 10 CFR 50.90 U.S. Nuclear Regulatory Commission Washington, DC 20555-001 ATTENTION: Document Control Desk

Subject:

Duke Energy Carolinas, LLC McGuire Nuclear Station, Units 1 and 2 Docket Nos. 50-369 and 50-370 License Amendment Request for One-Time Change to Technical Specification 3.8.4, "DC Sources-Operating" for Battery Replacement In accordance with the provisions of 10 CFR 50.90, Duke Energy Carolinas, LLC (Duke Energy) proposes a license amendment request (LAR) for the Renewed Facility Operating Licenses (FOL) and Technical Specifications (TS) for the McGuire Nuclear Station, Units 1 and 2.

The proposed LAR would revise the McGuire TS 3.8.4 Condition A. to allow replacement of the existing 125 VDC vital batteries while at power. This proposed LAR would be applicable one-time for each of the four battery channels. The vital batteries were last replaced in 1997 under a similar one-time TS change. All four battery channels are currently operable but a physical degradation phenomenon will shorten their/20 year nominal service life. Battery replacement is currently scheduled for 2013 and 2014.

Since battery replacement cannot be accomplished within the Completion Times currently allowed by TS 3.8.4 due to the number of activities, inspections, and tests, the proposed LAR would extend the Completion Time to 14 days for each battery channel replacement. During each vital battery replacement, the associated DC channel will remain energized by being cross-tied (bus tie with breakers) to another operable DC channel as allowed by TS 3.8.4 Condition A.

Duke Energy used a combination of a deterministic approach and Probabilistic Risk Analysis (PRA) insights to evaluate operating both units with one vital battery inoperable for an extended period of time. The configuration risk for this temporary one-time change was judged to be insignificant.

Attachment 1 provides Duke Energy's evaluation of the LAR which contains a description of the proposed changes, the technical evaluation, the regulatory analysis, the determination that this www.duke-energy corn

August 9, 2012 Nuclear Regulatory Commission Page 2 LAR contains No Significant Hazards Considerations, the basis for the categorical exclusion from performing an Environmental Assessment/Impact Statement, and precedent. provides the existing Technical Specification page for McGuire Units 1 and 2, marked-up to show the proposed changes. The reprinted Technical Specification page will be provided to the NRC upon issuance of the approved amendments. identifies Regulatory Commitments made in support of this LAR. Attachment 4 contains PRA evaluation specific Tables.

Duke requests NRC review and approval of this LAR by August 1, 2013 to facilitate the current battery replacement schedule. Duke has determined that a 30 day implementation grace period will be sufficient to implement this LAR.

In accordance with Duke internal procedures and the Quality Assurance Topical Report, the proposed amendment has been reviewed and approved by the McGuire Plant Operations Review Committee.

Pursuant to 10CFR50.91, a copy of this LAR has been forwarded to the appropriate North Carolina state officials.

Please direct any questions you may have in this matter to Lee A. Hentz at (980) 875-4187.

Sincerely, Regis T. Repko Attachments:

1. Evaluation of Proposed Amendment

2. Marked-Up McGuire Technical Specification Pages

3. Regulatory Commitments

4. PRA Evaluation Tables

August 9, 2012 Nuclear Regulatory Commission Page 3 cc w/ Attachments:

V. M. McCree Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 J. Zeiler NRC Senior Resident Inspector McGuire Nuclear Station J. H. Thompson, Project Manager U.S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 0-8 G9A Rockville, MD 20852-2738 W. L. Cox, III, Section Chief North Carolina Department of Environment and Natural Resources Division of Environmental Health Radiation Protection Section 1645 Mail Service Center Raleigh, NC 27699-1645

August 9, 2012 Nuclear Regulatory Commission Page 4 Regis T. Repko affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

Regis T. Relko, Site Vice President, McGuire Nuclear Station Subscribed and sworn to me: , Notar Pu, 2li)19-Cl'1AIAU I-w i v l I- w vl ~,Notary Public My commission expires:

Daie

ATTACHMENT 1 EVALUATION OF PROPOSED AMENDMENT 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

3.0 TECHNICAL EVALUATION

3.1 System Description 3.2 Vital battery Sizing Analysis 3.3 Discussion of Need to Replace Batteries 3.4 Battery Replacement Discussion 3.5 Temporary Battery Discussion 3.6 Compliance with Current Regulations 3.7 Defense in Depth Considerations 3.8 Evaluation of Safety Margins 3.9 Summary of the Risk Evaluation 3.10 Conclusion

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedents 4.3 Significant Hazards Consideration 4.4 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

S

1.0

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Duke Energy Carolinas, LLC (Duke Energy) proposes a license amendment request (LAR) for the Renewed Facility Operating License (FOL) and Technical Specifications (TS) for McGuire Nuclear Station, Units 1 and 2.

The proposed LAR would revise the McGuire TS 3.8.4 Condition A. to allow replacement of the existing 125 VDC vital batteries while at power. This proposed LAR would be applicable one-time for each of the four battery channels. The batteries were last replaced in 1997 under a similar one-time TS change. All four battery channels are currently operable but a physical degradation phenomenon will shorten their 20 year nominal service life. Battery replacement is currently scheduled for 2013 and 2014.

Since battery replacement cannot be accomplished within the Completion Times currently allowed by TS 3.8.4 due to the number of activities, inspections, and tests, the proposed LAR would extend the Completion Time to 14 days for each battery channel replacement. Battery replacement cannot be performed during a single unit refueling outage either since the batteries are shared between two units. During each vital battery replacement, the associated DC channel will remain energized by being cross-tied (bus tie with breakers) to another operable DC channel as allowed by TS 3.8.4 Condition A.

In addition, a temporary, spare battery will be available as an additional, backup DC power supply.

Duke Energy used a combination of a deterministic approach and Probabilistic Risk Analysis (PRA) insights to evaluate operating both units with one vital battery inoperable for an extended period of time. The configuration risk for this temporary one-time change was judged to be insignificant.

2.0 DETAILED DESCRIPTION The proposed LAR would revise the Completion Time for Required Action A.2.2 of TS 3.8.4, "Restore channel of DC source to OPERABLE status," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days on a one-time temporary basis. A footnote would be added to the TS page stating:

"The Completion Time that one channel of DC source can be inoperable as specified by Required Action A.2.2 may be extended beyond the "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months " up to a total of 14 days as part of the battery replacement project. This allowance may be used one-time for each of the four DC channels. Upon completion of the battery replacement project, this footnote is no longer applicable and will expire on December 31, 2014."

The marked-up TS 3.8.4 page illustrating the proposed change is provided in . The corresponding TS Bases will not require revision for this one-time temporary change.

Page 1 of 28

3.0 TECHNICAL EVALUATION

3.1 System Description

The 125 VDC Vital Instrumentation and Control (I&C) Power System is provided to supply power to nuclear safety related instrumentation and control loads requiring an uninterrupted power source to maintain safe reactor status.

The design of the McGuire 125 VDC I&C power system is such that four batteries, chargers and distribution centers serve both units. Each of the four vital batteries and chargers are connected through their own respective distribution center which is shared by both units. The loads served from these distribution centers are unitized, providing a 125 VDC power panelboard and inverter for each unit. The distribution centers are designed to provide cross-tie capability with its "associated" distribution center of the same train (load group). Updated Final Safety Analysis Report (UFSAR) Figure 8-35 of the Vital I&C power system is attached.

During normal operation, the independent and physically separated batteries are floated on the buses and assume load without interruption upon loss of a battery charger or AC power source. Battery chargers EVCA, EVCB, EVCC, and EVCD provide DC power to their respective distribution centers and maintain their respective batteries at float conditions. The 125 VDC distribution centers supply power to their respective 125 VDC power panelboards and the 120 VAC power inverters (see attached UFSAR Figure 8-35). The distribution center and power panelboard circuit breakers are closed except for the bus tie breakers and the spare battery charger distribution center breakers in EVDS.

When REQUIRED ACTION statement A.2.1 of Technical Specification 3.8.4 is invoked via OPERABLE tie breakers, and one battery and charger is removed from its bus, the distribution center (of the removed battery) and its normal loads are still energized by a full capacity charger and battery of the same affected train. For this alignment (cross-tied), one battery is serving two buses on one train. On the other train, two batteries are serving two buses, while assuring train redundancy at all times. All four vital batteries, including the one serving two buses during the Allowable Outage Time (AOT), are sized to serve normal and emergency loads of both buses. They independently have the capacity to automatically supply minimum engineered safety feature DC loads for accident conditions in one unit and safely shut down the other unit assuming both a loss of offsite power (LOOP) and a single failure in the 125 VDC system.

During a LOOP on one or both trains, the essential motor control centers feeding the Vital I&C battery chargers associated with the affected train will be load shed by the Emergency Diesel Generator (EDG) load sequencer. No more than eleven seconds after the diesel generator start signal, the affected essential motor control centers and battery chargers will be reloaded onto the essential bus by the sequencer. During the time period that the affected essential motor control centers and battery chargers are de-energized, the batteries, alone, feed the vital instrumentation and control loads.

For design basis events, any single vital battery by itself can supply an entire train of DC loads. The interaction between each unit's 125 VDC system is limited such that allowable combinations of maintenance and test operations as governed by the plant Technical Specifications will not preclude the system's capability to automatically supply Page 2 of 28

power to minimum Engineered Safety Feature (ESF) DC loads in either unit, assuming a LOOP.

3.2 Vital Battery Sizing Analysis All four vital batteries have been sized to carry the load duty cycle during loss of coolant accident (LOCA) and LOOP conditions for their respective bus/train while maintaining battery terminal voltage above 105 VDC for 60 cells in a cross-tied alignment. Each battery carries DC relays, trip coils, lights and momentary charging spring motor loads, as well as two inverters.

Design Requirements:

1. Should a station blackout (SBO) occur, each battery shall be capable of supplying its respective channel for a period of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months while maintaining a terminal voltage at or above 105 VDC.

2. The duty cycle used in the calculation is consistent with a LOOP or a LOCA without AC power being available to the chargers. Thus, breaker control and spring charging currents are included in the duty cycle. Therefore this duty cycle bounds the situation where no AC power is available from either the standby or offsite source.

3. Each charger is sized to:

a. Carry its own individual load plus the DC loads of another charger in a back-up capacity;

b. Recharge its associated battery within eight hours while supplying its normal loads.

Assumptions:

1. The inverter terminal voltage is assumed to be the minimum rated input voltage (100 VDC). A lower input voltage results in higher load currents in the battery duty cycle for constant power loads such as the inverters. The inverter input voltage is expected to be above 100 VDC during the duty cycle. Therefore the use of 100 VDC as the inverter terminal voltage is conservative.

2. In addition to the worst case loading on distribution centers EVDA, EVDB, EVDC, and EVDD each train's distribution center is assumed to have three breaker charging spring motors starting in the 0-1 minute period (74.88 Amps per motor starting) and one charging spring motor running in the 59-60 minute period. This is consistent with the guidance in IEEE 485-1983 sections 4.2.3 and 4.3.2 and IEEE 450-1995.

Design Inputs:

1. McGuire's low voltage load list

2. IEEE 485-1983 for lead acid battery sizing

3. The minimum temperature of the battery room is 60'F, for a temperature correction factor of 1.11 Page 3 of 28

4, The aging factor is for 80% end of life capacity, for a factor of 1.25

5. Load growth factor is 1.15 The following table provides the worst case Vital DC bus loading values for cross- tied alignments.

Train A EVDA Loads 0-1 minute 1-59 minutes 59-60 minutes Battery Panelboard EVDA 2.68A 1.52A 1.52A Battery Panelboard 1 EVDA 299.38A 50.75A 135.63A Battery Panelboard 2EVDA 306.36A 46.86A 131.74A Inverter Panelboard 1EKVA 104.7A 104.70A 104.7A Inverter Panelboard 2EKVA 110.35A 110.35A 110.35A EVDC Loads Battery Panelboard EVDC 2.68A 1.52A 1.52A Battery Panelboard 1EVDC 5.05A 0.90A 0.90A Battery Panelboard 2EVDC 5.05A 0.90A 0.90A Inverter Panelboard 1EKVC 64.13A 64.13A 64.13A Inverter Panelboard 2EKVC 65.49A 65.49A 65.49A Total Train A cross-tied load 965.87 A 447.11 A 616.87 A Train B EVDB Loads 0-1 minute 1-59 minutes 59-60 minutes Battery Panelboard EVDB 2.68A 1.52A 1.52A Battery Panelboard 1EVDB 5.05A 0.90A 0.90A Battery Panelboard 2EVDB 5.05A 0.90A 0.90A Inverter Panelboard 1EKVB 79.30A 79.30A 79.30A Inverter Panelboard 2EKVB 80.50A 80.50A 80.50A EVDD Loads Battery Panelboard EVDD 2.68A 1.52A 1.52A Battery Panelboard 1EVDD 291.53A 37.60A 122.48A Battery Panelboard 2EVDD 297.46A 40.61A 125.49A Inverter Panelboard 1EKVD 100.21A 100.12A 100.21A Inverter Panelboard 2EKVD 97.34A 97.34A 97.34A Total Train B cross-tied load 961.78 A 440.38 A 610.16 A Conclusion The vital batteries are sized according to Train A cross-tied alignment loading since it is the most limiting. From the Table above, Train A loading is equivalent to removing 459 Amp Hours (AH) from the battery in 60 minutes. Adjusting the load for battery aging, temperature, and load growth, 732AH would be the assumed worst case loading on a battery sized at 1944AH.

Page 4 of 28

This analysis demonstrates that, under the cross-tied alignment, the vital batteries are adequately sized to ensure the Vital I&C Power System will perform its design function under worst case conditions.

Battery Testing History Every 18 months a Modified Performance Test (MPT) is performed in accordance with IEEE Standard 450-1995 to satisfy both the service test and performance test requirements. The MPT uses the Train A cross-tied duty cycle again, since it is the most limiting. The results of the last three tests per battery are shown below. The acceptance criteria is > 80% capacity based on the 75 minute discharge rate, adjusted for temperature to 77 0 F.

EVCA Battery Test Results Date Capacity 07/23/2007 107.0%

3/29/2009 109.8%

02/01/2011 107.2%

EVCB Battery Test Results Date Capacity 08/11/2008 110.7%

01/25/2010 110.0%

11/29/2011 106.7%

EVCC Battery Test Results Date Capacity 10/15/2007 104.3%

08/18/2009 102.6%

02/08/2011 105.5%

EVCD Battery Test Results Date Capacity 09/10/2007 104.7%

06/16/2009 104.0%

04/18/2011 98.6%

Page 5 of 28

3.3 Discussion of Need to Replace Batteries Each vital battery bank consists of 60 GNB NCN-27 Flooded Lead Calcium (1944 Amp-Hr) battery cells, which were procured through third party qualifier Nuclear Logistics, Inc. (NLI).

The GNB safety related battery cells have a vendor advertised service life of 20 years, however, industry operating experience indicates that 15 to 18 years is a much closer approximation. McGuire's vital batteries were last replaced in 1997. Recent testing on all four batteries demonstrated that three have a capacity in excess of 100% while the fourth battery has a capacity near 99%. In May of 2006, positive post seal nut and jar lid cracking on the battery cells was discovered. This was evaluated by NLI for McGuire and the phenomenon was determined to be nodular corrosion. Approximately 50% of the cells are currently affected by this phenomenon.

Cracks on the positive post seal nuts can and will result in increased terminal and connection resistances over time. The following was provided by NLI:

The design function of the post seal components is to prevent the release of acid to the atmosphere. The seal nut is a part of the post seal components; its specific function is to compress the o-ring to form a seal.

The post seal components have no structural role in the battery cell. The failure of any of the seal components will not impact the seismic qualification of the battery. The failure of the seal components can result in a path for acid (electrolyte) to travel from the cell to the cell post. This will result in terminal post blackening. This is not an operability issue but may result in additional maintenance work. The long-term effect of the seal leakage is the corrosion product build-up at the intercell connections, with a corresponding build-up of resistance. As leaks continue to occur, the cell post blackens and a layer of corrosion forms between the post and the intercell connectors. Over time this causes a higher joint resistance.

Even though all McGuire's vital battery banks are operable from a capacity standpoint, physical degradation will eventually start to accelerate as a result of the nodular corrosion phenomenon. Consequently, replacing all four vital batteries prior to the end of their 20 year service life needs to be performed.

3.4 Battery Replacement Discussion The new, replacement vital batteries will be identical to the existing batteries; GNB Type NCN-27. The replacement batteries will be sized in accordance with IEEE Std. 485-1983 and will meet the current licensing basis and perform the same safety function as the existing batteries.

From discussions regarding the nodular corrosion phenomenon with battery vendors, other nuclear stations, and industry experts there is currently no permanent solution to the issue as the batteries age. Different vendors have mitigating strategies, however none are able to guarantee their cells will not experience cracking as the cell ages. As Page 6 of 28

indicated by the performance tests, the McGuire NCN-27 Batteries have shown minimal capacity loss for their age.

Replacing batteries will require the existing cells to be disconnected and removed from their mounting rack one cell at a time. Each cell weighs approximately 385 pounds and the end of the rack must be removed to push the cells out of the rack then lower onto a conveyor rack, transversed to the adjacent isle, then lowered onto a cart for transportation out of the battery room.

Prior to installation, each new vital battery bank will receive a commissioning charge followed by a Modified Performance Test (MPT). The MPT is a test of battery capacity using a constant current, modified by increasing the current to "bound" the currents required in the battery service test. The MPT will satisfy the TS Surveillance Requirements (SR) 3.8.4.7 (Battery Service Test) and 3.8.4.8 (Performance Discharge Test) requirements.

The new tested cells will be transported to the respective vital battery room, and installed into the racks one cell at a time. New intercell connectors and intertier jumpers and cables will be connected and tested for connection resistance. After installation, the new battery will receive a freshening charge followed by the TS SR voltage and resistance measurements to validate battery operability.

While the intent of performing each MPT prior to installation is to reduce the overall time in the cross-tied alignment to ten days, it may become more practical to perform the MPT after the new battery is permanently installed. If so, a five day contingent during the replacement schedule would be required after equalizing the new battery in its permanent rack. IEEE Standard 450-1995 requires that the battery must be on float charge for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months before performing the MPT. The MPT will take 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to setup and perform. After the MPT the new battery will need to charge 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months before it can be put in service. Should the contingent be required, it would take the place of floating the new battery 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before the quarterly inspection in the time line. The additional 60 hour6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months contingency allowance in the time line is to allow for complications during removal or installation of the battery.

It has been determined that the replacement of each battery bank will take a maximum of approximately 14 days. The time that a battery bank is removed from service for replacement will be kept to a minimum. Replacement activities are scheduled for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months per day, 7 days a week.

The replacement time line (per channel) is as follows:

Page 7 of 28

ACTIVITY TIME REQUIRED TIME REQUIRED (10 day schedule) (14 day schedule)

Cross-tie the associated channel and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months take the old battery out of service.

Remove old battery (isolate power, 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months disconnect cables and connectors, remove cells).

Transport new cells to battery room. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Install new battery (install new cells, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months attach connectors and all associated hardware)

Re-torque battery rack connections. 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Torque connectors and connect power cables.

Check new battery for continuity and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months grounds. Take baseline resistance measurements.

Equalize charge on new battery to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months restore capacity lost during storage/movement.

Float new battery prior to testing 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months N/A Pre-MPT new battery float charge N/A 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Perform MPT N/A 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Post-MPT charge N/A 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months Perform quarterly maintenance and 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months TS SR voltage and resistance measurements.

Re-align new battery to the bus. 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Removal/installation contingency 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months allowance Total time 235 hours0.00272 days 0.0653 hours 3.885582e-4 weeks 8.94175e-5 months (=10 days) 325 hours0.00376 days 0.0903 hours 5.373677e-4 weeks 1.236625e-4 months (=14 days) 3.5 Temporary Battery Discussion While a vital battery bank is being replaced on-line, McGuire will have available as a contingency an identical full capacity temporary battery bank procured for 1E usage and sized in accordance with IEEE Standard 485-1983. The temporary battery bank will be located in Room 700 of the McGuire Service Building (shared load center room) due to space limitations in the battery room in the Auxiliary Building. The Service Building, which is located between the Unit 1 and 2 Turbine Buildings, is not a Seismic Category structure and the temporary battery will not be seismically mounted. The temporary battery bank will remain disconnected via a disconnect box but available if needed.

If needed, the temporary battery bank will be tied to the DC side of the standby battery charger (EVCS) via safety related EVDS Distribution Center breaker 1 B. For the unlikely scenario where the vital battery supporting the cross-tied channels is lost or disabled; the temporary battery would be utilized to support recovery of one of the lost DC channels and associated loads. The temporary battery will not be credited for operability of the associated DC channels. In this scenario, with more than one DC channel Page 8 of 28

inoperable, McGuire would enter TS 3.8.4 Condition B. This would require both Units to be in Mode 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The temporary battery will receive a full complement of TS surveillances tests including a MPT prior to the first vital battery replacement. In addition, all applicable TS surveillance tests will be performed on the temporary battery configuration during periods of battery bank replacement.

The ambient temperature and hydrogen concentration of the area containing the temporary battery will be monitored once per a 12-hour shift to ensure they remain within battery specifications. The ventilation in this area will be supplemented with fans to ensure good air flow and mixing across the temporary battery.

At some point after the first battery bank is replaced but prior to the last (fourth) replacement, one of the older, removed batteries will be set-up as the temporary battery so the initial temporary battery can be installed as one of the new vital batteries. As previously stated, the older batteries are fully operable and identical to the replacement batteries.

3.6 Compliance with Current Regulations This LAR itself does not propose to deviate from existing regulatory requirements, and compliance with existing regulations is maintained by the proposed one time change to the plant's TS requirements. Additional details may be found in the Regulatory Evaluation section of this LAR.

3.7 Defense in Depth Considerations The proposed change is required to meet the defense-in-depth principle consisting of a number of elements. These elements and the impact of the proposed change on each of these elements are as follows:

A reasonable balance among prevention of core damage, prevention of containment failure and consequence mitigation is preserved.

The proposed LAR would revise the McGuire TS 3.8.4 Condition A. to allow replacement of the existing 125 VDC vital batteries while at power. This proposed LAR would be applicable one-time for each of the four battery channels. During each vital battery replacement, the associated DC channel will remain energized by being cross-tied (bus tie with breakers) to another operable DC channel as currently allowed by TS 3.8.4 Condition A. All four vital batteries have been sized to carry the load duty cycle during LOCA and LOOP conditions for their respective bus/train while maintaining battery terminal voltage in a cross-tied alignment. Due to this robust design, the safety functions of the 125 VDC I&C system are preserved. In addition, a temporary, spare battery will be available as an additional, backup DC power supply.

Page 9 of 28

The proposed LAR does not introduce a new accident or transient since no new equipment is installed, existing equipment is not operated in a new manner, and thus no new accident initiator is introduced. The spare battery remains disconnected via a disconnect box but available if needed. The 125 VDC I&C system is not an initiator of any analyzed design basis events, therefore, the proposed LAR does not increase the likelihood of an accident or transient.

Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

The proposed LAR does not change the plant design. During each vital battery replacement, certain important equipment will be protected and compensatory measures will be in place. These measures are consistent with normal plant practices. Applicable approved procedures will also be utilized during this activity. This is not considered to be an over-reliance on programmatic activities. No new specific programs are being initiated during the battery replacement evolutions.

System redundancy, independence and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system.

During each vital battery replacement, the associated DC channel will remain energized by being cross-tied (bus tie with breakers) to another operable DC channel as currently allowed by TS 3.8.4 Condition A. All four vital batteries have been sized to carry the load duty cycle during LOCA and LOOP conditions for their respective bus/train while maintaining battery terminal voltage in a cross-tied alignment. During each vital battery replacement, certain important equipment will be protected and compensatory measures will be in place to offset the impact on system redundancy. In addition, a temporary, spare battery will be available as an additional, backup DC power supply. As such, system redundancy, independence and diversity are maintained.

Defenses against potential common cause failures are preserved and the potential for the introduction of new common cause failure mechanisms is assessed.

As previously discussed, important equipment will be protected and compensatory measures will be in place to offset the impact on system redundancy and potential common cause failures. These measures will include avoiding (to the extent possible) severe weather conditions and periods of system grid instability during the proposed TS Completion Time extension. As such, appropriate measures will be taken to preserve defenses against potential common cause failures and no new common cause failure mechanisms will be introduced.

0 Independence of barriers is not degraded.

The proposed vital battery replacement activity does not directly impact the three principle barriers or otherwise cause their degradation. Independence of barriers is not degraded because the proposed TS Completion Time extension has no impact on the physical barriers.

Page 10 of 28

0 Defenses against human errors are preserved.

Appropriate training will be provided to Operations and Maintenance personnel for the battery replacement evolution and, as discussed above, equipment protection and compensatory measures will be in place. Applicable approved procedures will also be utilized during this activity. As such, defenses against human errors are preserved.

The intent of the plant's Design Criteria is maintained.

This activity is a TS Completion Time extension to allow replacement of the station vital batteries with an identical design. As such, this activity does not modify the plant design or the design criteria applied to systems, structures, or components (SSCs) during the licensing process.

3.8 Evaluation of Safety Margins Design basis analysis and system design criteria are not impacted by the proposed LAR.

As previously discussed, the design, operation and response of the systems addressed are unaffected. Administrative controls are in place in order to prevent the removal of redundant Trains of equipment at the same time. In addition, the safety analysis acceptance criteria stated in the UFSAR are not affected by the requested change. The system requirements credited in the accident analysis will remain the same. It is concluded that safety margins are not impacted by the proposed change.

3.9 Summary of the Risk Evaluation A one-time (per battery) Technical Specification (TS) change is being requested to extend the Completion Time by 11 days, from the current 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to a total of 14 days.

The analysis calculates the Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP) for 14 days to replace each battery, for a total maintenance configuration time of 56 days. The total ICCDP and ICLERP for 56 days is -3.03E-07 and -4.83E-08, respectively. The negative values indicate a reduction in risk, which is achieved by delaying routine maintenance on Systems Structures and Components (SSC) that appear in the cut sets for vital battery internal events sensitivity cases. I.e., the risk increase due to being in the vital DC cross-tie alignment for 14 days is more than offset by deferring routine maintenance on selected SSCs that appear in the cut sets.

The analysis calculates the delta Large Early Release Frequency (LERF) and delta Core Damage Frequency (CDF) for the 11 day extension per battery, for a total extension time of 44 days. The total delta CDF and delta LERF for the 44 additional days incurred by the extension are -2.38E-07/ reactor-operating-state-year and -3.79E-08/ reactor-operating-state-year, respectively.

The risk metrics are within the guidelines in Regulatory Guide 1.174 and 1.177 (< 1 E-06 and < 1 E-07, respectively). Since the calculated values indicate a risk decrease, it is judged that the configuration risk for the LAR is insignificant.

Page 11 of 28

The risk impact of the proposed increase of the Completion Time (CT) for operating in the cross-tie alignment for the 125VDC Vital I&C system has been evaluated using the NRC three-tier approach suggested in Regulatory Guide 1.177. Although Regulatory Guide 1.177 is primarily intended for permanent changes to plant technical specifications, the general framework of considerations is considered applicable for this application:

Tier 1 - Probabilistic Risk Assessment (PRA) Capability and Insights Tier 2 - Avoidance of Risk-Significant Plant Configurations Tier 3 - Risk-Informed Configuration Risk Management 3.9.1 Tier I - PRA Capability and Insights The analysis for this LAR submittal utilizes the McGuire internal events PRA model (with flood analysis update) and the Fire PRA model to determine the risk significance of replacing the four vital batteries.

McGuire Internal Events PRA Model Peer Review In October 2000, the internal events PRA model received a peer review to certify the acceptability of PRAs before a consensus PRA Standard was available. McGuire participated in the Westinghouse Owners Group (WOG) PRA Certification Program.

The industry-developed process and methodology outlined in Nuclear Energy Institute (NEI) 00-02 was used for the peer review. The review process was originally developed and used by the Boiling Water Reactor Owners Group (BWROG) and subsequently broadened to be an industry-applicable process through the NEI Risk Applications Task Force. The resulting industry document, NEI-00-02, describes the overall PRA peer review process. The Certification/Peer Review process is also linked to the ASME PRA Standard 10.

The objective of the PRA Peer Review process is to provide a method for establishing the technical quality and adequacy of a PRA for a range of potential risk-informed plant applications for which the PRA may be used. The PRA Peer Review process employs a team of PRA and system analysts, who possess significant expertise in PRA development and PRA applications. The team uses checklists to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA being reviewed. One of the key parts of the review is an assessment of the maintenance and update process to ensure the PRA reflects the as-built plant.

The review team for the McGuire PRA Peer Review consisted of six members. Three of the members were PRA personnel from other utilities. The remaining three were industry consultants. Reviewer independence was maintained by assuring that none of the six individuals had any involvement in the development of the McGuire PRA or Individual Plant Examination (IPE).

The results of the review provided strengths, weaknesses, and areas for improvement.

Overall, the peer review indicated the process used and technical adequacy was satisfactory and acceptable for use in applications.

Page 12 of 28

A summary of some of the McGuire PRA strengths and recommended areas for improvement from the peer review are as follows:

Strengths:

Good Summary Report write-up with insights

Good system notebooks

Rigorous Level 2 & 3 PRA Model

Integrated internal and external events model

Up-to-date plant database using Maintenance Rule

Ongoing PRA staff interaction with plant staff, plant staff reviews

PRA personnel knowledge of plant good Recommended Areas for Improvement:

Better integration of sequences and recoveries within quantification process needed

" Need to review treatment of events requiring time-phasing in the modeling

Better approach to closing the loop on PRA update items (tracking of errors/mods) needed

" More thorough, systematic approach to Human Reliability Analysis (HRA) screening values and common cause modeling needed

Need an approach for reconciling realistic LERF model with NRC expectations from simplistic LERF modeling

" Need to update the PRA model to be more in line with current practices and expectations for state-of-the-art PRA The significance levels of the WOG Peer Review Certification process have the following definitions:

A. Extremely important and necessary to address to ensure the technical adequacy of the PRA, the quality of the PRA, or the quality of the PRA update process.

B. Important and necessary to address but may be deferred until the next PRA update.

Based on the PRA peer review report, the McGuire PRA received six Fact and Observations (F&O) with the significance level of "A" and 31 F&O with the significance level of "B." All six of the "A" F&O have been resolved and changes are incorporated into the current McGuire internal events PRA model. The "B" F&O have been reviewed and prioritized for incorporation into the PRA. Twelve of the "B" F&O have already been incorporated into the current McGuire internal events PRA model. The 19 remaining F&O are dispositioned in Table 1 of Attachment 4.

The peer review team noted that the Duke Energy method of estimating LERF required a full Level 3 analysis, which was significantly different than the rest of the industry. As a result, the methodology was changed in 2005 to a LERF model based on the simplified containment event tree method described in NUREG/CR-6595. A focused peer review has not been performed for the upgraded LERF model, but a self assessment was Page 13 of 28

performed as described in the following section. Due to the overall decrease in LERF in the analysis, LERF is not significant for the application.

McGuire Internal Events PRA Model Self Assessment to Regulatory Guide 1.200 Subsequent to the previously discussed peer review, the ASME/ANS PRA Standard was developed and issued. A self assessment gap analysis was performed to evaluate the differences between the original peer reviews conducted using NEI 00-02 and RA-S-2008 of the ASME/ANS PRA Standard. The self assessment was performed in 2008, and minor revisions were performed in 2009. The results of this self assessment are documented in Duke Calculation DPC-1535.00-00-0013 Revision 2. The following discussion summarizes the self assessment.

Duke Energy performed a self assessment of the McGuire PRA against Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" and RA-S-2008 of the ASME/ANS PRA Standard. The assessment indicated that 230 of the 306 Supporting Requirements (SRs) for Revision 1 were fully met. In addition, 24 of the SRs were not applicable to McGuire, either because the referenced techniques were not used in the PRA or because the SR was not required for Capability Category (CC) II. Of the 52 open SRs, 42 require enhanced documentation, and only 10 were of a technical nature. The self assessment team indicated that none of the open items are expected to have a significant impact on the PRA results or insights. The SRs that were determined to be not met are dispositioned in Table 2 of Attachment 4.

PRA Maintenance and Update The PRA is maintained and updated such that its representation of the as-built, as-operated plant is sufficient to support the applications for which it is used. Duke Energy maintains workplace procedures that evaluate and prioritize changes in PRA inputs as well as address discovery of new information that could affect the PRA.

The PRA model is reviewed whenever plant accident response characteristics are changed by hardware modifications. Any identifiable plant change is analyzed for its risk significance. This includes plant modifications, changes to Emergency or Abnormal Procedures, as well as Technical Specifications and Selected Licensee Commitment changes. The Duke Energy PRA group is on distribution for receipt of these changes from McGuire. I The PRA Section has implemented a living PRA database program (PRA Tracker) to provide the means for formal documentation, tracking and resolution of any potential changes to the PRA based on plant modifications, discovered errors or industry information. When an issue is identified that calls into question some aspect of the PRA model or related analysis, or if during the review of a site design change package some issue is identified, the issue is entered into the PRA Tracker program. At that time a determination of the risk significance of the issue based on CDF and LERF is made, placing the issue in one of the following three categories:

the change in CDF or LERF is less than 1.OE-06 or 1.OE-07 / reactor-year, respectively = LOW risk significance Page 14 of 28

" the change in CDF or LERF is between 1.OE-06 to 1.OE-05 / reactor-year or 1.OE-07 to 1.OE-06 / reactor-year, respectively = MEDIUM risk significance

the change in CDF or LERF is greater than 1.OE-05 or 1.OE-06 / reactor-year, respectively = HIGH risk significance All open PRA Tracker items are reviewed prior to the start of an application for their impact on that application. There are no open HIGH PRA Tracker items. There are 12 open MEDIUM PRA Tracker items, which are dispositioned in Table 3 of Attachment 4.

Three LOW PRA tracker items were judged to have an impact on this application and were incorporated into the analysis, and are dispositioned in Table 4 of Attachment 4.

Flood Modeling Update to the Internal Events PRA Model Westinghouse conducted a peer review of the McGuire Internal Flooding PRA update to RA-Sa-2009 of the ASME/ANS PRA Standard. The ASME/ANS PRA Standard contains a total of 316 numbered supporting requirements for internal events and internal flooding in nine technical elements. This focused-scope peer review covered a total of 62 supporting requirements associated with the Internal Flood PRA. One of the SRs was determined to be not applicable to the McGuire Internal Flood PRA. Of the 61 remaining SRs, 44 were rated as SR Met, Capability Category I/Il, or greater. One SR was rated as Category I and 16 SRs were rated as not met. The 16 SRs rated as not met and the one SR rated as Category I have been addressed and there are no open issues. The 16 SRs not met and the SR rated as CC I are dispositioned in Table 5 of Attachment 4.

Fire PRA The fire risk was evaluated using the McGuire Fire PRA. The Fire PRA was used to develop an ICCDP and ICLERP for each of the four battery maintenance configurations, and this ICCDP and ICLERP is summed with the results of the internal events PRA model sensitivity cases to produce the final values for the LAR.

In April 2010 Westinghouse conducted a peer review of the McGuire Fire PRA to the ASME/ANS PRA Standard. Section 4 of the ASME/ANS combined PRA Standard (Reference 1) contains a total of 182 Supporting Requirements (SRs) under thirteen technical elements, and configuration control from Section 1.5. Of these 182 SRs, thirty were determined to be not applicable to the McGuire Fire PRA. There were 16 SRs that were found to be not met, and of these 15 have been resolved and one item is a documentation issue judged to be insignificant to this risk evaluation.

The review team found that, in general, the methodologies being used were appropriate and sufficient to meet the standard. There were some areas where additional justification or documentation of the methodology or assumptions was needed. Based on the review team's conclusions and the subsequent resolution of the SRs not met, the McGuire Fire PRA is adequate for use in the vital battery LAR risk evaluation. The 16 SRs that were not met are dispositioned in Table 6 of Attachment 4.

Page 15 of 28

External Events Regulatory Guide 1.200 Revision 2 includes external events in the PRA quality assessment and provides a position to the current revision of the ASME / ANS PRA quality standard. Section 1-3 of the Standard outlines the risk assessment application process.

Seismic Assessment The McGuire seismic PRA model is not used for this analysis, because it has not been peer reviewed. Therefore, the seismic risk is evaluated deterministically. The following two deterministic considerations for seismic risk during the vital battery replacement activities were considered:

The risk of a seismic event directly causing a failure of a vital DC control power SSC was considered. Since the vital DC control power SSCs are located in a seismically qualified structure and are seismically mounted, it is expected that seismic event of sufficient magnitude to damage a vital DC SSC will likely damage multiple vital DC SSCs. This is true for configurations where there is no battery maintenance in progress, as well as for the proposed battery replacement configuration. Therefore, the analysis for the vital battery LAR application is not considered to be sensitive to failures of vital DC control power SSCs caused by seismic events.

A seismic event could result in a LOOP, but since the seismic Initiating Event Frequency (IEF) is approximately two orders of magnitude less than the LOOP IEF, LOOP events are significantly more likely to occur due to non-seismic events. Therefore, the analysis for the vital battery LAR application is not considered to be sensitive to LOOP events resulting from seismic initiators.

Tornado I High Winds Assessment The McGuire tornado PRA model has not been peer reviewed. Therefore, the tornado risk for this LAR submittal is evaluated deterministically. The following two deterministic considerations for tornado risk during the vital battery replacement activities were considered:

The vital DC control power SSCs are located in a structure qualified to withstand tornados. It is expected that a tornado will not directly cause damage to vital DC control power SSCs. This is true for configurations where there is no battery maintenance in progress, as well as for the proposed battery replacement configuration. Therefore, the analysis for the vital battery LAR application is not considered to be sensitive to failures of vital DC control power SSCs caused by tornado events.

" A tornado event could result in a LOOP, but since the tornado Initiating Event Frequency (IEF) is approximately two orders of magnitude less than the LOOP IEF, LOOP events are significantly more likely to occur due to causes other than Page 16 of 28

tornados. Therefore, the analysis for the vital battery LAR application is not considered to be sensitive to LOOP events resulting from tornado initiators.

Truncation Limit Regulatory Guide 1.177 states that if the component in question appears in the cut sets near the truncation limit (e.g., all appearances are in cut sets within a factor of 10 of the truncation limit), it may be necessary to reduce the truncation limit. This is not an issue for this analysis; there is adequate representation of the expected failure in the results that drive the answer so that there was no need to solve to any lower truncation levels.

Uncertainty and Sensitivity As stated in Regulatory Guide 1.177 Section 2.3.5, risk analyses of CT extensions are relatively insensitive to uncertainties. The PRA did not credit equipment repair so there are no uncertainties to be evaluated for that issue. Important systems are required to remain in service during the CT so no issues with mean downtimes should exist. Thus uncertainty and sensitivity are not expected to alter the conclusions of the evaluation.

Internal Events Risk Insights The internal events PRA model with updated flood modeling was used for this analysis.

Base CDF and LERF are 3.42E-05/ reactor-year and 2.64E-06/ reactor-year, respectively.

Base Case Model Modifications The base model was modified by incorporating applicable PRA Tracker items and removing modeling for fire events (Modeling for fire events was removed because the Fire PRA was used to evaluate the fire risk). The resulting modified base CDF and LERF are 5.59E-05/ reactor-year and 6.79E-06/ reactor-year, respectively. When adjusted to reactor-operating-state-year values using a capacity factor of 0.9, the resulting base CDF and LERF are 6.21 E-05/ reactor-operating-state-year and 7.54E-06/

reactor-operating-state-year, respectively.

Nominal Maintenance Sensitivity Cases An internal events sensitivity case was performed for each of the four batteries in maintenance. The ICCDP and ICLERP were calculated based on the proposed 14 day CT. The delta CDF and delta LERF were calculated based on the 11 day extension.

The sensitivity case analysis was performed by setting the applicable battery maintenance event to 1 and updating the T14 initiator to reflect the battery in maintenance. Additionally, for the sensitivity cases for batteries EVCA and EVCD, the control power logic for essential switchgear ETA and ETB was modified to reflect that with these batteries in maintenance, the control power logic relies on batteries EVCC and EVCB. Battery EVCC produced no change in risk, because the equipment supplied by EVCC is less risk significant that the other three batteries. Specifically, the other three batteries supply various combinations of control power for pressurizer power operated relief valves (PORVs) and/or Refueling Water Storage Tank (RWST) level channels. EVCC does not supply this equipment.

Page 17 of 28

Internal Events Se sitivity Cases Nomr~inal Maint naice)

ICCDP ICLERP delta CDF delta LERF Battery EVCA 1.70E-08 2.13E-09 1.34E-08 1.67E-09 Battery EVCB 2.98E-08 2.56E-09 2.34E-08 2.01 E-09 Battery EVCC O.OOE+00 0.OOE+00 0.OOE+00 0.OOE+00 Battery EVCD 5.11E-08 5.11E-09 4.02E-08 4.02E-09 Sum 9.79E-08 9.80E-09 7.70E-08 7.70E-09 Eight Fire PRA sensitivity cases were performed, four per unit (the Fire PRA is a dual unit model). Due to asymmetries in the physical layout of plant equipment, the results were different between Unit 1 and Unit 2. The highest result for each battery was used in the analysis, and the results are summarized in the following table:

eiRMA Sensitivit Qas ICCDP ICLERP delta CDF delta LERF Battery EVCA 1.92E-08 3.45E-09 1.51E-08 2.71E-09 Battery EVCB 2.30E-08 1.15E-09 1.81 E-08 9.04E-10 Battery O.OOE+00 0.OOE+00 O.OOE+00 0.OOE+00 EVCC Battery EVCD 3.45E-08 4.22E-09 2.71E-08 3.32E-09 Sum 7.67E-08 8.82E-09 6.03E-08 6.93E-09 The four internal events sensitivity cases and the highest results of the fire PRA sensitivity cases for each battery are summed to produce a combined ICCDP and ICLERP. The following table summarizes the combined results.

SUmiidd Internal Events and Fire PR SeltaivDitya! det L ICCDP ICLERP delta CDF delta LERF Internal Sens 9.79E-08 9.80E-09 7.70E-08 Sensitivity 7.70E-09 Cases Fire PRA Sensitivity 7.67E-08 8.82E-09 6.03E-08 6.93E-09 Cases Total 1.75E-07 1.86E-08 1.37E-07 1.46E-08 Restricted Maintenance Sensitivity Cases To further reduce the risk of the maintenance configuration, additional internal events sensitivity cases were performed for each battery assuming zero maintenance on key equipment appearing in the cut sets. This equipment is listed in the compensatory Page 18 of 28

measures by stating that maintenance will not be allowed. The ICCDP and ICLERP results for the additional sensitivity cases are provided in the following table. The negative number results indicate that deferring routine maintenance on the equipment reduces the risk to less than the base case.

ICCDP ICLERP delta CDF delta LERF Battery EVCA -1.36E-07 -1.96E-08 -1.07E-07 -1.54E-08 Battery EVCB -1.32E-07 -2.0OE-08 -1.04E-07 -1.57E-08 Battery EVCC 0.OOE+00 0.OOE+00 0.OOE+00 Q.OOE+00 Battery EVCD -1.11E-07 -1.75E-08 -8.71E-08 -1.37E-08 Sum -3.79E-07 -5.71E-08 -2.98E-07 -4.48E-08 To simplify the modeling, restricted maintenance evaluations were not performed for the Fire PRA sensitivity cases. This is conservative because applying restricted maintenance evaluations to the Fire PRA sensitivity cases would produce a lower risk result (more negative).

The results of the internal events sensitivity cases with maintenance restricted on selected equipment are summed with the highest results of the Fire PRA sensitivity cases to produce a total ICCDP and ICLERP for the configuration. The results are provided in the following table:

Internal Events Sensitivity Cases

-3.79E-07 -5.71 E-08 -2.98E-07 -4.48E-08 (Restricted Maintenance)

Fire PRA Sity CA 7.67E-08 8.82E-09 6.03E-08 6.93E-09 SensTotaivy Cases Total -3.03E-07 -4.83E-08 -2.38E-07 -3.79E-08 Regulatory Guide 1.177 indicates that the ICCDP and ICLERP should be less than 1.OE-06 and 1.OE-07, respectively. The total ICCDP and ICLERP indicate a risk decrease, which meets the guideline. Due to the calculated ICCDP and ICLERP being negative values (i.e. risk is less than the base case due to deferring routine maintenance on selected equipment), it is judged that the risk of the requested Completion Time extension is insignificant.

The analysis shows a decrease in CDF and LERF, which meets the recommendations in Regulatory Guide 1.174 for delta CDF and delta LERF.

Page 19 of 28

3.9.2 Tier 2 - Avoidance of Risk-Significant Configurations Risk significant plant equipment outage configurations were identified using PRA insights gained from review of the cut sets.

The insights gained from the cut sets review show that LOOP events are the dominant risk contributor. Based on these insights, the analysis was refined to assume that no elective maintenance would be performed on the following SSCs during the vital battery replacements. Note that vital battery EVCC maintenance does not result in as much risk as the other batteries because the equipment receiving control power from battery EVCC is less significant than the other vital batteries. However, standard plant practices do not typically allow work on opposite train equipment, so from a practical standpoint a comparable list of equipment is established for deferral of routine maintenance.

Compensatory Measures

1. The following SSCs will be protected and routine maintenance deferred during each respective vital battery replacement:

Battery EVCA replacement

" Vital channels B, C, D

" McGuire Switchyard

" Safe Shutdown facility and associated equipment (SSF)

" Emergency Diesel Generators (EDG) 1 B, 2B

" Component Cooling water trains (KC) 1 B, 2B

" Nuclear Service Water trains (RN) 1B, 2B

Motor driven Auxiliary Feedwater (CA) pumps 1 B, 2B

" Unit 1 and 2 Turbine driven CA pumps

" Diesel powered Instrument Air (VI) compressors G, H Battery EVCB replacement

" Vital channels A, C, D

McGuire Switchyard

SSF

EDG 1A, 2A

" KC trains KC 1A, 2A

" RN trains RN 1A, 2A

" Motor driven CA pumps 1A, 2A

Unit 1 and 2 Turbine driven CA pumps

" Diesel powered VI compressors G, H Page 20 of 28

Battery EVCC replacement

" Vital channels A, B, D

" McGuire Switchyard

" SSF

" EDG 1B, 2B

KC trains KC 1 B, 2B

" RN trains RN 1B, 2B

" Motor driven CA pumps 1 B, 2B

" Unit 1 and 2 Turbine driven CA pumps

" Diesel powered VI compressors G, H Battery EVCD replacement

Vital channels A, B, C

McGuire Switchyard

SSF e EDG IA, 2A e KC trains KC 1A, 2A

RN trains RN 1A, 2A

Motor driven CA pumps 1A, 2A

&Unit 1 and 2 Turbine driven CA pumps 9 Diesel powered VI compressors G, H

2. A temporary battery located in the Service Building is available as a defense in depth measure. The temporary battery will be charged and has the necessary connections to tie-in to any of the four DC distribution centers, if necessary.

3. The ambient temperature and hydrogen concentration of the area containing the temporary battery will be monitored once per a 12-hour shift to ensure they remain within battery specifications.

4. The ventilation in the area containing the temporary battery will be supplemented with fans to ensure good air flow and mixing across the temporary battery.

5. Appropriate training will be provided to Operations Shift personnel regarding the vital battery replacement evolution, emergency procedures, and spare battery alignment.

6. Pre-job briefings will be provided to Maintenance and Vendor personnel each shift during the vital battery replacement evolutions.

7. Prior to the start of each TS Completion Time extension, McGuire will monitor the National Weather Service for potential severe weather conditions. To the extent practical, severe weather conditions will be avoided.

8. Prior to the start of each TS Completion Time extension, McGuire will contact the Transmission Control Center (TCC) regarding system grid stability. To the extent practical, system grid instability will be avoided.

Page 21 of 28

3.9.3 Tier 3 - Risk-Informed Configuration Risk Management 10 CFR 50.65 (a)(4), Regulatory Guide 1.182, and NUMARC 93-01 require that prior to performing maintenance activities, risk assessments shall be performed to assess and manage the increase in risk that may result from proposed maintenance activities.

These requirements are applicable for all plant modes. NUMARC 91-06 requires utilities to assess and manage the risks that occur during the performance of outages.

The proposed LAR is not expected to result in any significant changes to the current configuration risk management program. The existing program uses a blended approach of quantitative and qualitative evaluation of each configuration assessed. The McGuire on-line computerized risk software, Electronic Risk Assessment Tool (ERAT),

considers both internal and external initiating events with the exception of seismic events. Thus, the overall change in plant risk during maintenance activities is expected to be addressed adequately considering the proposed amendment.

McGuire has several Nuclear System Directives (NSD) and Work Process Manual (WPM) procedures that are in place to ensure that risk significant plant configurations are avoided. These documents are used to address the Maintenance Rule requirements, including the on-line (and off-line) Maintenance Policy requirement to control the safety impact of combinations of equipment removed from service. The key documents are as follows:

NSD 213, "Risk Management Process"

NSD 403, "Shutdown Risk Assessment (Modes 4, 5, 6, and No-Mode) per 10 CFR 50.65 (a)(4)"

" NSD 415, "Operational Risk Management (Modes 1-3) per 10 CFR 50.65 (a)(4)"

WPM-609, "Innage Risk Assessment Utilizing Electronic Risk Assessment Tool (ERAT)"

WPM-608, "Outage Risk Assessment Utilizing Electronic Risk Assessment Tool (ERAT)"

More specifically, the NSDs referenced above address the process; define the program, and state individual group responsibilities to ensure compliance with the Maintenance Rule. The Work Process Manual procedures provide a consistent process for utilizing the computerized software assessment tool; ERAT, which manages the risk associated with equipment inoperability.

The Electronic Risk Assessment Tool (ERAT) is a Windows-based computer program used to facilitate risk informed decision making associated with station work activities.

Its guidelines are independent of the requirements of the Technical Specifications and Selected Licensee Commitments and are based on probabilistic risk assessment studies and deterministic approaches.

Page 22 of 28

Additionally, prior to the release of work for execution, Operations personnel must consider the effects of severe weather and grid instabilities on plant operations. This qualitative evaluation is inherent of the duties of the Work Control Center Senior Reactor Operator (WCC SRO). Responses to actual plant risk due to severe weather or grid instabilities are programmatically incorporated into applicable plant emergency or response procedures.

The key safety significant systems impacted by this proposed LAR are currently included in the Maintenance Rule program, and as such, availability and reliability performance criteria have been established to assure that they perform adequately.

3.10 Conclusion Even though all the current McGuire vital battery banks are operable from a capacity standpoint, physical degradation will eventually start to accelerate as a result of the nodular corrosion phenomenon. Consequently, replacing all four vital batteries prior to the end of their 20 year service life needs to be performed.

During the time period of each vital battery bank replacement, the associated DC channel will remain energized by being cross-tied to another operable DC channel as allowed by TS 3.8.4 Condition A. In addition, a temporary, spare battery will be available as an additional, backup DC power supply.

Duke Energy used a combination of a deterministic approach and Probabilistic Risk Analysis (PRA) insights to evaluate operating both units with one vital battery inoperable for an extended period of time. The configuration risk for this temporary one-time change was judged to be insignificant.

Given the above, there is no significant decrease in margin of safety or increased risk of core damage associated with this license amendment request.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 10 CFR 50, Appendix A, General Design Criterion (GDC) 17, "Electric Power Systems," requires, in part, that "An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety ... The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies."

Page 23 of 28

10 CFR 50, Appendix A, GDC 18, "Inspection and Testing of Electric Power Systems," requires, in part, that "Electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing ... "

10 CFR 50.63, "Loss of All Alternating Current Power," requires, in part, that "Each light-water-cooled nuclear power plant licensed to operate must be able to withstand for a specified duration and recover from a station blackout ... "

During the time period of each vital battery bank replacement, the associated DC channel will remain energized by being cross-tied to another operable DC channel as allowed by TS 3.8.4 Condition A. In addition, a temporary, spare battery will be available as an additional, backup DC power supply.

For all design basis events, any single battery by itself can supply an entire train of DC loads. The interaction between each unit's 125 VDC system is limited such that allowable combinations of maintenance and test operations as governed by the plant Technical Specifications will not preclude the system's capability to automatically supply power to minimum ESF DC loads in either unit, assuming a LOOP.

All four vital batteries have been sized to carry the load duty cycle during LOCA and LOOP conditions for their respective bus/train while maintaining battery terminal voltage above 105 VDC for 60 cells in a cross-tied alignment. Each battery carries DC relays, trip coils, lights and momentary charging spring motor loads, as well as two inverters.

Thus during the replacement periods, compliance with the above regulatory requirements will not be affected. In addition, the new 125 VDC batteries are identical in design and function to the existing batteries thus will continue to meet the above regulatory requirements.

4.2 Precedents The following License Amendment Requests to replace the station batteries have been submitted and approved by the NRC. McGuire has reviewed these Amendments, the RAIs, and the NRC Safety Evaluations and has modeled this submittal after these:

1. Duane Arnold received NRC approval on October 1, 2002 (NRC ADAMS ML No.

022280041).

2. Indian Point received NRC approval on September 19, 2001 (NRC ADAMS ML No. 011990082).

3. Braidwood received NRC approval on March 26, 1999 (NRC ADAMS ML No.

021820479).

4. McGuire received NRC approval on February 7, 1997 (NRC ADAMS ML No.

013230346).

5. Oconee Nuclear Station received NRC approval on August 30, 2010 (NRC ADAMS ML No. 102210354).

6. Salem Unit 2 received NRC approval on September 1, 2010 (NRC ADAMS ML No. 102150499)

Page 24 of 28

4.3 Significant Hazards Consideration Pursuant to 10 CFR 50.90, Duke Energy Carolinas, LLC (Duke Energy) proposes a license amendment request (LAR) for the Renewed Facility Operating License (FOL) and Technical Specifications for McGuire Nuclear Station, Units 1 and 2.

The proposed LAR would revise the McGuire TS 3.8.4 Condition A. to allow replacement of the existing 125 VDC vital batteries while at power. This proposed LAR would be applicable one-time for each of the four battery channels. The vital batteries were last replaced in 1997 under a similar one-time TS change. All four vital battery channels are currently operable but a physical degradation phenomenon will shorten their 20 year nominal service life.

Since vital battery replacement cannot be accomplished within the Completion Times currently allowed by TS 3.8.4 due to the number of activities, inspections, and tests, the proposed LAR would extend the Completion Time to 14 days for each battery channel replacement. During the time period of each battery bank replacement, the associated DC channel will remain energized by being cross-tied to another operable DC channel as allowed by TS 3.8.4 Condition A. In addition, a temporary, spare battery will be available as an additional, backup DC power supply.

Duke Energy has concluded that operation of the McGuire Nuclear Station Units 1 & 2 in accordance with the proposed changes to the Technical Specifications (TS) does not involve a significant hazards consideration. Duke Energy's conclusion is based on its evaluation, in accordance with 10CFR50.91 (a)(1), of the three standards set forth in 10CFR50.59(c) as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

All four vital batteries are sized to serve normal and emergency loads of both buses. They independently have the capacity to automatically supply minimum engineered safety feature DC loads for accident conditions in one unit and safely shut down the other unit assuming both a loss of offsite power and a single failure in the 125 VDC system. So the probability of accident conditions occurring is not impacted by removing a vital battery for replacement.

The consequences associated with permitting a vital battery to be out of service for up to 14 days have been evaluated and determined to be risk insignificant with equipment protection and compensatory measures in place. The use of this provision is also infrequent since vital battery replacement is performed at or near the end of the designed 20 year life.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Page 25 of 28

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

Operation in accordance with the proposed LAR will not result in any new permanent plant equipment, alter the present plant configuration, nor adversely affect how the plant is currently operated. During the time period of each vital battery bank replacement, the associated DC channel will remain energized by being cross-tied to another operable DC channel as designed and as allowed by TS 3.8.4 Condition A.

No new accident causal mechanisms are created as a result of this proposed LAR. No changes are being made to any structure, system, or component which will introduce any new accident causal mechanisms. This LAR does not impact any plant systems that are accident initiators and does not impact any safety analysis.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in the margin of safety?

Response: No.

The proposed LAR does not physically alter the present plant design nor affect how the plant is currently operated. This activity only extends the amount of time that vital DC channels are allowed to be cross-tied. So a significant reduction in the margin of safety does not occur.

Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident situation. These barriers include the fuel cladding, the reactor coolant system, and the containment system. The performance of the fuel cladding, reactor coolant and containment systems will not be impacted by the proposed LAR.

Therefore, it is concluded that the proposed changes do not involve a significant reduction in the margin of safety.

4.4 Conclusions Based upon the above evaluation, Duke Energy concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

In conclusion, based the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in Page 26 of 28

the proposed manner, (2) such activities will be conducted in compliance with NRC regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public

5.0 ENVIRONMENTAL CONSIDERATION

S A review by Duke Energy has determined that the proposed amendment would temporarily change a requirement with respect to use of a facility component located within the restricted area, as defined in 10 CFR 20. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released onsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

Page 27 of 28

IE61XA 9EMKA IEUXft 2EMdX8 ZEUXA IEMXA 2EMMB IE11AXD3 IEMXHIE BMXHCI ISMI(T T M T IC 0

)-K C- 1 ~ r E8CO-2 )--K Y RA Rag VR --K ) R C hosg EC8W4 >~ -- K I)ic-1

(\ C\C Chargerr Batteryter ChargerSind 600/1 0 ) hCSo EVCS Botet T ransfer Bu- r Battery, -,1 Dot~

1 000 0o V IEVDA 2VAEVD8 [ECVYL EVDCL *****D** D j 00 1) m 04 2E4D ;loD 2VD

) Y 000 2AP2KRP 2KRP 2KRP J ZEKVA IEKVA 2EKV8 IEKVII IE.(VC 21KVC IEICVO ZEKD T Manuat Transfer Switche

ATTACHMENT 2 Marked-Up McGuire Technical Specification

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources -Operating LCO 3.8.4 The four channels of DC sources shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel of DC A. 1 Restore channel of DC 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months source inoperable, source to OPERABLE status.

OR A.2.1 Verify associated bus tie 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months breakers are closed between DC channels.

AND -.-

A.2.2 Restore channel of DC 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months source to OPERABLE status.

B. Required Action and B. 1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months

The Completion Time that one channel of DC source can be inoperable as specified by Required Action A.2.2 may be extended beyond the "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months " up to a total of 14 days as part of the battery replacement project. This allowance may be ,Used one-time for each of the four DC channels. Upon completion of the battery replacement project, this footnote is no longer applicable and will expire on December 31, 2014."

McGuire Units 1 and 2 3,8.4-1 Amendment No.16§

ATTACHMENT 3 Regulatory Commitments

REGULATORY COMMITMENTS The following Table identifies those actions committed to by Duke Energy McGuire in this document. Any other statements made in this submittal are provided for informational purposes and are not considered to be regulatory commitments.

COMMITMENT TYPE DUE DATE During replacement of battery EVCA, the following systems One time During EVCA and components will be protected and routine maintenance battery deferred: replacement.

" Vital channels B, C, D

McGuire Switchyard

Safe Shutdown facility and associated equipment (SSF)

Emergency Diesel Generators (EDG) 1 B, 2B

Component Cooling water trains (KC) 1 B, 2B

Nuclear Service Water trains (RN) 1B, 2B

Motor driven Auxiliary Feedwater (CA) pumps 1 B, 2B

Unit 1 and 2 Turbine driven CA pumps

Diesel powered Instrument Air (VI) compressors G, H During replacement of battery EVCB, the following systems One time During EVCB and components will be protected and routine maintenance battery deferred: replacement.

Vital channels A, C, D

" McGuire Switchyard

SSF

EDG 1A, 2A

KC trains KC 1A, 2A

RN trains RN 1A, 2A

Motor driven CA pumps 1A, 2A

Unit 1 and 2 Turbine driven CA pumps

" Diesel powered VI compressors G, H 1 of 3

COMMITMENT TYPE DUE DATE During replacement of battery EVCC, the following systems One time During EVCC and components will be protected and routine maintenance battery deferred: replacement.

Vital channels A, B, D

McGuire Switchyard

SSF

EDG 1B, 2B

KC trains KC 1B, 2B

RN trains RN 1B, 2B

Motor driven CA pumps 1B, 2B

Unit 1 and 2 Turbine driven CA pumps

Diesel powered VI compressors G, H During replacement of battery EVCD, the following systems One time During EVCD and components will be protected and routine maintenance battery deferred: replacement.

Vital channels A, B, C

McGuire Switchyard

" SSF

EDG 1A, 2A

KCtrains KC 1A, 2A

" RN trains RN 1A, 2A

" Motor driven CA pumps 1A, 2A

Unit 1 and 2 Turbine driven CA pumps

" Diesel powered VI compressors G, H A temporary battery located in the Service Building is One time During each available as a defense in depth measure. The temporary TS Completion battery will be charged and has the necessary connections Time extension to tie-in to any of the four DC distribution centers, if necessary.

The ambient temperature and hydrogen concentration of the Ongoing until Prior to area containing the temporary battery will be monitored once spare battery installation of per a 12-hour shift to ensure they remain within battery is removed, spare battery.

specifications.

2 of 3

COMMITMENT TYPE DUE DATE The ventilation in the area containing the temporary battery Ongoing until Prior to will be supplemented with fans to ensure good air flow and spare battery installation of mixing across the temporary battery. is removed, spare battery.

Prior to the start of each TS Completion Time extension, One time Prior to the McGuire will monitor the National Weather Service for start of each potential severe weather conditions. To the extent practical, TS Completion severe weather conditions will be avoided. Time extension Prior to the start of each TS Completion Time extension, One time Prior to the McGuire will contact the Transmission Control Center (TCC) start of each regarding system grid stability. To the extent practical, TS Completion system grid instability will be avoided. Time extension Appropriate training will be provided to Operations Shift One time Prior to battery personnel regarding the vital battery replacement evolution, replacements.

emergency procedures, and spare battery alignment.

Pre-job briefings will be provided to Maintenance and Ongoing Prior to battery Vendor personnel each shift during the vital battery replacements.

replacement evolutions.

_____________________ I_____ I______

3 of 3

ATTACHMENT 4 PRA Evaluation Tables

i ne Taiiure rate OT uivii in tmev. z ana in wne generic uaaa o0 iev. 5 is /.ut--Z in voon, Dut arter Uayesian i ne air compressors updating, in Rev. 3, the failure rate is 3.2E-5. The demand data for CMR and CMS grouped Reciprocating identified in this F&O are Compressors A, B, C, D, E, & F, and Compressor WA1, 1A2, 1B1, & 1B2 together. Compressors WA1, 1B1, 1A2, not significant for event 1B2 only have 1 start and 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months running for each, whereas the Reciprocating Compressors have 54 starts sequences involving vital and 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months running for each. Given the significantly different operating experience, these two kinds of DC control power.

compressors should not be grouped together to evaluate the failure rate. Dominant event 1 sequences related to vital The failure rate for the compressor is significantly reduced from Rev 2 to Rev 3 and is greatly below the generic DC control power are data. The reviewers suspect that this is because of the inappropriate combination of the demands and failures LOOP events that rely on noted above. the diesel air compressors, which are Possible Resolution: Separate the compressors into two groups and evaluate the failure rates separately. not impacted by this F&O.

-+ __________________________

Loss of HVAC initiator was removed, because operators may shut down the plant from remote locations (the Information in the Basis Auxiliary Shutdown Panel and the SSF) if the Control Room is incapable of maintaining inventory control. Not for Selected Licensee only the control room, but also the switch gear room may be affected by the failed HVAC. A particular example Commitment (SLC) of interest is the possibility that the switch gear room AHU might fail but the HVAC chiller is working, in which 16.9.22 (Switchgear Room case operators may not realize the situation in time. CDF may be affected by such an initiator. Ventilation System) indicates that the purpose Possible Resolution: Perform/document additional evaluation of loss of switchgear room HVAC and, if of the switchgear room 2 appropriate, develop a new event tree to analyze the sequence of loss of switch gear room cooling. HVAC is to assure equipment service life, and short term failure of the HVAC does not affect operability. This F&O will not impact the risk evaluation for the vital battery LAR application.

An analysis is available of the effect of overpressurizing the RHR discharge line to the RCS. The analysis Implementation of the new considers the effect of static pressure on the piping integrity by comparing the calculated hoop stress from static ISLOCA methodology RCS pressure and the ultimate strength of the piping. The results show that expected hoop stresses are below (WCAP-17154-P, Rev. 0) 3 the ultimate strength and thus piping failures are not expected to occur. The analysis then assesses the impact is expected to result in a of damaging all sealant materials in the lines (gaskets, valve packing, etc.) to conclude that the break area can decrease in CDF and be conservatively bounded by a 13.5 inch equivalent diameter break. Based on this, all ISLOCAs go to core LERF. The conclusions of damaae. I the vital battery LAR risk I

evaiuation are The present approach does not consider dynamic effects of the isolation valve failures with respect to piping conservative.

integrity. The present approach also does not factor in later industry generic analyses and methodology, e.g.,

NUREG/CR-5744. If piping failures are considered to have a non-zero failure probability, then other specific failure locations can be considered for which some response is available to avoid core damage. As documented in NUREG/CR-5744, other components such as RHR heat exchanger components, flanges, etc.

often represent the weak links. Rather than consider these as a single equivalent large break, as was done for the current McGuire ISLOCA evaluation, specific scenarios could be addressed explicitly, following the NUREG methodology. In addition, there would be a scenario involving a small but nonzero pipe rupture probability to address.

In summary, assigning a zero probability of gross piping system rupture due to a simple pipe hoop stress computation is not consistent with current PRA practice for these events; the present approach may not be sufficiently realistic, and may overstate the ISLOCA CDF contribution.

Since the ISLOCA is the major contributor to LERF, changes in the ISLOCA model could have a significant impact on the McGuire LERF calculations.

Possible Resolution: Consider implementing the more recent methodology, including the dynamic effects of valve rupture on piping integrity and possibly incorporating the results of the ongoing risk-informed in-service inspection of piping study if appropriate, to ensure that the McGuire approach is sufficiently realistic.

2

ere is a significant amount or operator action ana equipment recovery creaitea in tne u; i. A recent upaate or tne Oconee PRA model

. There is insufficient basis presented for the recovery probabilities. Since the present CET was done before demonstrated that the the development of McGuire SAMG, the basis for the recovery probabilities is not clear, are they from the HRA methodology for EOPs? from EPRI-TR-101689? from Draft WOG SAMG? operator actions used at the time of the McGuire

The basis for the operator action success is not apparent; a rigorous HRA does not appear to have been used. peer review produced conservative results,

It appears that the equipment recovery was determined from a review of the cut sets that end up in each PDS. largely due to This avoids double counting of equipment usage as long as the Level 1 PRA "recovery" is adequately overestimation of the designated in the PDS. impact of dependencies.

The split fractions used in the CET should be more rigorously developed, especially for the operator actions. The peer review team noted that the Duke 4 Proposed Resolution: Implement a more rigorous treatment of HRA, including supporting timing and success method of quantifying criteria analyses if necessary, to quantify CET operator actions and equipment recovery. LERF was significantly different than the rest of the industry. As a result, the LERF model was upgraded in 2005 to the simplified method described in NUREG/CR-6595.

This F&O is not expected to affect the overall conclusions of the vital batterv LAR submittal.

The McGuire CET is more complete than most industry efforts in terms of the modeling of equipment recovery The peer review team and post-core damage operator actions. However, this modeling was done prior to the development of the noted that the Duke McGuire SAMG. Thus the CET may not be consistent with current accident management practices at McGuire method of quantifying station. LERF was significantly different than the rest of Could impact CET results, but not likely to impact LERF results. the industry. As a result, the LERF model was upgraded in 2005 to the 3

simpliflee metnoo described in NUREG/CR-6595.

This F&O is not expected to affect the overall conclusions of the vital batterv LAR submittal.

The Level 2 analysis was done with MAP 3b, Versions 11 and 16. Significant improvements to MAAP code Same as disposition for models have been implemented in both MAAP 3b (up to Version 21) and MAAP 4.0 since that time. The impact Item # 5.

of these improvements on the McGuire Level 2 and LERF results is unclear.

6 Could impact CET results, but is not likely to impact LERF results. Thus, for applications sensitive to releases other than LERF, this could be important.

There is no room heatup analysis notebook / evaluation of loss of HVAC to equipment rooms for the McGuire This F&O is under PRA, and apparently no retrievable room heatup calculations or documentation to support the assumption that evaluation as part of the room cooling need not be modeled in the PRA. Other PRAs have found that room cooling is required for some in-progress McGuire PRA rooms such as electrical equipment rooms and small rooms housing critical pumps. (Internal Duke model update. Equipment corrspondence, and past interactions with NRC, have also identified this as an area requiring attention.) rooms that have not been screened or previously Failure of room cooling is typically detectable such that recovery actions are possible to limit impacts. However, modeled will be modeled without an evaluation, it is difficult to ascertain whether or not there are specific areas requiring cooling for as part of the update.

equipment success. Based on the results of a recent model update at Proposed Resolution: Perform an evaluation, with equipment room-specific calculations, if possible, of the Oconee, it is the judgment potential for, and magnitude of the room heatup for rooms housing electrical equipment, pumps, and other key of the analyst that any equipment credited in the PRA. Document the basis for any determinations that equipment will survive the potential impact from anticipated room heatups, and model loss of room cooling as a failure mode in the system fault trees (with. HVAC failures at McGuire recoveries as appropriate) for equipment that may not survive the anticipated heatup for the PRA mission time. would be small and would not change the overall conclusions of the vital battery LAR analysis.

Appendix F.5, Auxiliary Feedwater System (CA) states that "If, during CA operation, the suction pressure drops This F&O is under below a preset pressure for three seconds, the RN (Nuclear Service Water) System water source is aligned evaluation as part of the automatically" [pg. F.5-7, Rev 3]. Design Basis Specification for the CA System, Spec. MCS-1 592.CA-00-0001, in-progress McGuire PRA Revision 12, page 50, section 31.3.2.6 lists six valves that must automatically swap position (closed to open) to model update. The failure 4

proviae nuciear service water to tne suction oi [ne auxiiiary ieeuwater pumps oasea on tne response OT SIX OT ine assureo pain cue to suction pressure switches. These pressure switches do not seem to be modeled nor is an operator action to clam clogging is the open the six RN suction supply valves to CA due to CCF of the pressure switches to provide signal to dominant failure mode.

automatically open the supply valves. Other failures of equipment in this path will An operator action to open the RN supply to CA in the event of automatic swapover failure could be an be overshadowed by the important event in the PRA model; the impact of the actuation logic components should also be addressed so clogging failure.

that the model is complete. Engineering judgment is that any potential impact Proposed Resolution: Evaluate the need for modeling of the pressure switches and/or operator action from pressure switch discussed above; incorporate into the model or document the rationale for excluding. failures at McGuire would be small and would not change the overall conclusions of the vital battery LAR analysis.

The Nuclear Service Water (RN) supply to the Auxiliary Feedwater System (CA) contains a total of six valves Addition of this common which must open automatically (3 per train) to provide RN to the auxiliary feedwater pumps suction. The model cause event to the CA does not appear to include any common-cause failure of these valves to open to provide water to the CA model is expected to be of system. low impact. There are multiple suction paths so The common-cause failure of these valves could be a significant contributor to cut sets involving the failure of that the loss of any one the CA system. path does not have a large impact on overall failure Possible Resolution: Consider adding CCF events for the RN/CA supply to the CA pump suction, or providing, rates. In addition, the in the documentation, the rationale for excluding this. failure of the assured path 9 due to clam clogging is the dominant failure mode.

Other failures of equipment in this path will be overshadowed by the clogging failure.

Engineering judgment is that any potential impact from common cause failures at McGuire would be small and would not chanae the overall 5

conciusions or tne viu battery LAR analysis.

The McGuire Flood Analysis assumes that only 15% of the flood probability value is applicable to the CA Pump This has been addressed room even though the primary flood contribution effect comes from the CA room. The RN suction piping and in the internal flood update strainers are located in the CA room, including a stainless steel expansion bellows of 0.05 thickness (minimum). to the PRA model, and is The previous value used in the PRA for the flood probability from this room was 50% and there appears to be included in the model limited basis for the reduction. When 50% is used in the flooding calculations, the flood probability goes from used for the risk 4.41 E-6 to 1.47E-5. This increases core melt frequency by about 5%. evaluation for the vital 10 battery LAR application.

High flooding failure probability produces a significant increase in core melt frequency.

Possible Resolution: Provide a sound engineering basis for the percentage of flooding probability to be assigned to the CA room. Alternatively (or in addition), determine and document the sensitivity of the PRA results to the selected value, and identify this as a key PRA assumption if appropriate.

- +/- __________________________

6

I ne i-iooa Analysis Tor tne LA -ump room uses a caicuiation to aetermine me eriective ieakage area Tor tne KN zame as aispo!

suction expansion bellows (thickness from 0.05 to 0.5 inches) so that a leakage flow can be calculated. The Item # 10.

calculated leakage rate from the RN expansion bellows (0.05 inches minimum thickness) is essentially the same as that calculated for the 30 inch service water piping which is 0.375 inches thick. Thus, it seems that the leakage rate from a break inthe expansion bellows could be understated. Ifso, the time before critical flood levels are reached could be less than currently predicted.

The potential loss of safety related equipment could occur much more rapidly than expected adversely affecting 11 core melt frequency.

Posible Resolution: Review the Flood Analysis to ensure calculated leakage rates have a sound basis and reflect expected leakage rates and provide updated flood probabilities as necessary. If there are uncertainties in the expected leakage rates, evaluate their impacts via sensitivity or uncertainty evaluation as appropriate.

-+ 4-No specific guidance is given regarding modeling of system dependencies in the system notebooks; however, a The peer review highly knowledgeable analyst could reproduce the given results. A dependency matrix is provided but contains comments indicate that a little detailed explanation of how dependencies were determined. Flood Analysis does not seem to provide highly knowledgeable detail required to reproduce the results except by a highly knowledgeable analyst. analyst could reproduce the given results. This Sufficient guidance should be provided to explain how dependencies are treated in the PRA, such that the indicates that there is not 12 approach can be explained, reviewed, and defended, and so that future PRA updates are performed correctly an issue with the analysis; and consistently. rather the issue is with documentation needing Possible Resolution: Provide guidance for treatment of dependencies, including types of dependencies treated improvement. There is no in the model, approaches used to model dependencies, and important considerations regarding how impact on the analysis dependencies may affect the model and results. performed for the vital battery LAR application.

7

iviany or ine i im success criteria appiiea in tne iviNo 'I- nave oeen perrormea witn oiaer versions or tne MNb success criteria runs MAAP code, MAAP3B revision 16 or earlier. Many improvements have been implemented in the MAAP code were performed by a since this time. The success criteria database should be reconstituted by employing MAAP4 or other currently vendor since the peer accepted codes/analyses. This review should include but not necessarily be limited to the following: review was performed,

- pumps and accumulators required for large LOCA and found similar results

- break ranges for various LOCA sizes to the previous analyses.

- pumps required for small and medium LOCAs This F&O is not expected

- containment response to small LOCA - NS operates to affect the overall 13 - feed and bleed success criteria conclusions of the vital

- SGTR success criteria battery LAR application.

Actual F&O Wording:Success criteria for some systems are supported by MAAP runs with MAAP 3b, Version

16. This version of MAAP has been found to have deficiencies which can impact conclusions and results. In particular for the McGuire PRA, the simple pressurizer model impacts the analyses that involve RCS cooldown and depressurization using SG heat removal by permitting RCS depressurization to match RCS cooldown for transients, without the possible need for pressurizer PORVs, spray or aux spray.

Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. Same as disposition for For example, MLOCA success criteria analyses are done for a 3.5 inch break, while the MLOCA is defined as a Item # 13.

2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 14 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed) vs a break range down to 6 inches, and small LOCA (1 inch break analyzed) vs. break sizes from 3/8 to 2 inches.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

Success Criteria do not appear to have been sufficiently reviewed. The reviewers identified several apparent Same as disposition for errors in the MAAP analyses, including the following: Item # 13.

1) The MLOCA MAAP runs do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the resulting MLOCA success criteria.

15 2) The secondary side heat removal case (SAAG-98) shows no RCS pressure increase when 180 gpm of CA is supplied to 1SG and NC pumps are tripped.

3) For the F/B case, it appears that full CA was used in the MAAP run rather than the defined success criteria of 1 CA pump to 2 SG.

8

I r[It:: UU rIUL d*JP fdILU LJtbU

U;U LAIiLUIId CdtCIIdI LU bLUP UIL LIIIIl IUI Up:IdLUI dL;LIU I]b. rUILIit:, IIIUZL /A I*r*LIL UpUdW UI LIIU analysis do not include the effects of possible operator interventions. Even where they do, the minimum time Oconee PRA model window for operator action is not analyzed. For example, in the feed and bleed case, two pressurizer PORVs demonstrated that the are opened at 10% SG level (per EOPs) and flow from 1 ECC pump is modeled. This results in a core heatup HRA methodology for to about 1800 F. If this were to be used to define the basis for an operator action success, the results would operator actions used at have to be interpreted as indicating that there must be instantaneous operator actions without any recovery time the time of the McGuire for the HRA analysis. Analyses should be available to support available time windows for modeled operator peer review produced actions. Further, the success criteria analyses should reflect impacts of anticipated operator interventions. conservative results, 16 largely due to overestimation of the impact of dependencies.

This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

Table 2 of SAAG-501 lists the pre-initiator His considered in the analysis. The table does not include His for Based on preliminary modeling instrument miscalibration events. evaluations using the Further, no systematic process to identify pre-initiator human actions is identified in the HRA calc. EPRI HRA calculator, calibration errors that result in failure of a single channel are expected to fall in the low 10-3 range.

Calibration errors that result in failure of multiple channels are expected to 17 fall in the low 10-5 range.

Relative to post-initiator Human Error Probabilities (HEPs), equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability. Recent 9

[moUUeIfgy UpUdLab WI Lf1tn Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

Some of the Type Cp HIs are evaluated using the HCR model. For these, the only performance shaping factors Same as disposition for considered are time available and operator response time. Table 4 of SAAG-501 lists the potential effects of Item # 16.

additional PSFs, such as operator experience, but table 4 does not appear to have been applied in the 18 quantification of HI events.

In Rev 3, the documentation of the HEPs for single events is not reproducible. The HRA method calculated 3 Same as disposition for different HEP contributors for each HI [HCR, P(e) and P(c)]. In many circumstances, one element is assumed to Item # 16.

be dominant and the others are neglected. In support of this, summary judgments are made like - "execution errors were assessed negligible", "event not evaluated in detail because was time critical", "cause based calculation not performed because action is time critical". The time is not referenced to any T/H basis or generic analysis. The basis for assumptions and criteria is not documented.

In general, there is limited documentation for the HRA in the following areas.

19 1. The sequence context of each HI is not stated.

2. The previous failures in the event sequence, the performance shaping factors, or stress levels are not stated.

3. Procedural steps applicable to each HEP are not consistently provided.

4. Basis (T/H) for timing of each action is not provided.

The lack of these types of information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

10

For each accident sequence, IDENTIFY the Accident sequence Phenomenological effects are already phenomenological conditions created by the notebooks and system considered in the model, but were not accident progression. Phenomenological impacts model notebooks should well documented. This is not expected include generation of harsh environments affecting identify those to impact the overall conclusions of the temperature, pressure, debris, water levels, environmental effects of the vital battery LAR application.

humidity, etc. that could impact the success of the initiating event and the system or function under consideration [e.g., loss of impact on mitigation pump net positive suction head (NPSH), clogging of systems.

flow paths]. INCLUDE the impact of the accident progression phenomena, either in the accident sequence models or in the system models.

DA-Ala ESTABLISH definitions of SSC boundaries, failure Revise the data calc. to No The Oconee PRA model was recently (old) modes, and success criteria consistent with discuss component updated, and the Systems Analysis in corresponding basic event definitions in Systems boundaries definitions, the updated model was found to be DA-A2 Analysis (SY-A5, SY-A7, SY-A8, SY-A10 through consistent with the previous modeling.

(new) SY-A1 3 and SY-B4) for failure rates and common The McGuire PRA model was cause failure parameters, and ESTABLISH developed by the same personnel boundaries of unavailability events consistent with using a similar process. Therefore, this corresponding definitions in Systems Analysis (SY- gap is considered to be a A18). documentation issue and will not affect the overall conclusions of the vital battery LAR application.

DA-B1 For parameter estimation, GROUP components Revise the data calc. to Partial This is a refinement to the equipment according to type (e.g., motor-operated pump, air- segregate standby and failure rates. However, since most operated valve) and according to the characteristics operating component data. components are grouped appropriately, of their usage to the extent supported by data: (a) Segregate components by the overall impact should be small.

mission type (e.g., standby, operating) (b) service service condition to the This gap is not expected to affect the condition (e.g., clean vs. untreated water, air) extent supported by the overall conclusions of the vital battery data. LAR application.

I1

vvnen ine bayesian approacn Is useu ouuueivC d ErIirlanLGe LHi inis is a uocumentation issue oniy.

distribution and mean value of a parameter, CHECK documentation to include a Workplace procedures are in place to that the posterior distribution is reasonable given the discussion of the specific ensure that the Bayesian update relative weight of evidence provided by the prior and checks performed on the results are reviewed for the plant-specific data. Examples of tests to ensure Bayesian-updated data, as reasonableness by the data analyst.

that the updating is accomplished correctly and that required by this SR.

the generic parameter estimates are consistent with the plant-specific application include the following:

(a) confirmation that the Bayesian updating does not produce a posterior distribution with a single bin histogram (b) examination of the cause of any unusual (e.g., multimodal) posterior distribution shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate (d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean value DA-D6 USE generic common cause failure probabilities Provide documentation in Partial The self assessment team indicated consistent with available plant experience. SAAG 637 of the that none of the open items are EVALUATE the common cause failure probabilities comparison of the expected to have a significant impact consistent with the component boundaries, component boundaries on the PRA results or insights. No assumed for the generic technical issues were identified for this CCF estimates to those gap. This is a documentation issue assumed in the McGuire only and is not expected to affect the PRA to ensure that these overall conclusions of the vital battery boundaries are consistent. LAR application.

12

IU-IN I ir T, rn[UglI d evieW UI prULotUUleb dllU IIIWIL;;: LltIIt fl/M LU oasbu unUlpreirnarfid[y tvdIudlIuln usbriy practices, those calibration activities that if consider the potential for the EPRI HRA calculator, calibration performed incorrectly can have an adverse impact calibration errors. errors that result in failure of a single on the automatic initiation of standby safety channel are expected to fall in the low equipment. 10-3 range. Calibration errors that result in failure of multiple channels are expected to fall in the low 10-5 range.

Relative to post-initiator Human Error Probabilities (HEPs), equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability.

Recent modeling updates for the Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

HR-A3 IDENTIFY which of those work practices identified Identify maintenance and No Based on preliminary evaluations using above (HR-Al, HR-A2) involve a mechanism that calibration activities that the EPRI HRA calculator, calibration simultaneously affects equipment in either different could simultaneously affect errors that result in failure of a single trains of a redundant system or diverse systems equipment in either different channel are expected to fall in the low

[e.g., use of common calibration equipment by the trains of a redundant 10-3 range. Calibration errors that same crew on the same shift, a maintenance or test system or diverse systems. result in failure of multiple channels are activity that requires realignment of an entire system expected to fall in the low 10-5 range.

(e.g., SLCS)]. Relative to post-initiator Human Error Probabilities (HEPs), equipment random failure rates and maintenance unavailability, calibration HEPs are not expected to contribute significantly to overall equipment unavailability.

Recent modeling updates for the Oconee PRA support this position. This F&O is not expected to affect the overall conclusions of the vital battery LAR submittal.

13

rINuvIu- an assessren[TU U1 Mne unILeILdIrILy in UIt ueveiup mIeandi values 101 HEPs. USE mean values when providing point pre-initiator HEPs. values for pre-initiator HEPs have been estimates of HEPs. developed and are in use.

HR-G3 When estimating HEPs EVALUATE the impact of Document in more detail Partial A recent update of the Oconee PRA the following plant-specific and scenario-specific the influence of model demonstrated that the HRA performance shaping factors: (a) quality [type performance shaping methodology for operator actions used (classroom or simulator) and frequency] of the factors on execution human at the time of the McGuire peer review operator training or experience (b) quality of the error probabilities. produced conservative results, largely written procedures and administrative controls (c) due to overestimation of the impact of availability of instrumentation needed to take dependencies.

corrective actions (d) degree of clarity of the meaning of the cues/indications (e) human-machine This F&O is not expected to affect the interface (f) time available and time required to overall conclusions of the vital battery complete the response (g) complexity of detection, LAR submittal.

diagnosis and decision-making, and executing the required response (h) environment (e.g., lighting, heat, radiation) under which the operator is working (i) accessibility of the equipment requiring manipulation (j) necessity, adequacy, and availability of special tools, parts, clothinq, etc.

HR-G4 BASE the time available to complete actions on Enhance HRA Partial Same as response to gap for SR HR-appropriate realistic generic thermal-hydraulic documentation accordingly. G3.

analyses, or simulation from similar plants (e.g.,

plant of similar design and operation) (See SC-B4.).

SPECIFY the point in time at which operators are expected to receive relevant indications.

HR-G6 CHECK the consistency of the post-initiator HEP Document a review of the No Same as response to gap for SR HR-quantifications. REVIEW the HFEs and their final HFEs and their final HEPs G3.

HEPs relative to each other to check their relative to each other to reasonableness given the scenario context, plant confirm their history, procedures, operational practices, and reasonableness given the experience. scenario context, plant history, procedures, operational practices, and experience.

14

1- iK-t unaracterize tne uncertainty in ine estimates oi ine Develop mean values for I nis item nas Deen cioseo. iviean (old) HEPs, and PROVIDE mean values for use in the post-initiator HEPs. values for post-initiator HEPs have quantification of the PRA results. been developed and are in use.

HR-G8 (new)

HR-H2 CREDIT operator recovery actions only if, on a Develop more detailed Partial Same as response to gap for SR HR-plant-specific basis: (a) a procedure is available and documentation of operator G3.

operator training has included the action as part of cues, relevant performance crew's training, or justification for the omission for shaping factors, and one or both is provided (b) "cues" (e.g., alarms) that availability of sufficient alert the operator to the recovery action provided manpower to perform the procedure, training, or skill of the craft exist (c) action.

attention is given to the relevant performance shaping factors provided in HR-G3 (d) there is sufficient manpower to perform the action IE-Al IDENTIFY those initiating events that challenge Enhance the IE Partial The McGuire PRA model is undergoing normal plant operation and that require successful documentation (as was a complete update, and the complete mitigation to prevent core damage using a done in OSC-9068). list of Initiating Events in the update structured, systematic process for identifying was found to be consistent with the initiating events that accounts for plant-specific previous modeling. Therefore, this gap features. For example, such a systematic approach is considered to be a documentation may employ master logic diagrams, heat balance issue and will not affect the overall fault trees, or failure modes and effects analysis conclusions of the vital battery LAR (FMEA). Existing lists of known initiators are also application.

commonly employed as a starting point.

15

REVIEW the plant-specific initiating event Perform a review of the PRA Change Form M-07-0012 experience of all initiators to ensure that the list of plant-specific initiating identifies two flooding events that were challenges accounts for plant experience. See also event experience of all not initially included in the IE-A7 initiators to ensure that the quantification of the CA Pump Room list of challenges accounts flood frequency. This has been for plant experience. addressed by the flood model update to the internal events PRA, which was used for the vital battery LAR application analysis.

Similarly, a review of the PIP database for fire events that did not lead to plant trip could affect the frequency of a fire initiator. This has been addressed in the recently completed Fire PRA. Other initiators (except for ATWS) result in plant triD and the aeneration of an LER.

IE-A3a REVIEW generic analyses of similar plants to Ensure the list of Partial Same as response to gap for SR IE-(old) assess whether the list of challenges included in the challenges included in the Al.

model accounts for industry experience. McGuire PRA accounts for IE-A4 industry experience using a (new) more recent reference, such as the WOG PSA Model and Results Comparison Database -

Revision 4.

IE-A4 PERFORM a systematic evaluation of each system Provide documentation of a Partial Same as response to gap for SR IE-(old) where necessary (e.g., down to the subsystem or systematic evaluation of all Al.

train level), including support systems, to assess the plant systems, including IE-A5 possibility of an initiating event occurring due to a support systems (including (new) failure of the system. USE a structured approach those not explicitly modeled

[such as a system-by-system review of initiating in the PRA), to assess the event potential, or an FMEA (failure modes and possibility of an initiating effects analysis), or other systematic process] to event occurring due to a assess and document the possibility of an initiating failure of the system.

event resulting from individual systems or train failures.

16

When performing the systematic evaluation required Enhance the IE (old) in IE-A4 (new SR number is IE-A5), INCLUDE documentation (as was Al.

initiating events resulting from multiple failures, if the done in OSC-9068).

IE-A6 equipment failures result from a common cause, and (new) from system alignments resulting from preventive and corrective maintenance.

IE-A5 In the identification of the initiating events, Enhance the IE Partial Same as response to gap for SR IE-(old) INCORPORATE (a) events that have occurred at documentation (as was Al.

conditions other than at-power operation (i.e., during done in OSC-9068).

IE-A7 low-power or shutdown conditions), and for which it (new) is determined that the event could also occur during at-power operation. (b) events resulting in a controlled shutdown that includes a scram prior to reaching low-power conditions, unless it is determined that an event is not applicable to at-power operation.

IE-A6 INTERVIEW plant personnel (e.g., operations, Obtain plant personnel No Same as response to gap for IE-Al.

(old) maintenance, engineering, safety analysis) to input (as was done in OSC-IE-A8 determine if potential initiating events have been 9068).

(new) overlooked.

IE-A7 REVIEW plant-specific operating experience for Include review of precursor Partial Same as response to gap for SR IE-(old) initiating event precursors, for the purpose of events for their potential to Al.

identifying additional initiating events. For example, be initiating events.

IE-A9 plant specific experience with intake structure (new) clogging might indicate that loss of intake structures should be identified as a potential initiating event.

IE-B1 COMBINE initiating events into groups to facilitate Enhance the IE No Same as response to gap for SR IE-definition of accident sequences in the Accident documentation (as was Al.

Sequence Analysis element (para. 4.5.2) and to done in OSC-9068).

facilitate quantification in the Quantification element (para. 4.5.8).

IE-B2 USE a structured, systematic process for grouping Document a structured, Partial Same as response to gap for SR IE-initiating events. For example, such a systematic systematic grouping of Al.

approach may employ master logic diagrams, heat initiating events (as was balance fault trees, or failure modes and effects done in OSC-9068).

analysis (FMEA).

17

%..7ri% L,/U - IIIlLl;"JLlIIY 1VtVIILb UIII* VIWIl~l LiltV IUIIU VIII* t,0ll F--III10:IILM:* UUU,.UIlII1:IILCJLIU)II UI r-diLICII I Od I It: db tUbpUIIbU LU YdFJ IUI be assured: (a) events can be considered similar in the grouping process (as terms of plant response, success criteria, timing, and was done in OSC-9068).

the effect on the operability and performance of operators and relevant mitigating systems; or (b) events can be subsumed into a group and bounded by the worst case impacts within the "new" group.

DO NOT SUBSUME events into a group unless: (1) the impacts are comparable to or less than those of the remaining events in that group, AND (2) it is demonstrated that such grouping does not impact sianificant accident seauences.

IE-D3 DOCUMENT the assumptions and sources Enhance the IE No Same as response to gap for SR IE-uncertainty with the initiating event analysis. documentation (as was Al.

done in OSC-9068).

IF-B3 For each source and its identified failure mechanism, Enhance the Internal Flood Partial This has been addressed by the flood (old) IDENTIFY the characteristic of release and the analysis to address the model update to the internal events capacity of the source. INCLUDE: (a) a potential for spray, jet PRA which was used for the vital IFSO-A5 characterization of the breach, including type (e.g., impingement, and pipe battery LAR application analysis.

(new) leak, rupture, spray) (b) range of flow rates (c) whip failures. Additionally, capacity of source (e.g., gallons of water) (d) the document how these pressure and temperature of the source failures are included in the quantification.

18

r'u Vi* ,Io I iiuuu idl Id IIUL W.Jt'l=llt:U UUL UollIlJy LIIZ *OIV1=:* I LI I% t::Ayt:.LfU OdIiI- 'dbIlubpUlliv LU WCIP (old) requirements under IF-Bib, IDENTIFY the SSCs increase in number of flood B3.

located in each defined flood area and along flood areas needed to satisfy IFSN-A5 propagation paths that are modeled in the internal requirement IF-Al, (new) events PRA model as being required to respond to additional equipment will an initiating event or whose failure would challenge need to be identified and normal plant operation, and are susceptible to flood. discussed in order to meet For each identified SSC, IDENTIFY, for the purpose the requirements of the of determining its susceptibility per IF-C3, its spatial ASME Standard. The location in the area and any flooding mitigative current flooding analysis features (e.g., shielding, flood or spray capability does not discuss flood ratings). mitigative features and this will have to be corrected to satisfy the requirements of the ASME Standard.

IF-C3 For the SSCs identified in IF-C2c, IDENTIFY the The current flooding Partial Same as response to gap for SR IF-(old) susceptibility of each SSC in a flood area to flood- analysis identifies the B3.

induced failure mechanisms. INCLUDE failure by submergence failure height IFSN-A6 submergence and spray in the identification process. of the equipment important (new) ASSESS qualitatively the impact of flood-induced to accident mitigation, but, mechanisms that are not formally addressed (e.g., except for the Aux.

using the mechanisms listed under Capability Shutdown Panel, never Category III of this requirement), by using addresses the impact of conservative assumptions. spray. Spray as a failure mechanism needs to be addressed in the analysis or a note made explaining whv it was omitted.

IF-C3b IDENTIFY inter-area propagation through the normal Provide more analysis of Partial Same as response to gap for SR IF-(old) flow path from one area to another via drain lines; flood propagation B3.

and areas connected via back flow through drain flowpaths. Address IFSN-A8 lines involving failed check valves, pipe and cable potential structural failure of (new) penetrations (including cable trays), doors, doors or walls due to stairwells, hatchways, and HVAC ducts. INCLUDE flooding loads and the potential for structural failure (e.g., of doors or walls) potential for barrier due to flooding loads and the potential for barrier unavailability.

unavailability, including maintenance activities.

19

INL;LUU., in tne quantiTicatlon, Dom tne airect Address potential indirect OdIIIIU db I~bYviiZ) LU cly iU (old) effects of the flood (e.g., loss of cooling from a effects. B3.

service water train due to an associated pipe IFQU-A9 rupture) and indirect effects such as submergence, (new) jet impingement, and pipe whip, as applicable.

IF-F2 DOCUMENT the process used to identify flood Need to document how the Partial Same as response to gap for SR IF-(old) sources, flood areas, flood pathways, flood analysis addressed all of B3.

scenarios, and their screening, and internal flood the items identified in this N/A model development and quantification. For example, requirement.

this documentation typically includes (a) flood sources identified in the analysis, rules used to screen out these sources, and the resulting list of sources to be further examined (b) flood areas used in the analysis and the reason for eliminating areas from further analysis (c) propagation pathways between flood areas and assumptions, calculations, or other bases for eliminating or justifying propagation pathways (d) accident mitigating features and barriers credited in the analysis, the extent to which they were credited, and associated justification (e) assumptions or calculations used in the determination of the impacts of submergence, spray, temperature, or other flood-induced effects on equipment operability (f) screening criteria used in the analysis (g) flooding scenarios considered, screened, and retained (h) description of how the internal event analysis models were modified to model these remaining internal flooding scenarios (i) flood frequencies, component unreliabilities/unavailabilities, and HEPs used in the analysis (i.e., the data values unique to the flooding analysis) (j) calculations or other analyses used to support or refine the flooding evaluation (k) results of the internal flooding analysis, consistent with the quantification requirements provided in HLR QU-D 20

In crediting HFEs that support the accident Explicitly model RCS This issue affects some small LOCAs.

(old) progression analysis, USE the applicable depressurization for small Because the small LOCA contribution requirements of para. 4.5.5, as appropriate for the LOCAs and perform the to LERF is small, the impact to the LE-C7 level of detail of the analysis. dependency analysis on the analysis for the vital battery LAR (new) HEPs. application is insianificant.

LE-F2 PROVIDE uncertainty analysis that identifies the Perform and document Partial Same as response to gap for SR DA-sources of uncertainty and includes sensitivity sensitivity studies to D6.

studies for the significant contributors to LERF. determine the impact of the assumptions and sources of model uncertainty on the LERF results.

LE-F3 IDENTIFY contributors to LERF and characterize Compare LERF results and Partial Same as response to gap for SR DA-LERF uncertainties consistent with the applicable uncertainties to similar D6.

requirements of Tables 4.5.8-2(d) and 4.5.8-2(e). plants and include in the NOTE: The supporting requirements in these tables LERF documentation.

are written in CDF language. Under this requirement, the applicable requirements of Table 4.5.8 should be interpreted based on LERF, including characterizing key modeling uncertainties associated with the applicable contributors from Table 4.5.9-3. For example, supporting requirement QU-D5 addresses the significant contributors to CDF. Under this requirement, the contributors would be identified based on their contribution to LERF.

LE-G3 DOCUMENT the relative contribution of contributors Evaluate the relative Partial Same as response to gap for SR DA-(i.e., plant damage states, accident progression contribution of the various D6.

sequences, phenomena, containment challenges, contributors to the total containment failure modes) to LERF. LERF.

LE-G4 DOCUMENT assumptions and sources of Perform and document Partial Same as response to gap for SR DA-uncertainty associated with the LERF analysis, sensitivity studies to D6.

including results and important insights from determine the impact of the sensitivity studies. assumptions and sources of model uncertainty on the LERF results.

21

ILJr-IMI I IF I IIIIIILCdUIIIII III Lill Include in the LERF OdHIII dtýc I IbJUI I= LU YdFJ lUl OM\

would impact applications. documentation an D6.

assessment that identifies the limitations in the LERF analysis that could impact aDplications.

LE-G6 DOCUMENT the quantitative definition used for Provide a discussion of the Partial Same as response to gap for SR DA-significant accident progression sequence. If other significant cut sets and D6.

than the definition used in Section 2, JUSTIFY the sequences.

alternative.

QU-D3 COMPARE results to those from similar plants and Perform and document a No Same as response to gap for SR DA-(old) IDENTIFY causes for significant differences. For comparison of results D6.

example: Why is LOCA a large contributor for one between the MNS PRA and QU-D4 plant and not another? other similar plants.

(new)

QU-E4 EVALUATE the sensitivity of the results to model Perform and document a No Same as response to gap for SR DA-uncertainties and assumptions using sensitivity set of sensitivity cases to D6.

analyses [Note (1)]. determine the impact of the assumptions and sources of model uncertainty on the results.

QU-F2 DOCUMENT the model integration process, Expand the documentation Partial Same as response to gap for SR DA-including any recovery analysis, and the results of of PRA model results to D6.

the quantification including uncertainty and address all required items.

sensitivity analyses. For example, documentation typically includes (a) records of the process/results when adding nonrecovery terms as part of the final quantification (b) records of the cutset review process (c) a general description of the quantification process including accounting for systems successes, the truncation values used, how recovery and post-initiator HFEs are applied (d) the process and results for establishing the truncation screening values for final quantification demonstrating that convergence towards a stable result was achieved (e) the total plant CDF and contributions from the different initiating events and 22

accident classes (f) the accident sequences and their contributing cutsets (g) equipment or human actions that are the key factors in causing the accident sequences to be nonsignificant (h) the results of all sensitivity studies (i) the uncertainty distribution for the total CDF (j) importance measure results (k) a list of mutually exclusive events eliminated from the resulting cutsets and their bases for Elimination (I) asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model (m) the process used to illustrate the computer code(s) used to perform the quantification will yield correct results process QU-F6 DOCUMENT the quantitative definition used for Document the required Partial Same as response to gap for SR DA-significant basic event, significant cutset, significant definitions. D6.

accident sequence. If other than the definition used in Section 2, JUSTIFY the alternative.

SC-A4 SPECIFY success criteria for each of the key safety Improve the documentation Partial MNS success criteria runs were (old) functions identified per SR AS-A2 for each modeled on the TH bases for all performed by a vendor since the peer initiating event [Note (2)]. safety function success review was performed, and found SC-A3 criteria for all initiators. similar results to the previous analyses.

(new) This F&O is not expected to affect the overall conclusions of the vital battery LAR application.

SC-B5 CHECK the reasonableness and acceptability of the Provide evidence that an Partial Same as response to gap for SR SC-results of the thermal/hydraulic, structural, or other acceptability review of the A4.

supporting engineering bases used to support the T/H analyses is performed.

success criteria. Examples of methods to achieve this include: (a) comparison with results of the same analyses performed for similar plants, accounting for differences in unique plant features (b) comparison with results of similar analyses performed with other plant-specific codes (c) check by other means appropriate to the particular analysis 23

DOCUMENT the success criteria in a manner that Improve the documentation 00111t-, d~b IýbpUIIbt LU WIP U

facilitates PRA applications, upgrades, and peer on the TH bases for all A4.

review. safety function success 4

criteria for all initiators. 4 4 SC-C2 DOCUMENT the processes used to develop overall Improve the documentation Partial Same as response to gap for SR SC-PRA success criteria and the supporting engineering on the TH bases for all A4.

bases, including the inputs, methods, and results. safety function success For example, this documentation typically includes: criteria for all initiators.

(a) the definition of core damage used in the PRA including the bases for any selected parameter value used in the definition (e.g., peak cladding temperature or reactor vessel level) (b) calculations (generic and plant-specific) or other references used to establish success criteria, and identification of cases for which they are used (c) identification of computer codes or other methods used to establish plant-specific success criteria (d) a description of the limitations (e.g., potential conservatisms or limitations that could challenge the applicability of computer models in certain cases) of the calculations or codes (e) the uses of expert judgment within the PRA, and rationale for such uses (f) a summary of success criteria for the available mitigating systems and human actions for each accident initiating group modeled in the PRA (g) the basis for establishing the time available for human actions (h) descriptions of processes used to define success criteria for grouped initiating events or accident seauences I. ______ +/- ___________________________________

24

in meeting OT-/A-I Zanu OT-/A i0, o;UfILilUULUOb Lu riuviuc qudiIuLLdLIV o~difit dzý lt~zJufibt LU Id UI (old) system unavailability and unreliability (i.e., evaluations for screening. D6.

components and specific failure modes) may be SY-A1 5 excluded from the model if one of the following (new) screening criteria is met: (a) A component may be excluded from the system model if the total failure probability of the component failure modes resulting in the same effect on system operation is at least two orders of magnitude lower than the highest failure probability of the other components in the same system train that results in the same effect on system operation. (b) One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component, when their effects on system operation are the same.

SY-A4 PERFORM plant walkdowns and interviews with Enhance the system Partial Same as response to gap for SR DA-system engineers and plant operators to confirm that documentation to include D6.

the systems analysis correctly reflects the as-built, an up-to-date system as-operated plant. walkdown checklist and system engineer review for each system. Consider revising workplace procedure XSAA-106 to require that such documentation be revisited with each major PRA revision.

25

MOIb ILIIl-I Ine UOUnlU[ieUt U1ol LnUurrpUiienit odfT]u d5 rt-spu[15u, to yap wil required for system operation. MATCH the documentation to discuss D6.

definitions used to establish the component failure component boundaries.

data. For example, a control circuit for a pump does not need to be included as a separate basic event (or events) in the system model if the pump failure data used in quantifying the system model include control circuit failures. MODEL as separate basic events of the model, those subcomponents (e.g., a valve limit switch that is associated with a permissive signal for another component) that are shared by another component or affect another component, in order to account for the dependent failure mechanism.

SY-B8 IDENTIFY spatial and environmental hazards that Per Duke's PRA modeling Partial Same as response to gap for SR DA-may impact multiple systems or redundant guidelines, ensure that a D6.

components in the same system, and ACCOUNT for walkdown/system engineer them in the system fault tree or the accident interview checklist is sequence evaluation. Example: Use results of plant included in each system walkdowns as a source of information regarding notebook. Based on the spatial/environmental hazards, for resolution of results of the system spatial/environmental issues, or evaluation of the walkdown, summarize in impacts of such hazards. the system write-up any possible spatial dependencies or environmental hazards that may impact system operation.

26

SY-B15 IDENTIFY SSCs that may be required to operate in The impact of adverse Same as response to gap for (old) conditions beyond their environmental qualifications. environmental conditions D6.

INCLUDE dependent failures of multiple SSCs that on SSC reliability is SY-B 14 result from operation in these adverse conditions. considered but not (new) Examples of degraded environments include: (a) documented.

LOCA inside containment with failure of containment heat removal (b) safety relief valve operability (small LOCA, drywell spray, severe accident) (for BWRs)

(c) steam line breaks outside containment (d) debris that could plug screens/filters (both internal and external to the plant) (e) heating of the water supply (e.g., BWR suppression pool, PWR containment sump) that could affect pump operability (f) loss of NPSH for pumps (g) steam binding of pumps (h) harsh environments induced by containment venting or failure that may occur prior to the onset of core

+

damaae + 4 4 SY-C2 DOCUMENT the system functions and boundary, Enhance system model Partial Same as response to gap for SR DA-the associated success criteria, the modeled documentation to comply D6.

components and failure modes including human with all ASME PRA actions, and a description of modeled dependencies Standard requirements.

including support system and common cause failures, including the inputs, methods, and results.

For example, this documentation typically includes:

(a) system function and operation under normal and emergency operations (b) system model boundary (c) system schematic illustrating all equipment and components necessary for system operation (d) information and calculations to support equipment operability considerations and assumptions (e) actual operational history indicating any past problems in the system operation (f) system success criteria and relationship to accident sequence models (g) human actions necessary for operation of system (h) reference to system-related test and maintenance procedures (i) system dependencies and shared component interface (f) component 27

spailial WITormUon-11U kK) a55umIpLUonb U1 5I1mpILmdLaUons made in development of the system models (I) the components and failure modes included in the model and justification for any exclusion of components and failure modes (m) a description of the modularization process (if used) (n) records of resolution of logic loops developed during fault tree linking (if used) (o) results of the system model evaluations (p) results of sensitivity studies (if used)

(q) the sources of the above information (e.g.,

completed checklist from walkdowns, notes from discussions with plant personnel) (r) basic events in the system fault trees so that they are traceable to modules and to cutsets. (s) the nomenclature used in the svstem models.

__________ U 4 ____________________________ 1 ________ 1 ________________________________________

28

uetermine wnetner Nil t6 and Nil lb Would De expected to close I iis chlange is related to ILUGCA, and does not interact against the possibly higher differential pressure (dp) induced by an with vital DC control power. The impact of this change is ISLOCA. Update the ISLOCA analysis to incorporate the insights not considered to be significant for this application and is from PA-RMSC-0464, "Consensus ISLOCA PRA Model." not included in the analysis.

M-04-0014 MNS PRA model is not taking credit for a recovery that is credited in This change would result in a risk decrease. Therefore, the SGTR WCAP. analysis performed for this application is conservative and the change is not included.

M-06-0004 Revise HRA as needed per comments in PIP M-06-00652. The available time to throttle AFW was reduced from 60 minutes to 50 minutes. This resulted in an increase in the HEP failure probability for FCATHRODHE. This change was incorporated into the analysis for the vital battery LAR submittal.

M-06-0011 Operator Recovery is needed in the SG PORV logic on a loss of This change would result in a risk decrease. Therefore, the instrument air (VI) pressure analysis performed for this application is conservative and the change is not included.

M-07-0015 (1) Revise the CA system model to reflect the capability of being This change would result in a risk decrease. Therefore, the supplied externally via a fire hose. (2) Revise the ND system model analysis performed for this application is conservative and to reflect the capability of supplying the RWST externally via a fire the change is not included.

hose.

Correction: (PRA Tracker Form M-1 1-000 1 was created to deal with using b.5.b equipment to supply the CA system whereas tracker form M-07-0015 will deal with utilizing b.5.b equipment to supply the RWST for ND use.) -JRE 3/9/2011 29

Kevise wne ivicuuire seismic ri-'k, i reroiuve piaNritIvui ll*Ui[iuydL.) I Iii tsibiiI ri-I ib inuL ubeu II tillS LtAM dppIILdLIUII.

fragilities and reinstate component level fragilities per the IPEEE. Instead, seismic is evaluated qualitatively. Therefore, this Reference is Attachment B of DPC-1535.00-00-0006 (CNC-1535.00- change does not affect the vital battery LAR application.

00-0069 and MCC-1535.00-00-0058)

M-10-0001 The ECCS Water Management Project was initiated due to the ECCS water management modification affects FWST following issue: At the time of FWST depletion and ND pump swap- water conservation and eliminates NS pump automatic over to the ECCS sump, the sump level is marginal for a small operation. This does not impact the vital battery LAR spectrum of Small Break LOCAs. The sump inventory contribution application. Additionally, this modification will result in a from ice melt is minimal for these smaller SBLOCAs. To account for risk decrease. Therefore, the analysis performed for this this, the project has determined that it is feasible to raise the application is conservative and the change is not included.

containment spray set-point, and to rely on manual containment spray actuation during the ECCS recirculation phase.

M-1 1-0001 The NRC has required the capability to provide additional accident This change would result in a risk decrease. Therefore, the mitigation functions with pumps commonly referred to as the B.5.b analysis performed for this application is conservative and pumps. Revise the CA system model to reflect the capability of the change is not included.

being supplied externally via a fire hose. (This PRA Tracker Form was created to split the entries in PRA Tracker Form M-07-0015 in regard to the CA and ND systems. Tracker form M-1 1-0001 will deal with using B.5.b equipment to supply the CA system whereas tracker form M-07-0015 will deal with utilizing B.5.b equipment to supply the RWST for ND use.)

30

[Affected PRA element: SY.] Revise the CA system model to reflect This change was determined to impact the LAR ris the need for the operators to manually open CA161, CA162 to evaluation and was incorporated into the analysis.

provide an alternate supply to the CA TDP.

I 31

steam (3enerator Hower uperatea I-Keiiet I nis cnange is included in the application by adding I power supplies not included in the model. panel board transfers as an input to SG PORV logic.

M-04-0015 The T14 (Loss of Vital I&C) frequency in the initiator This change is included in the application by increasing notebook (SAAG 594) does not agree with the the base case T14 IEF to 2.64E-02, and the sensitivity frequency in the I & C Notebook (SAAG 407). cases T14 IEF to 4.OE-02.

M-1 1-0007 SYSTEM ANALYSIS - Remove RN Recovery from This change was incorporated by changing the CAFTA Unit 2 (gate WRNUNIT2) from the RN system database value of WRNUNT2DHE to 1.73 for the base model. and the sensitivity cases. PRA Short Calculation # 288 describes the method used to develop the multiplier.

32

LurULuu, i plant I ne peer review assessment conciuaea tnat A TOIIow-on walKaown was perrormea Dy vv.u on uctoDer A5 walkdown(s) to verify the this SR was not met in the original analysis 24 th-25th, 2011. No missing rooms were identified during accuracy of information and F&O IFPP A5-01 and IFSN A17-01 were the walkdown, but some walkdown sheets were obtained from plant identified. The basis for this determination is documented on a flood area basis rather than a plant information sources and as follows: room basis. This is acceptable to meet The ASME/ANS to obtain or verify: PRA Standard (Ref. 12.3), and is consistent with the (a) Spatial information Based on walkdowns performed by the Peer original internal flooding evaluation which was performed needed for the Review Team, several rooms were identified to some CC-I SRs. An additional walkdown was development of flood that are not included in the current walkdown performed and walkdown forms which represented flood areas forms for the Plant. areas identified what plant features correspond to each (b) Plant design features individual room so that it would not appear any plant credited in defining rooms were missed. Any rooms which were identified as flood areas grouped during the original evaluation are now identified individually in each flood area.

IFPP- DOCUMENT sources of The peer review assessment concluded that The existing analysis was reviewed to identify any missing B3 model uncertainty and this SR was not met in the original analysis assumptions. Any missing assumptions have been related assumptions (as and F&O IFPP B3-01 was identified. The identified, included in that particular calculation note identified in QU-E1 and basis for this determination is as follows: assumption section (Section 4.4) and have been QU-E2) associated with characterized as part of the uncertainty evaluation. The the internal flood plant Some of the key assumptions and areas of uncertainty evaluation has been attached in Appendix C partitioning. uncertainty were not all identified as such. and will be used to update Appendix E in CN-RAM-10-010 These should appear in Section 4.4 but are (Ref. 9). The following set of additional assumptions were found throughout the documents. Many of the identified and captured in the identified calculation notes:

assumptions are not called assumptions but are identified as expectations. Additional assumption to be included into CN-RAM 003 (Ref. 5):

1. "KC was assumed to be lost when the surge tank is empty. The KC was therefore identified as a potential flood source. Breach of the KC pressure boundary including pipe failure and rupture of the surge tanks was identified as a flooding mechanism."

Additional assumption to be included into CN-RAM 004 (Ref. 6):

IrUI dl I N IIUUU, LIMI UF.JUIdLUI ItýbpJUII*b IIIVUIVe LIIl identification of the break location and isolation of the flood source. It was assumed that the operator response is not timely enough to prevent a plant trip.

The successful isolation of an RN flood would render the affected RN train inoperable. The standby train would then be placed in operation. Therefore, RN flood scenarios require additional consideration as flood initiating events."

Additional assumptions to be included into CN-RAM 005 (Ref. 7):

1. "Passive failure of liquid pipes is based on a model that assumes that through-wall flaws are precursors to cracks, leaks, floods and major structural failures.

Pipe failure frequency categories are constructed based on EPRI TR 1013141 in Table 5-3."

2. "Flooding events were assumed to cause a direct failure of the ruptured system (except for spray events) and/or indirect failure of one or more PRA-related equipment (due to spray, submergence or steam) such that a reactor trip or plant shutdown is required. The reactor trip or plant shutdown may be a result of the system failure or the consequential failure of PRA-related equipment. This is significant for operating systems whose failure will cause a reactor trip."

3. "Depending on the location of a pressure boundary failure, certain systems may not cause a plant trip, and this was analyzed on an individual basis."

4. "Given that one of both doors to the Battery Room flood area (door PD-2) was assumed to be opened for a limited duration, a flood-induced event caused bv a 34

i-L.,Uiii1yUi1U IIUIU byLUI1i wLuUIU HIJUtdYC1L% LU LIM Battery Room flood area. The 125 VDC batteries and 125 VDC distribution centers are located in this flood area. The flood would cause a reactor trip for the operating unit due to the submergence of vital electrical equipment. The 125 VDC distribution buses for both units would also fail."

5. "The fraction of time during which door PD-2 is assumed to be open also applies to door PD-7, which is the door in the TB to the EDG room, and is assessed in the model as an additional maintenance activity."

6. "For a Pre-initiator Error Probability, the ASEP HRA Methodology (Ref. 8) was assumed to be applicable and was used to determine a screening value for the probability that operators will induce a flood during a maintenance activity. The ASEP method uses a screening value of .03 for pre-initiators and this value is assumed to be bounding for this probability."

7. "Based on a review of the statistical data included in Appendix A of (Ref. 5), the 5% and 95% data limits were used to establish appropriate passive failure error factors (EFs) for various pipe systems."

Additional assumption to be included into CN-RAM 006 (Ref. 8):

1. "Limited credit was taken for human interactions occurring within the period immediately following the flood. It is reasonable to assume that the Control Room staff will be unable to respond effectively to many events immediately following the flooding event.

Before any local actions are credited, it was confirmed that no access limitations or restrictions exist.

35

-iiyy~iudi udindy Lu Bne piant may sigruicariuy increase the execution time for local actions."

IFSO- For each potential source The peer review assessment concluded that The peer review team identified that Assumption 5a was A4 of flooding, IDENTIFY this SR was not met in the original analysis not valid given that MNS Units 1 & 2 does periodically the flooding mechanisms and F&O IFSO A4-01 was identified. The perform at-power maintenance. However, this that would result in a basis for this determination is as follows: maintenance is infrequent, major system reconfiguration is release. INCLUDE: typically not performed at power and plant staff is well (a) Failure modes of Although there is a discussion of aware of the maintenance. Therefore Assumption 5a has components such as Maintenance-Inducedflood scenarios in MCC- been rewritten. Plant staff being immediately aware of pipes, tanks, 1535-0124, the assumptions noted in this flooding events greatly increases successful event gaskets, expansion section do not appearto be valid or mitigation. Assumption 5a has been rewritten as follows joints, fittings, seals, defendable. These assumptions could result and will be updated in CN-RAM-10-005 (Ref. 7):

etc. in potentialmaintenance-inducedfloods not (b) Human-induced being identified and modeled appropriately. "Reconfiguration of a normally operating fluid mechanisms that system for maintenance activities is typically could lead to For example, the first assumption (5a) states performed while the unit is in cold shutdown overfilling tanks, that reconfigurationof a fluid system for conditions. Additionally, plant staff will be diversion of flow- maintenance activities is performed while the immediately aware of any possible flooding through openings unit is in cold shutdown conditions. It was events resulting from potential maintenance-created to perform therefore assumed that majorpumps relied on induced flooding scenarios. It was therefore maintenance; for power productionhave been secured and assumed that major pumps relied on for power inadvertent actuation would influence the flow rate. production have been secured and would not of fire-suppression influence the flow rate."

system Although it is agreed that most preventive (c) Other events maintenance is performed while a unit is in Additionally, some examples are given by the team of resulting in a release shutdown conditions (hot shutdown or cold specific at-power flooding events, however no changes into the flood area shutdown), corrective maintenance, and some are made to the MNS Units 1 & 2 maintenance induced preventive maintenance activities, which flood assessment as their maintenance activities have require system reconfigurationswhile the unit been thoroughly evaluated and the applicable at power are not precluded unless Technical maintenance induced flooding scenarios have already Specifications exist which would not allow been included in the analysis. However, industry them to be performed in the Tech Spec operating experience specifically dealing with allowed outage time. Forexample, fluid maintenance induced flooding events was not evaluated, systems with a 3 day allowed outage time that and this information has been reviewed and identified as have more pumps than are required for such in the analysis. (Note, the peer review team continued operation (component coolina provided the industry experience data.) The industry 36

WWLUI, Z:;VIUfi Wd(If, UlIdYIly) LUUUIU fldVU expei~riec revieweu is capturea in nmis ietter report in valve maintenanceperformed that requires Appendix B. This Appendix is referred to as Appendix D system reconfigurationsthat have the in the quoted excerpt intended to be included in CN-RAM-potential to resultin maintenance induced 10-005 (Ref. 7) documented below. The table is a floods with the unit at power. Additionally, collection of human-induced floods from the following when valves requiremaintenance (e.g. resources:

internalsreplacement following valve failure),

isolation valves are typically closed under a " Table C-2 of EPRI TR-1013141, which documents clearance order, or a freeze seal is used to significant internal flood events at nuclear power isolate the valve for work. However, there plants world-wide from 1970 to 2002.

have been instances where the isolation valve

INPO Operating Experience databases from 1980 or freeze seal has failed resulting in a flood to 2008, which includes US & foreign events.

path through the removed internals. The " Licensee Event Reports (LERs) from 1980 to potential for these types of maintenance 2008, through the INPO website.

induced floods need to be evaluated.

NRC Information Notice 2009-06 "Construction-Related Experience with Flood Protection The second set of assumptions (6a-g) is not Features".

supported by actualindustry OE. For

SOER 85-5 "Internal Flooding of Power Plant example, several events have occurredin the Bldgs."

industry that were not readily recognizable by " SER 3-98 "Flooding of ECCS Rooms Caused by the personnel who initiatedthe event, but Fire Protection System Water Hammer."

were identified by operations when levels raised/loweredunexpectedly in tanks/sumps.

No new maintenance induced scenarios have been The time to diagnose and respond to the identified in the McGuire internal flooding analysis as a induced floods by the operators exceeded five result of this review. The following should replace the minutes for each task, the actions requiredto discussion present in Section 5.1 in CN-RAM-10-005 (Ref.

mitigate the flood were not always simple, and 7):

stress levels were not low.

"The primary source of rupture data used here is the 2006 EPRI report on pipe rupture frequencies (Ref. 5). In this EPRI report, the rupture frequency is expressed as a per unit length of line of a specific line diameter, magnitude of the discharge, and type of pipe service. This report notes that the piping failure data include all failures associated with valve bodies, heat exchangers and other similar components. The data does include components susceDtible to 37

iow-acceieratea corrosion ano expansion joints in the Circulating Water System (RC) for which specific failure rates are presented. In other words, the EPRI report asserts that the frequency with which a rupture would occur in a specific system in a specific flood area can be adequately predicted from counts of the total length of line of a specific size in that flood area and that the presence of valves and other equipment can be ignored. Baseline frequencies obtained using the EPRI method are presented in Table 5-1.

The last 10 years of the MNS Units 1 & 2 PIPs database was searched using the following keywords: "flood, HELB, rupture, overfill, submerge, overflow, spray, or pipe." Additionally, the MNS Units 1 & 2 LER database over the past 10 years was reviewed to ensure no key occurrences were missed as part of the evaluation. Key issues identified were incorporated into the flooding evaluation as appropriate. The following two issues were identified and explicitly modeled as part of the internal flooding evaluation:

Condenser Circulating Water System (RC) floods in the Turbine Building which may induce a dual unit Loss of Offsite Power (LOOP).

Flooding backflow via the Groundwater Drainage System (WZ) into the CA Pump Rooms.

Additionally, maintenance process documents were evaluated to ensure that maintenance activities would prevent maintenance induced flooding events. The MNS Units 1 & 2 38

UPerUonalll M15K Mdvlanagemenll krel. tf), vvorK Activity Risk Management Process" (Ref. 10) and the "Risk Management Process" (Ref. 11) process documents were specifically reviewed. Key issues were identified and incorporated into the evaluation. Furthermore, industry maintenance events were specifically examined and insights were incorporated as appropriate into the existing analysis. These issues are discussed in detail in Section 5.5.

Additionally, the "Operational Risk Management" (Ref. 11) Nuclear Policy Manual states that:

"If the evaluation determines that there is a risk of causing flood damage to equipment identified in the Electronic Risk Assessment Tool, the following risk mitigation strategies shall be considered:

Development of a Complex/Critical Activity Plan containing risk management actions as described in Appendix E (Risk Management Actions). Guidance for developing a Complex/Critical Activity Plan can be found in NSD 213 (Risk Management Process).

" Consider revising the isolation plan to include double isolation between the open piping and the water source, tagging of pumps which could move the water to the open piping, or draining piping to eliminate the water source.

When possible, work activities and isolations shall be structured such that a flooding potential does not impact redundant trains of equipment identified in the Electronic Risk Assessment Tool.

39

vvnen pussWie, worK actIviieb lriu isolations shall be structured such that a flooding potential does not impact redundant functions. For example, the SSF performs a function that is redundant to the centrifugal charging pumps. If an activity is in progress that presents a flood risk to a centrifugal charging pump, consideration should be given to not performing activities that could affect the ability of the SSF to perform its redundant function.

Identify items such as valves or pumps in the path from the water source to the breach that could be used to isolate or stop a flood."

Note, the previously referenced "Appendix E" refers to an appendix in the "Operational Risk Management" (Ref. 11) Nuclear Policy Manual.

This risk mitigation approach identified in the "Operational Risk Management" (Ref. 11) Nuclear Policy Manual ensures that maintenance procedures will not produce flooding events.

The results of the PIPs and LER search can be found in Appendices B and C respectively while the industry operating experience specifically dealing with maintenance induced floods can be found in Appendix D. This treatment is intended to meet IFEV-A6 at CC-II/III."

IFSO- For each source and its The peer review assessment concluded that Walkdown forms have been reviewed to ensure all fields A5 identified failure this SR was not met in the original analysis have been filled out. Additionally, the temperatures and mechanism, IDENTIFY and F&O IFSO A5-01 was identified. The pressures of the plant fluid systems do not need to be the characteristic of basis for this determination is as follows: defined as all flooding impacts are inherently considered release and the capacity due to Assumption 2 in CN-RAM-1 0-004 (Ref. 6) that all 40

or ine source. IINULUUI:= /-4 I:v:Iw cW L/V l IILellldl rIuuuIuly IULUtUUURs. tqquipTl*Ile, iII [lte uioouI al[ wrIere a IoouI IrullI-Llly III, its (a) A characterization of did not identify where the characterizationof failed. (Note, Assumption 2 has been rewritten so that the breach, including each source and flood mechanism was this treatment is clearer.) Therefore, the following type (e.g., leak, documented. The flood scenarios in MCC- statement should be added to the end of Section 5.3 in rupture, spray) 1535-123 did discuss some of the required CN-RAM-1 0-003 (Ref. 5):

(b) Flow rate information such as type of breach, but not all (c) Capacity of source the requiredinformation. Although the "The temperatures and pressures of the plant fluid (e.g., gallons of walkdown forms provided in Appendix A of systems do not need to be defined as all flooding water) MCC-1535-121 has fields available for some impacts are inherently considered due to (d) The pressure and of the requiredinformation, these fields were Assumption 2 in CN-RAM-10-004 which identifies temperature of the not always filled out, and some of the required that all equipment in the flood area in which a source information was not listed on the walkdown flood initiates, is assumed failed. Therefore it is forms so it was not looked for during the not necessary to describe systems in terms of walkdowns. pressure and temperature to determine potential flood induced failure modes."

The following modification to Assumption 2 is provided for replacing the wording of the existing assumption in the original analysis, CN-RAM-10-004 (Ref. 6):

"All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., water-proofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect."

IFSO- DOCUMENT the internal The peer review assessment concluded that Documentation has been reviewed to ensure that the B1 flood sources in a this SR was not met in the original analysis difficulty the peer review team had reviewing screened manner that facilitates and F&O IFPP Bi-01 was identified. The flood sources is addressed. Documenting plant PRA applications, basis for this determination is as follows: walkdowns on a room-by-room basis rather than a flood upgrades, and peer area basis was performed. This is intended to aid in the review. Documentation is not easy to follow in a few peer review process. Additionally, by not identifying the spots. Difficult to see why specific flood list of critical component heights found in CN-RAM-1 0-004 sources screened. The analysis also lacks a (Ref. 6) Appendix A, the peer review team considered the 41

documentation dcllticult to tollow. I rieretore, no cflange is needed to address that comment. No additional issues with regard to the difficulty the team had reviewing the documentation were identified.

IFSO- DOCUMENT sources of The peer review assessment concluded that Same as IFPP-B3-01 from above.

B3 model uncertainty and this SR was not met in the original analysis related assumptions (as and F&O IFPP B3-01 was identified. The identified in QU-E1 and basis for this determination is as follows:

QU-E2) associated with the internal flood Some of the key assumptions and areas of sources. uncertainty were not all identified as such.

These should appearin Section 4.4 but are found throughoutthe documents. Many of the assumptions are not called assumptions but are identified as expectations.

IFSN- ESTIMATE the capacity The peer review assessment concluded that Piping less than two inches was not screened from the A4 of the drains and the this SR was not met in the original analysis analysis. In some cases piping less than two inches was amount of water retained and F&O IFSN A4-01 was identified. The not measured and included in the pipe length for a given by sumps, berms, dikes, basis for this determination is as follows: flood area, but this was only done when appropriate.

and curbs. ACCOUNT for Assumption 2 in CN-RAM-10-005 (Ref. 7) provides these factors in The analysis states that two inch line breaks justification for this approach:

estimating flood volumes were screened due to the fact that the floor and SSC impacts from drain had the capacity to contain the water. "Pipe sizes of less than or equal to 2 inch flooding. There is no documentation to support this. diameter were not included in generating pipe break frequencies resulting from floods or major The analysis states that spray events were floods, however they were considered for spray screened from the flood analysis due to the effects on an individual basis. Flood areas that fact that the floor drain had the capacityto only contained piping less than 2 inches in contain the water. There is no documentation diameter were not screened from the analysis if to support this. no other larger piping was present in the flood areas. Not including piping less than 2 inches in It should be noted that very few floor drains diameter only marginally reduced the Initiating were noted in the Auxiliary Building during the Event Frequency (IEF), and did not impact the Plantwalkdown. methodology used in the evaluation. This reduction is not verified anywhere but is generally understood as the less than 2 inch diameter 42

piping oniy proviaes a smaii iengin OT pipe compared to the rest of the piping in the rooms.

Additionally, if the initiating event frequencies are examined, the larger piping has greater IEFs by an order of magnitude. Therefore, no comparison was performed. Additionally, the impact of the less than 2 inch diameter piping when compared to the larger piping is significantly less. Finally, in cases in which none of these assumptions hold true, the impact of the less than 2 inch diameter piping is explicitly evaluated. This treatment is intended to support IFSO-Al at CC-I/II/III."

All spray events were not screened from the analysis.

Spray events were evaluated to determine whether or not a pressure boundary failure of a nearby fluid source spraying onto a set of equipment could lead to a plant trip.

As part of this evaluation the floor drains present in the flood area were considered. As appropriate floor drains were credited as a way of mitigating the accumulation of the water in a flood area from a spray event.

Documentation to more clearly state this treatment is being incorporated into the flooding evaluation. The MNS Units 1&2 floor drain calculation, MCC-1206.47-69-1 001 (Ref. 10), should be referenced in the Calculation Note to further justify the treatment. The following is recommended to replace Assumption 3 in CN-RAM 004 (Ref. 6) to clarify this treatment:

"Floor drains were assumed to be capable of controlling water levels for spray events. This is based on the expectation that a spray event will not result in a significant accumulation of standing water. During plant walkdowns it was observed that drain entrances were maintained in proper working conditions and free of debris.

Additionally, walkdowns confirmed that drains were present in all flood areas where spray 43

events were conslaerea. -eviews or severai Problem Investigation Process (PIP) reports suggest that the floor drains that discharge to sumps that provided level alarms in the control room are maintained in working conditions.

Finally, MCC-1206.47-69-1001 (Ref. 15) has verified that drains present in identified flood areas are capable of adequately relieving flood area water levels due to spray events. Drains were not credited for any flood or major flood events. Table 4.4-1 provides a summary of spray event treatment in the analysis."

IFSN- For each flood area not The peer review assessment concluded that See Section 2.21.3 for resolution of PRA equipment A5 screened out using the this SR was not met in the original analysis documentation. Assumption 2 in CN-RAM-1 0-004 (Ref. 6) requirements under other and F&O IFSN A5-01 was identified. The provides justification as to why only limited equipment Internal Flood Supporting basis for this determination is as follows: spatial information is documented. Additionally, requirements (e.g. IFSO- justification for not providing a full set of PRA equipment A3 and IFSN-A12), Although some of the flood areas appearto listing in the internal flooding documentation is provided in IDENTIFY the SSCs identify all PRA related SSCs in them, others Section 2.21.3. In all cases equipment was conservatively located in each defined do not. For example, the Unit 2 AFW Pump assumed to fail as a result of the different flooding flood area and along Room only lists the majorpumps and the Safe mechanisms (as appropriate) and then refinement was flood propagation paths Shutdown Panels. No additional valves or performed as appropriate. Documentation includes that are modeled in the other PRA-related equipment located in the spatial information as appropriate as refinement to the internal events PRA room are identified. Additionally, no spatial modeled scenarios were performed. For example, the CA model as being required information of any of the PRA-related pump room includes a detailed discussion of equipment in to respond to an initiating equipment in the flood areasappears to be the room and its proximity to potential flooding hazards.

event or whose failure documented in the InternalFlooding Analysis. No change is made to Table 5-5 in CN-RAM-10-003 (Ref.

would challenge normal Table 5-5 screening criteria may not be 5) as no example of issues were provided other than plant operation, and are appropriate. asking that the table be verified. The table was compiled susceptible to flood. For based on numerous flooding efforts and was cross-each identified SSC, checked with McGuire plant staff to ensure Table 5-5 IDENTIFY, for the appropriately represented plant equipment susceptibility.

purpose of determining No documentation change is recommended as a result of its susceptibly per IFSN- this F&O.

A6, its spatial location in the area and any flooding mitigative features (e.g.,

44

Table 5:~Flood Modelin Pe~er Revidew Facts ard Observatio~ns for SLupotidnq Recuirements Not Met and Capabilitv CatecibrV 1 Item SR Element CPeer Revew Aessqi*§ejqnt Resouti~ .

shielding, flood, or spray capability ratings).

IFSN- IDENTIFY inter-area The peer review assessment concluded that It is likely the peer review team did not identify a specific A8 propagation through the this SR was met in the original analysis at CC- assessment of this SR in the assessment due to the fact normal flow path from I; however F&O IFSN A8-01 was identified as that this SR is inherently addressed throughout the one area to another via a suggestion. The basis for this determination analysis. The following provides a simple high-level drain lines; and areas is as follows: justification as to how each of the inter-area propagation connected via backflow pathways is treated in the analysis. Each of the potential through drain lines A review of the analysis did not identify inter-area propagation mediums was not addressed involving failed check anywhere that potentialconnections between separately, but rather was addressed as appropriate in valves, pipe and cable areas due to back flow through drains with Section 5.0 in CN-RAM-10-004 (Ref. 6) as the penetrations (including failed check valves, pipe, and cable propagation means was applicable to the scenario and cable trays), doors, penetrationsincluding cable trays or HVA C flood areas being discussed. Each scenario identified in stairwells, hatchways, ducts were evaluated. Additionally, no Section 5.0 in CN-RAM-10-004 (Ref. 6) identifies the and HVAC ducts. discussion of potential for structuralfailures flooding initiator, the pathway (and the inter-area INCLUDE potential for due to flooding loads resulting in additional propagation means taken by the flooding source along structural failure (e.g., of propagationpathways could be found. that pathway) and the impacted equipment. The following doors or walls) due to explicit discussion on inter-area propagation pathways will flooding loads. be included after paragraph one in Section 4.3 in CN-RAM-10-004 (Ref. 6):

"The following provides an explicit description on each of the inter-area propagation pathway means required in SR IFSN-A8 to meet CC-Il:

Drain lines - MNS Units 1 & 2 drainage systems were specifically addressed throughout the analysis. The groundwater drainage system (WZ) especially, was thoroughly analyzed and Sensitivity Study 6 was included in the analysis to determine the degree of interaction between flood areas due to this inter-connected drainage system. All plant drainage systems were evaluated in the internal flooding analysis and the connection between flood areas was identified to determine the potential impact.

" Backflow through drain lines - Backflow through drain lines was evaluated for all drainage 45

bybLU11i dL IVIION UniLs I O, Z. I lie VVL sysLem11 was identified as a system which could potentially impact plant risk from an internal flooding perspective, and this scenario is explicitly evaluated in the analysis. Flooding connections between the CA pump rooms for Unit 1 and Unit 2 was discussed in the evaluation and is described here as an example of one of the backflow scenarios evaluated in the analysis.

" Failed check valves - No potential scenarios were identified with potential backflow issues aside from the WZ system scenarios. This scenario did not credit check valves, and therefore failed check valves are inherently included in the assessment. No other systems were identified due to the wide-open nature of the plant and subsequent defined wide-open flood areas.

Pipe and cable penetrations - During plant walkdowns all penetrations were identified and documented in the walkdown forms which were deemed important to the internal flooding analysis (penetrations which were either sealed or higher than potential flood levels were not documented).

It is reasonable to expect that the non-water tight door(s) associated with the flood area would.fail prior to the accumulation of water to these penetration elevations. No penetrations were identified which would impact a propagation pathway. This does not imply that no penetrations exist within the plant, but rather no penetrations exist which would provide a propagation pathway which would either change the described pathway, or produce a new propagation pathway. Penetrations were identified as sealed throughout the plant.

Doors - Doors were identified and included in all the described scenarios.

46

Table 5: Flo MoeiqPe eve at n Obs~ervations for Suppotn Reureet No e nd Capability Categqry 1 Item SR777 EIement IPe~er Review Asse~ssmenit [ ___ ResolutionV

" Stairwells - Stairwells were identified and included in all the described scenarios.

Hatchways - Equipment hatchways identified throughout the plant were determined to be sealed and did not provide a propagation pathway from one flood area to another. Additionally, in all cases the potential new propagation pathway that the hatchway would have provided would not change the analyzed propagation pathway. For example, flooding from the 716' elevation through the equipment hatches would lead to flooding out the 695' elevation. The impact of the hatchway propagation path is the same as the propagation pathway analyzed via the open stairwell from the 716' elevation to the 695' elevation.

HVAC ducts - Similarly to pipe and cable penetrations, all HVAC ducts were identified and documented in the walkdown forms which were deemed important to the internal flooding analysis (ducts which were higher than potential flood levels were not documented). It is reasonable to expect that the non-water tight door(s) associated with the flood area would fail prior to the accumulation of water to these HVAC duct elevations. No HVAC ducts were identified which would impact a propagation pathway. This does not imply that no HVAC ducts exist within the plant, but rather no HVAC ducts exist which would provide a propagation pathway which would either change the described pathway, or produce a new propagation pathway.

" Structural failure - No break-out walls or structural failures aside from doors or the plug between the Service Building and the Auxiliary Building were identified. The only potentially structural failures were discussed in detail as appropriate in the documentation."

47

I1-0114- ,,L,Ir_. uu I rLUU I 11U PU .1 [t!Vlt:W d-Z]bS bb11t:fL (.;UIIL.;IUU*I Ll::U W L I IMI MIuIUIUb WdS FUL *UU Lu Ucireenu ItIdLIValy [IUIt A12 AREAS where flooding of this SR was not met in the original analysis piping. This was a poor choice of words used to describe the area does not cause and F&O IFSN A12-01 was identified. The the flood area. The Annulus was initially screened due to an initiating event or a basis for this determination is as follows: the fact that no equipment in that flood area could lead to need for immediate plant a plant trip or immediate plant shutdown. Identification of shutdown, AND either of Based on the write-ups in MCC-1535-122, short piping in the Annulus was to support the stance that the following applies: several potential flood areas were screened the piping was sufficiently short to allow that flooding (a) The flood area based on potentially invalid initiator to be subsumed under the loss of system initiators (including adjacent criteria/assumptions. For example, Section corresponding to the fluid systems in the flood area. Upon areas where flood 5.2.1 screens out the Annulus regions based further investigation however it was determine that sources can on the length of the piping being relatively additional scenarios warranted modeling in the Annulus.

propagate) contains short, the PRA-components being primarily Scenarios requiring modeling included Pressure Boundary no mitigating valves which are not susceptible to Failures (PBFs) in the ND, NV and KC systems causing a equipment modeled submergence, and that the unavailabilityof plant trip and a consequential failure of the standby in the PRA; OR these valves are "notexpected to" result in a makeup pump for the standby shutdown facility. The (b) the flood area has no reactortrip. Regardless of the length of the following required documentation changes needed to flood sources piping, the potential/frequencyof a pipe break include these scenarios in the model are identified below.

sufficient (e.g., needs to be evaluated; no listing of PRA- No CDF or LERF changes were identified due to these through spray, components or theirphysical location in the additional scenarios. The contribution to plant risk was immersion, or other flood area is provided nor is the potential not great enough to be retained after quantification applicable impact of spray on them causing them to fail truncation limits were applied. In addition to the changes mechanism) to cause discussed; the actual impact of a failure of identified below, the quantification Calculation Note CN-failure of the these valves on continued plant operations RAM-10-010 (Ref. 9) has been updated to reflect the equipment identified needs to be validated. It is not appropriateto identified model changes. These changes have not been in IFSN-A5. screen out a flood area based on these included in this letter report due to the large number of DO NOT USE failure of a assumptionssince they do not meet the changes and will be incorporated in the revision of barrier against inter-area criteriafor screening. CN-RAM-10-010 (Ref. 9).

propagation to justify screening (i.e., for Section 5.2.4 screens out the AFW isolation Refer to LTR-RAM-11-1 1-112 Section 2.18.3 for a detailed screening, do not credit valves as not being impacted by a flood event discussion of the updated annulus modeling.

such failures as a means since the valves are normally open and fail of beneficially draining open on a loss of power. There is no AFW isolation valves were addressed in Section 2.17.3 as the area). JUSTIFY any discussion of the potential impact of spray on follows:

other qualitative the valves causing them to spuriously close screening criteria. resulting in a partialloss of AFW following a Plant personnel confirmed that neither the PORV loss of MFW due to the break in the Dog controllers (Ref. 11) nor the CA isolation valves House. The spurious closing of the AFW (Ref. 12) are susceptible to spray and therefore Isolation valves in this scenario would result in no change to the existing analysis is appropriate.

48

jTable 5: Flood Modeling Peer Review, Facts and Observ'ations for Supporting Requirements Not Me~t and Capability Cateqor 1,Itemn I Fkm~nt I; ~ ~ -. i ~;,

a situation that cannot be screened. A discussion justifying this treatment has been added to the existing analysis. The following should be input to Section 5.2.4, paragraph six in CN-RAM-10-003 (Ref. 5):

"Furthermore, both AFW isolation valves and PORV controllers were examined to determine if spray event could impact this equipment. Discussions with plant personnel confirmed that neither the PORV controllers (Ref. 54) not the CA isolation valves (Ref. 55) is susceptible to spray, and therefore has not been incorporated into the analysis.

Additionally, the PORV controllers are listed as EQ equipment in a harsh environment and are expected to operate in the defined spray scenario."

Screening criteria, which was used to screen out potential flood areas, were revisited. Upon review no instances aside from those in the previously discussed flood areas were identified which required reassessment. Therefore, with the recommended changes, the screening criteria used to screen potential flood areas are valid and complete.

.1-IFSN- CONDUCT plant The peer review assessment concluded that Walkdowns have been verified and forms have been A17 walkdown(s) to verify the this SR was not met in the original analysis reviewed to ensure all fields have been filled out. The accuracy of information and F&O IFSN A17-01 was identified. The items identified by the peer review team have been obtained from plant basis for this determination is as follows: addressed with the exception of more fully listing the PRA information sources and equipment located in a flood area. The walkdown sheets to obtain or verify: A review of the walkdown forms provided in continue to identify only the PRA-related equipment (a) SSCs located within Appendix A of MCC-1535-121 identified that critical to developing the internal flooding PRA model each defined flood some critical information required to support sufficient to capture the impact of the flooding events. For area the SRs mentioned above was not available example, a flood area may contain a motor-driven oumD 49

kD) r-iooo/spray/otner Of/ MUl WdIKCJC)Wf1 (f/I. I-0F UAFflpWl, ariu assoc5ateu motor operateo suction ano/or aiscnarge applicable mitigative although the forms containeda field for Flood valves. The impact on system operation is the same if features of the SSCs Sources, this appeared to only include tanks, either the motor-driven pump or motor operated valve is located within each and not piping in the area (note states that affected by a flooding event. It is therefore not necessary defined flood area piping and correspondinglengths were to list both the pump and valves to assess the flooding (e.g., drains, shields, determined from isometric and layout impact. Inclusion of either the pump or valve(s) is etc.) drawings), and the volume of the tanks was sufficient to assess the flooding impact on PRA-related (c) Pathways that could not always provided. Although there is a field equipment in the flood area. This is consistent with an lead to transport to on the form for PRA-related equipment in the inquiry and subsequent response by the NRC on the the flood area Area, this information was not filled out topic. The inquiry is identified below:

consistently, resulting in some of the flood zones only listing major equipment such as File # 08-503 pumps and panels, but not all PRA equipment

Subject:

SR IF-C2c [IFSN-A5]

in the room so it is not always possible to Applicability: RA-Sc-2007 up to and including RA-determine what is susceptible to flood-related Sa-2009 impacts, including submergence and/or spray Date Issued: September 10, 2009 impacts in the room. Additionally, some of the Question: Is it the case that SR IF-C2c [IFSN-A5]

information provided is contradictoryfor can only be met if individual components located example, on the walkdown for Unit 2 CA in the flood area are documented?

Pump Room although doors are listed, the Response: No. However if individual components Door Type and Door Sizes are given as N/A, are not identified, adequate justification to support and no information is provided with respect to the level at which SSCs are modeled should be which way the door opens. Some of the documented.

walkdown forms said they assumed the information was the same as Unit I which As a result the level of detail presented in the walkdown implies that an actualwalkdown of the room forms is adequate and a statement justifying the level of was never performed. detail presented has been incorporated into the documentation. The following statement is recommended Since some of the originalwalkdowns are to be added to Section 5.0 at the end of Part B in CN-incomplete with respect to identifying all the RAM-10-002 (Ref. 4):

information required to satisfy the requirements of SRs IFSO-A6, IFPP-A5, "The walkdown sheets identify only the PRA IFSN-A 17, IFQU-A 11 (e.g. equipment equipment critical to developing the internal locations in the rooms, doorpropagation flooding PRA model sufficient to capture the pathways, some information on the forms is impact of the flooding events. This is consistent assumed information, pipe lengths and sizes with NRC inquiry and subsequent response by the are taken from isometric and layout drawings, NRC on the topic. The inquiry is identified below:

etc.) walkdowns to verify the information not 50

aocumentea aunng ine onginau WdIKUOwns r-ie iF Uo-oU-5 are required to ensure validity of the

Subject:

SR IF-C2c [IFSN-A5]

information. Applicability: RA-Sc-2007 up to and including RA-Sa-2009 Date Issued: September 10, 2009 Question: Is it the case that SR IF-C2c

[IFSN-A5] can only be met if individual components located in the flood area are documented?

Response: No. However if individual components are not identified, adequate justification to support the level at which SSCs are modeled should be documented."

IFSN- DOCUMENT the internal The peer review assessment concluded that Same as IFPP 81-01.

B1 flood scenarios in a this SR was not met in the original analysis manner that facilitates and F&O IFPP B1-01 was identified. The PRA applications, basis for this determination is as follows:

upgrades, and peer review. Documentation is not easy to follow in a few spots. Difficult to see why specific flood sources screened. The analysis also lacks a list of criticalcomponent heights.

IFSN- DOCUMENT sources of The peer review assessment concluded that Same as IFPP B3-01.

B3 model uncertainty and this SR was not met in the original analysis related assumptions (as and F&O IFPP B3-01 was identified. The identified in QU-E1 and basis for this determination is as follows:

QU-E2) associated with the internal flood Some of the key assumptions and areasof scenarios. uncertainty were not all identified as such.

These should appearin Section 4.4 but are found throughoutthe documents. Many of the assumptions are not called assumptions but are identified as expectations.

51

UL,,lJUIVIIr-I I rlli iriLrrlial I Iitý p~t ItvI-W dbbtrriliitýL LUFILuIUU~U WdlL B1 flood scenarios in a this SR was not met in the original analysis manner that facilitates and F&O IFPP Bl-01 was identified. The PRA applications, basis for this determination is as follows:

upgrades, and peer review. Documentation is not easy to follow in a few spots. Difficult to see why specific flood sources screened. The analysis also lacks a list of critical component heights.

IFEV- DOCUMENT sources of The peer review assessment concluded that Same as IFPP B3-01.

B3 model uncertainty and this SR was not met in the original analysis related assumptions (as and F&O IFPP B3-01 was identified. The identified in QU-El and basis for this determination is as follows:

QU-E2) associated with the internal flood Some of the key assumptions and areasof scenarios, uncertaintywere not all identified as such.

These should appearin Section 4.4 but are found throughoutthe documents. Many of the assumptions are not called assumptions but are identified as expectations.

IFQU- CONDUCT walkdown(s) The peer review assessment concluded that Same as IFSN A17-01.

11 to verify the accuracy of this SR was not met in the original analysis information obtained from and F&O IFSN A17-01 was identified. The plant information sources basis for this determination is as follows:

and to obtain or verify inputs to: A review of the walkdown forms provided in (a) Engineering analyses Appendix A of MCC-1535-121 identified that (b) Human reliability some critical information required to support analyses the SRs mentioned above was not available (c) Spray or other on the walkdown forms. For example, applicable impact although the forms contained a field for Flood assessments Sources, this appearedto only include tanks, (d) Screening decisions and not piping in the area (note states that piping and correspondinglengths were determined from isometric and layout I _drawings), and the volume of the tanks was 52

IIUL dlIVVCyO JJIUVIUIVU. -'iILIIUUVI/ IIVlfICP 1,0 C1 IIVIU on the form for PRA-related equipment in the Area, this information was not filled out consistently, resulting in some of the flood zones only listing major equipment such as pumps and panels, but not all PRA equipment in the room so it is not always possible to determine what is susceptible to flood-related impacts, including submergence and/or spray impacts in the room. Additionally, some of the information provided is contradictoryfor example, on the walkdown for Unit 2 CA Pump Room although doors are listed, the Door Type and Door Sizes are given as N/A, and no information is provided with respect to which way the door opens. Some of the walkdown forms said they assumed the information was the same as Unit I which implies that an actual walkdown of the room was never performed.

Since some of the originalwalkdowns are incomplete with respect to identifying all the information requiredto satisfy the requirements of SRs IFSO-A6, IFPP-A5, IFSN-A 17, IFQU-A1I (e.g. equipment locations in the rooms, door propagation pathways, some information on the forms is assumed information, pipe lengths and sizes are taken from isometric and layout drawings, etc.) walkdowns to verify the information not documented during the original walkdowns are requiredto ensure validity of the information.

53

Table 5: Flood Modeli~nq Peer Review Facts and Observationts for SLIPportinq Requiremjents Nt Me aaiiyCaeoy1Ie SR Element .Peer Review A§s§sessment Re'soliitionv IFQU- DOCUMENT sources of The peer review assessment concluded that Same as IFPP B3-01.

B3 model uncertainty and this SR was not met in the original analysis related assumptions (as and F&O IFPP 83-01 was identified. The identified in QU-E1 and basis for this determination is as follows:

QU-E2) associated with the internal flood Some of the key assumptionsand areas of accident sequences and uncertainty were not all identified as such.

quantification. These should appearin Section 4.4 but are found throughoutthe documents. Many of the assumptions are not called assumptions but are identified as expectations.

54

If partitioning credits Section 7.1 of plant partitioning and The six non-rated HVAC wall, ceiling, or floor ignition frequency calculation penetrations through the elements that lack a states "The fire compartments reactor building wall (per fire resistance rating, were mapped directly to fire areas; drawing MC-1384-07.17-00) justify the judgment therefore no crediting of have no impact on the FPRA.

that the credited partitioning features that do meet There are no in-situ element will the formal NUREG/CR-6850 combustibles or fixed ignition substantially contain criteria for compartments was sources which would the damging effects of applied. Consequently, MNS contribute to fire propagating fires given the nature 'compartments' are enclosed across the boundary.

of the fire sources rooms with rated fire barriers."

present in each Drawing MC-1384-07.17-00 Note compartment (1) states that six HVAC separated by the penetrations through the reactor nonrated partitioning building wall do not contain fire element. dampers - there is no mention of this in the partitioning documentation or why this is acceptable. Fire areas 25 to 32 and/or 33. Additional examples in F&O description. The SR is not met.

PP-B7 Conduct a No description of walkdown for Since fire compartments confirmatory plant partitioning was given in the correspond to fire area walkdown of locations documentation. Nothing noted that boundaries, the burden for within the global a walkdown related to plant maintaining the condition of analysis boundary to partitioning occurred. Discussion the portioning elements is confirm the conditions with plant analyst determined that programmatically addressed.

and characteristics of additional walkdown information Fire boundary conditions and credited partitioning related to plant partitioning was not characteristics were elements. confirmed or documented since the documented in the Multi-plant partitioning is based upon Compartment Analysis room barriers. Therefore, the SR is (Attachment D of the Scenario not met. Development Report) under the Fire Zone Configuration Notes column.

PP-C3 Document the general Description of the general nature Fire Area boundaries are nature and key or and key or unique features of the described in the Fire unique features of the partitioning elements is limited to a Protection Design Basis partitioning elements single statement that plant fire Specification (MCS-1465.00-that define each areas/rooms are used as the plant 00-0008).

physical analysis unit partitions. This is not sufficient defined in plant documentation of these elements partitioning in a as fire barriers as noted in F&O manner that facilitates PP-B2-01. Basis for Significance:

Fire PRA applications, Documentation does not meet the upgrades, and peer requirement to describe elements review, of the partitioning.

55

Document the cable The Cable Selection document is Enhanced details on Y1 and selection and location well organized, but requires more Y2 cables were added to methodology applied detail in order to facilitate Fire PRA section 2 of the Cable in the Fire PRA in a applications, upgrades and peer Selection Report. The report manner that facilitates review. Therefore, the SR is judged states that Y1 and Y2 cables Fire PRA applications, to be not met. are comprised of thermoset upgrades, and peer cables constructed with flame review. retardant cross-linked polyethylene insulation, an interlocking armor and a PVC exterior iacket.

CS-C3 If the provision of SR As noted for SR CS-Al1, assumed A clearer basis for the Y3 CS-Al 1 is used, cable routing appears to be cable routing was included in document the reasonable, however more detailed section 2.3 of the Cable assumed cable documentation is judged to be Selection Calculation.

routing and the basis needed to facilitate Fire PRA Additionally, cable selection for concluding that the applications, upgrades and peer has since been expanded to routing is reasonable review. Therefore, the SR is judged address numerous Y3 in a manner that to be not met. components.

facilitates Fire PRA applications, upgrades, and peer review.

CS-C4 Document the review The electrical distribution system The peer review stated that of the electrical over current coordination and this is a documentation issue distribution system protection analysis is judged to be and that analysis is judged to overcurrent reasonable based on review, be reasonable. This item does coordination and However, documentation is not yet not affect the conclusions of protection analysis in complete. Therefore, the SR is the vital battery LAR analysis.

a manner that judged to be not met.

facilitates Fire PRA application, upgrades, and peer review.

PRM-B2 Verify the peer review Appendix E of the McGuire and All known deficiencies exceptions and Catawba PRA Technical Adequacy identified as having a deficiencies for the for NFPA-805 report provides potentially significant impact Internal Events PRA exceptions and deficiencies for the on the FPRA have been are dispositioned, and Internal Events PRA. Of the 55 addressed (refer to PRM-B1 1-the disposition does open SRs, 14 are of a technical 01). The FPRA Model not adversely affect nature. All dispositions were Development Report was the development of documented to not adversely affect updated (Section 4) to the Fire PRA plant the development of the Fire PRA acknowledge that internal response model. plant response model. However, events open items are the findings are judged to not be addressed during applications conclusive. In particular, basic consistent with the IEPRA event data is out-of-date (pre- practice.

NUREG/CR-6928), which doesn't account for running/standby components. Additionally, no pre-initiator HEPs have been modeled.

Certain pre-initiator HEPs have the potential to impact the PRA results with some significance. For 56

example, miscalibration of RWST and containment sump level indicators could potentially be significant for an ice condenser plant. Therefore, the SR is judged to be not met.

PRM-B1 1 Model all operator This SR is considered to be not All findings associated with actions and operator met because of a number of issues HRA SRs have been influences in associated with the identification resolved. Also, Duke has accordance with the and incorporation of fire related updated the HEP values as HRA element of this HFEs. See HRA F&Os. necessary to address the use Standard. of mean values. The updated HEP values have been incorporated into the recovery rule file used for FPRA quantification.

FSS-C5 Justify that the The MNS FPRA uses thermo set As described in Section 6.1 of damage criteria used damage criteria for their cable the Fire Scenario Report, the in the Fire PRA are damage criteria. Justification for thin layer of flame- retardant representative of the use of this damage criteria is PVC jacket material damage targets provided in Section 6.1 of surrounding the armored associated with each Calculation MCC-1535.00 cable is considered fire scenario. 0104(Draft), MNS Fire Scenario insignificant to impact the Report." Based on the justification results. Non-armored (but not the criteria provided in necessarily thermoplastic)

NUREG/CR-6850, Section H.1.3 cables at MNS are primarily for the treatment of thermo set related to security and cable with a thermoplastic coating communication (phone, LAN, is discussed. This discussion or fiber optic cables). The low concludes the cable used at MNS concentration of non-qualified (armored thermo set with cables, which are not thermoplastic coating) has a associated with credited thermo set damage temperature. In circuits, is considered addition to the predominant use of insufficient to impact the armored thermo set cables with results.

thermoplastic coating, a smaller but not insignificant number non-armored thermoplastic cables are routed in plant cable trays. More robust justification than that provided in Calculation MCC-1535.00-00-0104 (Draft), is needed to justify the use of thermo set cable damage temperatures in the presence of thermoplastic coating material and cables that would be expected to ignite at damage temperatures lower that that for thermo set insulated cables. This SR requires that the damage criteria used in the Fire PRA be 57

representative of the damage targets. Because the target sets include materials and cables that may ignite and/or damage at temperatures lower than the damage temperature used this SR is considered not met. F&Os have been generated for the issues identified above.

HRA-Al For each fire scenario, At least one human action was The FPRA Model Report has for each safe found that the timing from the been updated to document shutdown action internal events model would not be the review of the carried over from the applicable for all fire scenarios in quantification of basic event Internal Events PRA, an identified enclosure. No RNCBLKVDHE which determine whether or adjustment for this timing change revealed that the HEP is not not each action was made in the HEP. Additionally, sensitive to the time available remains relevant and the lack of internal events pre- even with 3 PORVs open valid in the context of initiators and the use of median vs. based on MAAP runs the Fire PRA mean values from the internal performed by Duke.

consistent with the events PRA will requires some Consequently, no adjustment scope of selected level of reanalysis and to the HEP for this action is equipment per the ES requantification of the fire CDF required for the possibility of element and plant once incorporated. See F&Os multiple spurious PORV response model per PRM-B2-01 and PRM-B11-01 operation.

the PRM element of this Standard, and in accordance with HLR-HR E and its SRs in Part 2 with the following clarifications:

(a)Where SR HR-El mentions "in the context of the accident scenarios," specific attention is to be given to the fact these are fire scenarios, and (b)

Develop a defined basis to suppor tthe claim of nonapplicability of any of the requirements under HLR-HR-E in Part 2.

58

Document the Fire There is no traceable path from the The criteria used to develop PRA HRA including documented definition of screening adjust HEPs in Appendix B of (a) those fire-related criteria to the documented HEP the FPRA Model Report influences that affect values for use in the FPRA. The outlined in sections 5.3.1 and the methods, SR is judged to be not met. 5.3.2 has been updated to processes, or eliminate inconsistencies. The assumptions used as report provides details on well as the increasing the HEP value by a identification and specified factor depending on quantification of the action time and complexity of HFEs/HEPs in the action for operator actions accordance with HLR- inside and outside the control HR-I and its SRs in room.

Part 2, and develop a defined basis to suppor the claim of nonapplicability of any ot the requirements under HLR-HR-I in Part 2, and (b) any defined bases to support the claim of nonapplicability of any of the referenced requirements in Part 2 beyond that already covered by the clarifications in the Part.

SF-A2 For those physical Addressed by walkdown review The FPRA Summary Report analysis units within with the exception of loss of has been updated to address the Fire PRA golobal habitability and suppression habitability impacts beyond plant analysis system diversion. The SR is judged what was captured in the boundary, (a) Review to be not met. IPEEE documentation. The installed fire detection Halon cylinders are located in and suppression the Turbine Building systems and provide a basement. In the unlikely qualitative event of an earthquake assessment of the causing a cylinder to rupture, potential for either the Halon would be dissipated failure (e.g., rupture or over the very large volume of unavailability) or the Turbine Building and the spurious operation resulting concentration levels during an eqrthquake, would not be expected to and (b) Assess the significantly impact potential impact of habitability.

system rupture or spurious operation on post earthquake plant response including the potential for flooding relative to water-based fire 59

buppitbl~ ll, bybUt, loss of habitability for gaseous suppression systems, and the potential for diversion of suppressantes from areas where they might be needed for those fire suppression systems associated with a common suppressant supply.

SF-A3 Assess the potential This item is not directly addressed No impact on quantification of for common-cause in the FPRA MCS-1465 00 FPRA or Change Evaluations failure of multiple fire 0008, Rev. 9 (FP DBD) indicates (seismic-fire interaction is suppression systems (Section C. 18.4) that fire pumps purely qualitative per due to the seismically are located in a non-seismic Cat III NUREG/CR-6850. The Fire induced failur of intake. Not clear if this indicates a Protection Specification notes supporting systems potential common mode failure. A that the fire pumps are such as fire pumps, reference to procedures for located in a non seismic fire water storage recovering from a loss of fire water structure. In the event that tanks, yard mains, system pumps was provided the fire pumps are disabled, gaseous suppression (OP/0/B/6400/002 D) and appears TSC Volume 2, Enclosures 46 storage tanks, or to address the specific concern & 47 provide for the building standpipes. identified above. An evaluation of deployment of a portable other potential common cause (Hale) pump or use of the losses of fire system equipment CACST to pressurize the RY appears to be necessary to meet header if necessary for fire this requirement. This SR is judged suppression (stated in the to be not met. Summary Report, section 3.13).

SF-A4 Review plant seismic Need Procedures required by the No impact on quantification of response procedures SR. Therefore, this SR is judged to FPRA or Change Evaluations and Qualitatively be not met. (seismic-fire interaction is assess the potential purely qualitative per that seismically NUREG/CR-6850). It is noted induced fire, or the that Earthquake Procedure spurious operation of RPIOIA/57001007 does not fire suppression reference fire response systems, might procedure AP-45 or TSC compromise post Volume 2, Enclosure 46 & 47; earthquake plant however, in the event of a response. seismic induced fire it is expected that multiple procedures will be used in parallel as necessary. The entry conditions for the fire response procedure (via fire 60

didIIfmI drlr[UiC;IdrU OfM UI r UPOIL a fire) apply at all times and under any plant operating conditions.

SF-A5 Review (a) plant fire Need Procedures required by the No impact on quantification of brigade training SR. Therefore, this SR is judged to FPRA or Change Evaluations procedures and be not met. (seismic-fire interaction is assess the extent to purely qualitative per which training has NUREG/CR-6850). See prepared firefighting qualitative discussion of personned to respond seismic fires in the McGuire to potential fire alarms Fire PRA Summary Report.

and fires in the wake of an earthquake and (b) the storage and placement of firefighting support equipment and fire brigade access routes, and (c) assess the potential that an earthquake might compromise one or more of these features.

SF-B1 Document the results See F&Os associated with SF-Al The seismic-fire interactions of the seismic/fire through A5. The SR is judged to be found by SF-A2 through A5 interaction analysis, not met. have been addressed above including the results and are also documented in and insights gained the seismic-fire interactions from any unique fire assessment, Section 3.13 of scenrios that were the McGuire Fire PRA identified, in a manner Summary Report.

that failitates Fire PRA applications, upgrades, and peer review.

61

ML12229A146

Contents

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

3.0 TECHNICAL EVALUATION

3.1 System Description

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

Subject:

Subject:

Navigation menu

ML12229A146

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

3.0 TECHNICAL EVALUATION

3.1 System Description

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

Subject:

Subject:

Navigation menu

Search