NRC 2018-0014, NextEra Energy Point Beach, LLC, Construction Truss License Amendment Request 278, Response to Request for Additional Information

NextEra Energy Point Beach, LLC, Construction Truss License Amendment Request 278, Response to Request for Additional Information

ML18102B164
Person / Time
Site:	Point Beach
Issue date:	04/12/2018
From:	Craven R Point Beach
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NRC 2018-0014
Download: ML18102B164 (220)

Text

NEXTera ENERGY .

POINT BEACH April 12, 2018 NRC 2018-0014 U.S. Nuclear Regulatory Commission ATTN : Document Control Desk Washington, DC 20555-0001 Point Beach Nuclear Plant, Units 1 and 2 Docket 50-266 and 50-301 Renewed License Nos. DPR-24 and DPR-27 NextEra Energy Point Beach. LLC. Construction Truss License Amendment Request 278.

Response to Request for Additional Information

References:

1. NextEra Energy Point Beach, LLC, License Amendment Request 278, Risk-Informed Approach to Resolve Construction Truss Design Code Nonconformances, dated March 31, 2017 (ML17090A511)

2. NRC Letter, Point Beach Nuclear Plant, Units 1 and 2 - Request for Additional Information for Point Beach Nuclear Plant, Units 1 and 2, Regarding License Amendment Request to Resolve Nonconformances Relating to Containment Dome Truss (EPID L-2017-LLA-0209),

dated January 31 , 2018(ML18025C043)

By letter dated March 31, 2017 (Reference 1), NextEra Energy Point Beach, LLC (NextEra) subm itted License Amendment Request (LAR) 278 to resolve legacy design code nonconformances associated with the Point Beach Units 1 and 2 containment dome construction trusses. By letter dated January 31, 2018 (Reference 2), NRC requested additional information to support the review of LAR 278. Enclosure 1 to this letter transmits NextEra's response to the request for information. Enclosure 2 provides an updated probabilistic risk assessment (PRA) report in support of LAR 278.

This letter contains one new regulatory commitment:

1. NextEra wi.11 implement a modifica~ion to protect the contrql cables for Unit 2 pres~urizer power operated relief valve (PORV) 2RC-431 C, and associated block valve, 2RC-515, from a postulated falling object. This modification will be implemented during the Spring 2020 Unit 2 refueling outage. (Reference RAl-11 .e response.)

If you have any questions, please contact Mr. Eric Schultz, Licensing Manager, at (920)755-7854.

NextEra Energy Point Beach, LLC 661 O Nuclear Road, Two Rivers, WI 54241

Document Control Desk Page 2 I declare under penalty of perjury that the foregoing is true and correct.

Executed on April 12, 2018.

Sincerely, NextEra Energy Point Beach , LLC Robert Craven Plant General Manager cc: Director, Office of Nuclear Reactor Regulation Administrator, Region Ill, USNRC Resident Inspector, Point Beach Nuclear Plant, USNRC Project Manager, Point Beach Nuclear Plant, USNRC

Enclosures:

1. Response to Request for Information License Amendment Request 278, Risk-Informed Approach to Resolve Construction Truss Design Code Nonconformances

2. PBN-BFJR-17-019, Point Beach Units 1 & 2 Construction Truss PRA Evaluation, Revision 1

ENCLOSURE 1 NEXTERA ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 RESPONSE TO REQUEST FOR INFORMATION LICENSE AMENDMENT REQUEST 278, RISK-INFORMED APPROACH TO RESOLVE CONSTRUCTION TRUSS DESIGN CODE NONCONFORMANCES By letter dated March 31, 2017 (Reference 1), NextEra Energy Point Beach, LLC (NextEra) submitted License Amendment Request (LAR) 278 to resolve legacy design code nonconformances associated with the Point Beach Units 1 and 2 containment dome construction trusses.

By letter dated January 31, 2018 (Reference 2), NRC requested additional information to support the review of LAR 278. This enclosure provides the response to the request for information.

Enclosure 2, PBN-BFJR-17-019, Revision 1, presents a revised probabilistic risk assessment (PRA) that includes a bounding case and a demonstrably conservative analysis. As discussed during the audit that was conducted on November 29 and 30, 2017 (ref. ML17319A227), and as presented in response to RAl-3 below, upon LAR approval, it is the revised demonstrably conservative analysis that will be included in the baseline risk of the plant for future risk-informed applications to determine the cumulative impact of changes to the licensing basis.

Accordingly, it is the demonstrably conservative analysis that is requested for review by NRC staff.

Section 2.4 of Enclosure 1 of the submittal proposes "[a]cceptance of the final modified configuration of the Unit 1 construction truss and associated equipment, and the current configuration of the Unit 2 construction truss and associated equipment, using a risk-informed approach for resolution." The current licensing basis for the trusses is the code of record (COR) against which nonconformance is noted for certain truss members. It appears that the licensing basis change includes the use of a different analysis method and acceptance criteria, such as those listed in Tables 4-1 and 4-2 of Enclosure 5 of the submittal, for certain truss members. of the submittal includes the text for the new section (Section A.5.10) of the updated final safety analysis report (UFSAR), which also appears to change the licensing basis for certain truss members to a different code and/or acceptance criteria by incorporating the submittal by reference. However, Section 3.4 of Enclosure 1 of the submittal states that "[t]he alternative evaluation methods and acceptance criteria are not proposed as part of the license basis revision" which appears to be contradictory in that it seeks acceptance of the final proposed configurations of the trusses and associated equipment without any change to the current licensing basis.

a. Clarify the change(s) to the licensing basis being sought by the submittal and provide a tabular comparison of the current licensing basis and the proposed change, including any specific changes to the current COR.

Page 1 of 54

b. Clarify whether the intent of reference to the submittal in the proposed text of the new Section A.5.10 of the UFSAR, as shown in Enclosure 3 of the submittal, is to include the alternative evaluation methods and acceptance criteria used in the submittal as part of the proposed new licensing basis or explain which sections of the submittal are intended to be incorporated by reference.

c. Explain how the cited nonconformances can be reconciled if "[t]he alternative evaluation methods and acceptance criteria are not proposed as part of the license basis revision" as stated in Section 3.4 of Enclosure 1 of the submittal.

Response to RAl-1.a LAR 278 uses a risk-informed methodology to resolve the identified nonconformances associated with the truss structures by demonstrating that the associated risk of the proposed configurations meets the acceptable risk values identified in Regulatory Guide 1.174. To support the determination of the associated risk values, fragility and probability of failure limits were calculated based on structural analyses that used design codes and input values, which deviated from the current licensing basis. These deviations support the fragility value determination for the purposes of calculating the risk values, and are not presented as a deterministic resolution (i.e., the primary purpose of the structural analyses was to identify the limiting members to support fragility analyses, with the secondary function of the structural analyses being to demonstrate that the truss structures maintain structural integrity). However, it is recognized that the LAR submittal seeks approval of the risk-informed resolution, which also includes the request for approval of the evaluation methods and acceptance criteria used to develop the fragility values and evaluate the truss structures and attached/adjacent systems, structures, and components (SSCs) for structural integrity in support of the LAR.

The methodologies and acceptance criteria that are used to determine the strength capacities and demonstrate the ability to maintain structural integrity of the truss structures and other adjacent and supported systems are documented in 1100060-RPT-002, Methodology and Criteria to Determine the Strength Capacity of the Point Beach Nuclear Plant Containment Dome Trusses and Attached/Adjacent Components in Support of a Risk-Informed License Amendment Request. A table summarizing the current code of record and the proposed evaluation methods and acceptance criteria in support of the LAR submittal is shown below (input is taken from Tables 4-1, 4-2 and 4-3 of Enclosure 5 of the LAR submittal and from document 1100060-RPT-002).

Item Current Desian Criteria Proposed Criteria Ground seismic The SSE is based on a Housner Apply a ground motion seismic input based input source. spectral shape ground response on the site-specific ground motion response spectra (GRS) anchored to a 0.12g spectra (GMRS), which is anchored to a PGA. 0.14g PGA.

Vertical accelerations are taken as 2/3 Apply EPRI 3002004396, High Frequency of the horizontal GRS value. Program: Application Guidance for Functional Confirmation and Fragility Evaluation, Appendix A, to define the vertical spectral shape using mean V/H ratios for A-Soft sites.

Page 2 of 54

Item Current Design Criteria Proposed Criteria In-structure In-structure seismic motion In-structure seismic motion determined seismic motion I determined through SSI analysis and through SSI analysis using state-of-practice soil-structure used simplified springs to represent analysis methods using site soil profile as interaction (SSI) soil effects. discussed in Section 5.2 of Enclosure 5 of analysis. the LAR submittal.

Ground motion Olympia, Washington (N80E) on April Time histories selected to meet Section 2.4 time history for 13, 1949, scaled to 0.05g for OBE. of ASCE/SEI 43-05, Seismic Design Criteria SSI analysis. SSE is taken as two times OBE. for Structures, Systems, and Components in Nuclear Facilities, with the limitations identified in NUREG/CR-5925, Evaluation of the Seismic Design Criteria in ASCE/SEI Standard 43-05 for Application to Nuclear Power Plants.

Soil damping. Soil damping is identified as 5% per Soil damping is as determined by SSI Table A.5-2 of Appendix A.5 in the analysis for the site soil profile as discussed UFSAR, however, as noted in Section in Section 5.2 of Enclosure 5 of the LAR A.5.1 of the UFSAR, the containment submittal.

damping values of 2% and 5% include the soil-structure interaction damping.

Structural Damping values used are as defined For the structural calculations to support the damping. in Table A.5-2 of Appendix A.5 of the LAR submittal, use the following damping UFSAR. Specifically: values for the identified equipment:

Prestressed Concrete Containment Containment Structure (5% damping, no Structure on Piles change)

Design Earthquake (2%)

Hypothetical Earthquake (5%) Truss Structures (7% damping), per ASCE/SEI 43-05 Table 3-1, Response Bolted Steel Framed Structures: Level 2 (see response to RAl-20.a for more Design Earthquake (2.5%) information)

Hypothetical Earthquake (5%)

Containment Spray piping attached to the Vital Piping Systems: truss structures (4% damping), per Table 3 Design Earthquake (0.5%) of Regulatory Guide 1.51, Rev. 1, Damping Hypothetical Earthquake (0.5%) Values for Seismic Design of Nuclear Power Plants Acceptance OBE and SSE seismic load Evaluate for the GM RS-based seismic criteria for truss combinations are evaluated against loading as the developed response spectra components seismic class I stress limits, per support the risk-informed approach (i.e.,

subjected to Appendix A.5 of the Point Beach GMRS reflects the site-specific hazard and seismic loads. UFSAR. is appropriate for use with ASCE/SEI 43-05).

The code of record used for the The application of the seismic analysis and evaluation of the truss structures was acceptance criteria from ASCE/SEI 43-05, AISC Manual of Steel Construction, Limit State D, is used to meet ANSI/Al SC 5th Ed., with station practice of limiting N590-1994(R2004), American National SSE loading acceptance criteria to 1.5 Standard Specification for the Design, times the values of AISC 5th Ed., not Fabrication, and Erection of Steel Safety-to exceed 90% of the material yield Related Structures for Nuclear Facilities, per strength. Section 4.2.4 of ASCE/SEI 43-05, with stress increase factor taken from Table Page 3 of 54

Item Current Design Criteria Proposed Criteria 01 .5.7.1, with exceptions as noted below.

Exception:

For truss members (i.e., top and/or bottom chords) not meeting the acceptance criteria of ANSl/AISC N590-1994(R2004), the maximum permissible strain will be limited to 1.5% for combined axial and flexure or flexure only.

Acceptance OBE and SSE seismic load For system segments attached to and criteria for combinations are evaluated against significantly influenced by the truss components SC-I stress limits. structure motion, the seismic load attached to the combinations will be evaluated using only truss structures the GMRS-based seismic load. Apply that are original SC-I stress limits for this evaluation.

subjected to seismic loads.

The code of record for the No change to the code of record.

containment spray piping is USAS B31.1 Power Piping, 1957.

The code of record for the post- No change to the code of record.

accident containment ventilation (PACV) piping is USAS B31.1 Power Piping, 1957.

Pipe supports are evaluated using No change to the code of record.

station guideline DG-M10, Pipe Support Guidelines, which cites AISC Manual of Steel Construction, 5th Ed.

as the code of record for structural steel.

A design code of record for the No change to the code of record.

containment air recirculation cooling system (VNCC) ductwork is not specified in the associated specification (Specification 5118-M-41, Specification for Sheetmetal Ductwork, Heating, Ventilating, and Air Conditioning Systems for the Point Beach Nuclear Plant). In accordance with Bechtel Spec-0852, Structural Design Criteria for the Point Beach Nuclear Plant, use AISC Manual of Steel Construction, 5th Ed.

Lighting and other miscellaneous No change to the code of record.

loads (e.g., conduit) are assessed on a case by case basis to demonstrate the ability to maintain structural integrity.

Note - Per station guideline DG-M09, Design Requirements for Piping Page 4 of 54

Item Current Desi~n Criteria Proposed Criteria Stress Analysis, the ASME B&PV Code, Section Ill, NC and ND, 1977 through the Winter of 1978 Addenda, has been reconciled with USAS B31.1 Power Piping, 1967, for use in pipe stress analysis, with allowable values taken from USAS B31.1 Power Pipinq, 1967.

Containment There are no defined criteria, as the The proposed acceptance criteria are steel liner plate liner contact load was not specifically selected to maintain the requirement of under contact identified for original design. Per leak-tight integrity of the containment liner.

load from the Section 5.1.2.2 of the Point Beach (Note: Per ASME B&PV Code, Section Ill, truss structure. UFSAR, guidance on the Division 1, 1983, Appendix F, Subsection establishment of allowable strains is F-1341.6, bearing stress does not need to taken from ASME B&PV Code, be evaluated for loads for which Level D Section Ill, Nuclear Vessels, 1965, Service Limits are specified.)

Article 4.

The allowable contact load is developed using guidance from ASME B&PV Code, Section Ill, Division 1, 1983, Appendix F.

The allowable stress limit under seismic or thermal loads is the minimum of:

• 0.9Su for maximum primary stress intensity at any location (ASME Appendix F Subsection F-1341.2)

• 2/3 of the maximum sustainable load (ASME Subsection NB-3228.3)

For the assessment of seismic repeated contact load:

• Apply loading/unloading cycles. With each loading cycle, use the displaced shape of the liner from the previous cycle. Determine the accumulation in strains in the liner, and the change in strain between each loading cycle, to assess liner integrity.

Containment There are no defined criteria, as the The proposed code of record remains structure liner contact load was not specifically ACI 318-63. The LAR submittal proposes concrete behind identified for original design. The to permit localized concrete strain steel liner plate at code of record for the concrete exceedance, provided:

contact point with structure is ACI 318-63, Building Code

• The liner maintains leak-tight integrity the truss Requirements for Reinforced as noted above.

structure. Concrete.

• Localized exceedance of strain limits does not significantly reduce containment structure shell strength.

Concrete compressive strength is based on the compressive strength from test data as permitted in ACI 318-63.

Page 5 of 54

Item Current Design Criteria Proposed Criteria Acceptance There are no defined criteria for Acceptance criteria from ANSl/AISC N690-criteria for truss applied thermal loading of steel 1994(R2004) will be used, with stress components structures. Station practice is taken increase factors from Table Q1 .5.7.1.

subjected to from Bechtel Spec-0852, Structural design basis Design Criteria for the Point Beach accident (DBA) Nuclear Plant, which limits thermal loads. acceptance criteria to 1.33 times the allowable values in the AISC Manual of Steel Construction, 61h Ed., not to exceed 90% of the material yield strength.

Response to RAl-1.b The proposed wording for the UFSAR Section A.5.10 is being revised to reflect the alternate evaluation methods and acceptance criteria that were used to develop the fragility values and evaluate the truss structures and attached/adjacent SSCs for structural integrity in support of the LAR submittal (see RAl-1.a response). The alternative evaluation methods and acceptance criteria used to support the LAR submittal are requested to become part of the revised license basis. The calculations that support the fragility or probability of failure analyses and that demonstrate structural integrity of the truss structures is maintained are used to support the evaluation to determine the risk of the proposed configurations of the truss structures.

Demonstration that the associated risk for Unit 1 and Unit 2 meets the established criteria of Regulatory Guide 1.174 is the basis for resolution of the identified nonconformances.

Response to RAl-1.c As noted in response to RAl-1.a, the evaluation methods and acceptance criteria used to develop the fragility values and evaluate the truss structures and attached/adjacent SSCs for structural integrity are requested as part of the LAR submittal. The original construction codes of record for each SSC will remain part of the license basis, but the resolution of the identified nonconformances in the LAR submittal will be in accordance with the proposed changes. The statement in Section 3.4 of Enclosure 1 of the original LAR submittal should read: "The alternate evaluation methods and acceptance criteria are proposed as part of the license basis revision." of the submittal identifies the regulatory commitments made by the licensee in conjunction with the submittal. One of the commitments states that the licensee will "implement new seismic operating limits applicable to both Units ... Site procedures will be revised .... "

Section 3.2 of Enclosure 1 of the submittal provides the proposed "new seismic operating limits" and Section 2.2.2 of the same enclosure provides the maximum ground accelerations in the horizontal and vertical directions for the operational basis earthquake (OBE). It appears that the "new seismic operating limit" for the vertical direction exceeds the corresponding value for the OBE.

a. Provide the basis and justification for the selection of the "new seismic operating limits."

b. Clarify the purpose of the "new seismic operating limits" as compared to the QBE limits when the "new seismic operating limit" for the vertical direction appears to exceed the corresponding value for the OBE.

Page 6 of 54

Response to RAl-2.a The new seismic operating limits identified in Section 3.2 of Enclosure 1 of the LAR, with respect to the truss structures, were derived in calculation 1100060-C-037, Seismic Evaluation of Units 1 and 2 Containment Dome Trusses for Lesser Events. The accelerations (Horizontal of 0.053g and Vertical of 0.045g) documented in the LAR submittal represent the peak ground accelerations that result in truss members and adjacent/supported equipment remaining within the following documented acceptance criteria in the calculation:

• Truss members (including bolts and welds) are analyzed to ANSl/AISC N690-1994(R2004), American National Standard Specification for the Design, Fabrication, and Erection of Steel Safety-Related Structures for Nuclear Facilities, 'Extreme' case allowable limits, not to exceed 0.9xFy (no members exceeding elastic limits).

• Containment liner contact force is evaluated to not exceed 7.43 kips (as determined in calculation 1100060-C-034, Analysis of Containment Liner to Determine Elastic Limit under Contact Load from CDT).

• Post-accident containment ventilation (PACV) piping is evaluated to Class II piping requirements, in accordance with site design guideline DG-M09, Design Requirements for Piping Stress Analysis, to demonstrate that the PACV piping will not prevent an adjacent safety related, Seismic Class I SSC from performing its safety related function.

• Containment spray piping and supports are analyzed in calculations 1100060-C-032, Evaluation of Unit 1 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, and 1100060-C-033, Evaluation of Unit 2 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, to the original site design basis stress limits (USAS 831.1, 1967, Power Piping), as documented in site design guidelines DG-M09 and DG-M10, Pipe Support Guidelines. Allowable support steel and weld stresses for Faulted Condition loading may be increased by a factor of 1.5 x the upset allowable stresses, not to exceed 0.9xFy.

• All remaining SSCs supported by the containment dome trusses (excluding the PACV and containment spray piping) are unchanged from original design basis analyses.

The acceptance criteria defined above were used to maintain the truss components and supported/adjacent SSCs within essentially elastic limits (i.e., no permanent strain deformation).

The truss and associated SSCs were evaluated to determine the seismic accelerations at which the stresses/loads (of the truss and adjacent equipment) reached the acceptance criteria defined above. This ensures the trusses and supported/adjacent SSCs maintain full intended safety functions, with no permanent strain deformations (i.e., all SSCs are restored to their original positions of rest upon removal of loading). The calculated seismic accelerations are specifically tied to the results of calculation 1100060-C-037 and do not represent seismic Code limits for other plant SSCs' design bases (i.e., site maximum ground accelerations of 0.04g in the vertical direction and 0.06g in the horizontal direction, per Section A.5.1 of the UFSAR).

Page 7 of 54

Response to RAl-2.b As demonstrated in calculations 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR, the truss structures and supported/adjacent equipment remain capable of performing their intended design functions considering applied loading from a design basis event. The seismic operating limits identified in Enclosure 1 of the LAR will serve to establish a threshold whereby the site would pursue a controlled dual Unit backdown to hot shutdown. This action ensures that both Units are positioned into a condition that would permit inspection and evaluation of the trusses for any event exceeding elastic stress limits, to ensure that the affected structures/components can withstand a subsequent seismic event before returning the affected Units to power operation.

The peak ground accelerations included in the LAR submittal are specific to the truss structures, as discussed in part a. above, and do not replace the site Operating Basis Earthquake (OBE) and Safe Shutdown Earthquake (SSE) design basis accelerations. Existing site procedures do not require a dual Unit backdown to hot shutdown based on any specific seismic criteria (walkdowns are required if site OBE limits are exceeded to support determination of continued operation). Implementation of the truss-specific peak ground accelerations (as documented in the LAR submittal) in the site procedures will ensure conservative actions are taken to ensure the truss structure is inspected and evaluated prior to continued operation. Station implementation will be consistent with current practice (e.g., use of two significant digits for seismic accelerations of 0.05g Horizontal, 0.04g Vertical).

According to Section 3.1.1 of Enclosure 1 and Section 1.3 of Enclosure 4 of the submittal, the initiating events considered are seismic events and thermal loading arising from postulated accidents. These initiators are used in the risk assessments for both the "bounding" and the "demonstrably conservative" analyses. The focus on these initiators is presumably due to the source of the nonconformances. However, a risk assessment needs to consider events and hazards that can credibly impact the structural integrity of the truss and the equipment supported from it. Provide quantitative or qualitative technical justification for the exclusion of internal and external initiating events other than those already considered in the analysis that could impact the application.

Response to RAl-3 As noted in the first page of this Enclosure, NextEra has revised the PRA evaluation in support of LAR 278 and has included it in this transmittal. The revised PRA evaluation is an extensive revision due to the additions and refinements. However, the previous information and conclusions of the PRA evaluation remain unchanged. As also noted in the first page of this Enclosure, the PRA evaluation includes a bounding case and a demonstrably conservative analysis. It is the demonstrably conservative analysis that will be implemented and is requested for staff review.

In response to RAl-3, only initiating events that can increase containment temperature above 250°F are considered in the PRA evaluation. 250°F is the temperature at which the probability of a construction truss overstress is -1 E-7. This probability is based on the Thermal Fragility Curve, Figure 11, Section 2.3.1 in the revised PRA evaluation, PBN-BFJR-17-019, Revision 1 (Enclosure 2).

Page 8 of 54

PRA evaluation PBN-BFJR-17-019, Revision 1 (Enclosure 2), Section 2, provides additional detail regarding the development and application of the initiating events in the PRA thermal analysis . The table below summarizes the screening of Internal Events, Fire PRA, and External Initiating Events for applicability to the construction truss evaluation.

Initiating Events (IE) Screening for Containment Thermal Transients Impacting the Construction Truss Conditional on Thermal Transient> 250°F PRA IE Description Basis for Inclusion/Exclusion INIT-A INITIATING EVENT LARGE LOCA > 6 11 Included - can exceed 25DF INITIATING EVENT EXCESSIVE LOCA Omitted - This event will result in temperatures> 250F. However this event INIT-EXC (VESSEL FAILURE) independently results in core damage, CCDP=l .

INIT-FBIC FEEDLINE BREAK INSIDE CONTAINMENT Included - can exceed 25DF INIT-FBOC FEEDLINE BREAK OUTSIDE CONTAINMENT Excluded - High energy release occurs outside containment.

GENERIC INITIATOR TO CALCULATE FIRE INIT-FIRE Included - Fire initiators which result in very small, small and medium LOCAs.

CCDP Excluded - Internal flooding screened all initiators except T3, Transient with PCS INIT- INITIATING EVENT INTERNAL FLOOD (ALL (Power Conversion System) available. Sequences which would result in high IFLOOD SCENARIOS) energy release inside containment were screened.

Excluded - Low probability of occurrence. From Table 11 in PRA 2.0, Initiating INITIATING EVENT INTERFACING SYSTEMS INIT-15l Events Notebook, Category 5, ISL {Interfacing System LOCA} for Unit 1 is LOCA 2.lOE-7/yrand Unit 2 is 2.16E-7/yr.

Excluded - Transient releases steam outside containment or into RCS. Steam INIT-R INITIATING EVENT SGTR does not challenge containment.

INITIATING EVENT MEDIUM LOCA >2" TO INIT-51 6"

Included - can exceed 250F INIT-52 INITIATING EVENT SMALL LOCA 3/8" TO 2" IN IT-SB IC STEAMLINE BREAK INSIDE CONTAINMENT STEAMLINE BREAK OUTSIDE Excluded - Outside containment, transient unlikely to result in >250F inside INIT-5BOC CONTAINMENT containment.

INIT-TlG GRID-RELATED LOOP INIT-TlGB GRID BLACKOUT LOOP INIT-TlP PLANT-CENTERED LOOP INIT-TlW WEATHER-RELATED LOOP INIT-SBO STATION BLACKOUT INIT-T2 INITIATING EVENT TRANSIENT w/o PCS Excluded - Transient unlikely to result in >250F inside containment. AFW used to INIT-T3 INITIATING EVENT TRANSIENT w PCS remove decoy heat outside containment.

INITIATING EVENT LOSS OF COMPONENT INIT-TCC COOLING INIT-TDl INITIATING EVENT LOSS OF BUS D-01 INIT-TD2 INITIATING EVENT LOSS OF BUS D-02 INITIATING EVENT LOSS OF INSTRUMENT INIT-TIA AIR INITIATING EVENT LOSS OF SERVICE INIT-T5W WATER Excluded - based on low probability of occurrence. Gate ATWS-T, "Transfer Logic", which provides ATWS initiators, was solved using the Unit 15.02 INIT- internal events PRA model of record at a truncation of 2E-13 which is the same ATWS ATW5 truncation used for the 5.02 internal events model of record. The same flag file and recovery rule file were used as the Unit 1 5.02 model of record. The Quantification of gate ATWS-T resulted in a probability of 1.42E-6/yr.

INIT-FIRE INDUCED MEDIUM LOCA Included - can exceed 25DF

1. FIRE-51 Page 9 of 54

Initiating Events (IE} Screening for Containment Thermal Transients Impacting the Construction Truss Conditional on Thermal Transient> 250°F PRA IE Description Basis for Inclusion/Exclusion INIT-FIRE INDUCED SMALL LOCA Included - can exceed 25DF

1. FIRE-52 Excluded - Very low probability that a high wind event will lead to a thermal event that will challenge the construction truss. The ~3.5' thick concrete HIGH WINDS containment structure is robust and will not be penetrated by highly energetic wind driven missiles.

Excluded - Very low probability that a seismic event will lead to a thermal event that will challenge the construction truss.

The IPEEE top events that could lead to seismically initiated thermal transients include SLOCA, MLOCA, LLOCA, and Steamline/Feedline break. With the exception of SLOCA, these events have a high HCLPF capacity (0.3g} and were screened out in the IPEEE. Should a seismically induced SLOCA occur it would likely be mitigated by containment cooling functions. These functions and their probability of failure are evaluated in Section 2.3.4 of the PRA Evaluation. In SEISMIC addition, the fragility associated with SLOCA is much lower than the construction truss fragility [Attachment F, section F.3 in the PRA Evaluation];

the construction truss is more likely to fail due to a seismic event than due to piping failure associated with a SLOCA. The impact of a seismically induced SLOCA is negligible and bounded by the assumptions used in the bounding and demonstrably conservative analysis. Attachment F, Section F. 7, in the PRA Evaluation provides the bases for excluding or including IPEEE top events in this evaluation.

Excluded -Other external hazards were screened from applicability to PBNP, Units 1 and 2 per a plant-specific evaluation in accordance with GL 88-20 and updated to use the criteria in ASME PRA Standard RA-Sa-2009. Paint Beach OTHER EXTERNAL EVENTS Units 1 & 2 Construction Truss PRA Evaluation, Revision 1, Attachment I, provides the bases for screening.

Page 10 of 54

Initiating Events (IE) Screening for Containment Thermal Transients Impacting the Construction Truss Conditional on Thermal Transient> 250°F PRA IE Description Basis for Inclusion/Exclusion Excluded - Feed and Bleed was also considered for thermal events. Feed and Bleed sequences in the various transient event trees will inject mass/energy into containment. While F&B scenarios are not "initiators" in the traditional sense, F&B sequences were evaluated and dispositioned.

The frequency of successful F&B events is determined by finding the RAW

{Risk Achievement Worth} for a basic event that defeats F&B all the time (e.g., an operator action or CCF (Common Cause Failure) of PORVs). The frequency of successful F&B would then be the increase in CDF assuming F&B FEED & BLEED failed with probability 1.0. For the Point Beach models, this basic event is the CCF of PORVs which defeats F&B in all cases, basic event RC--POR-CM-PORV.

This event was set to 1.0. The table below summarizes the results for Unit 1 for each hazard; Unit 2 results would be similar.

The small frequency for success of Feed and Bleed events of 2.475142E-6/rx1 yr would increase the initiating event frequency for thermal events from 1.87813£-3 to 1.880605£-3 which is not risk significant. Therefore, feed and bleed is excluded.

FEED & BLEED INITIATING EVENT FREQUENCY F&B F&B Success Frequency HAZARD CDF RAW = CDF* (RAW- 1)

Internal Events Ul 6.05092E-6° 1.095 5.748374E-7.

NFPA 805 Ul "GO_ LIVE_MODEL_FINAL" 5.29727E-5 1.031 1.642154E-6 Internal Flooding U1_FLOOD_CDF_ IN/T.cut 2.99294E-6 1.001 2.99294E-8.

DCA Seismic 06-18-CT- RASP, U1 -2 OF 2 PORVs- RASP, 2.70821E-6 1.071 2.28221E-7.

G-CT-SEISMIC-CDF-POST- /PEEE.cut High Winds Common mode failure of PORVs do not N/A U1 PBUl-503-CDF-E-12, 11-15-2017 contribute to CDF for High Winds TOTAL= 2.475142E-6 Page 11 of 54

According to Enclosure 2 and Section 1.2 of Enclosure 4 of the submittal, no modifications are to be performed for the trusses in Unit 2. However, Section 6.4.2.2 of Enclosure 5 of the submittal states that "[t]rimming the first panel point at 14 locations for Unit 1 and 11 locations for Unit 2" while Section 6.5.1 states that "[t]he Unit 1 truss was analyzed in the configuration with limited modifications (six first panel point locations require trimming)."

a. Clarify, with technical justification for the selection, the modifications that are proposed for the Unit 1 trusses and provide the rationale for not proposing all the modifications for Unit 1 trusses mentioned in Section 6.4.2.2 of Enclosure 5 of the submittal.

b. Clarify whether any modifications are proposed for the Unit 2 trusses. If no modifications are proposed provide the rationale for not performing the modifications for Unit 2 trusses mentioned in Section 6.4.2.2 of Enclosure 5 of the submittal.

c. Confirm that the configuration of the Unit 2 trusses that were analyzed to determine the seismic and thermal fragility values, which are used in the submittal are consistent with the configuration of the Unit 2 trusses as proposed in the submittal. If differences are found between the two configurations, provide and propagate the updated values or justify the continued use of the values in Section 6.4.2.2 of Enclosure 5 (and throughout Enclosure 4).

Response to RAl-4.a The modifications proposed for the Unit 1 truss structure consists of trimming the top chord at the first panel point of six trusses, specifically trusses 1, 2, 3, 7, 8, and 15 (trusses numbered as shown in Attachment A of calculations 1100060-C-022, Thermal Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR). Calculations 1100060-C-022 and 1100060-C-024 documented the thermal and seismic analyses, respectively, of the proposed modified configuration of the Unit 1 truss. As noted in Section 6.2 of calculation 1100060-C-022, the trusses that required modification were determined through an iterative process to result in the truss structure and adjacenUsupported equipment meeting the established acceptance criteria noted in 1100060-RPT-002, Methodology and Criteria to Determine the Strength Capacity of the Point Beach Nuclear Plant Containment Dome Trusses and Attached/Adjacent Components in Support of a Risk-Informed License Amendment Request (summarized within Section 4.0 of Enclosure 5 of the LAR submittal).

Specifically, calculations 1100060-C-022 and 1100060-C-024 demonstrate that:

• The modified Unit 1 containment dome truss structure (modified at the six specified locations) maintains structural integrity for applied loading from design basis accidents (thermal loading) and seismic loading.

o Truss members and connections maintain stress values within ANSl/AISC N690-1994(R2004) limits.

o Truss top and/or bottom chord members exceeding ANSl/AISC N690-1994(R2004) limits remain within permissible strain limit of 1.5%.

• The truss to containment liner contact load remains below the calculated allowable limit.

• The attached VNCC ductwork remains within original design basis allowable limits and remains fully capable of performing its intended safety functions.

Page 12 of 54

• The containment spray piping, for applied thermal loading, remains within original design basis allowable limits and remains fully capable of performing its intended safety functions.

• Other supported equipment (lighting, conduit, PACV piping), which have no specified safety functions, maintain seismic 2/1 capability (i.e., the supported SSCs maintain their own structural integrity).

Additionally, calculation 1100060-C-032, Evaluation of Unit 1 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, demonstrates that the containment spray piping that is attached to the modified Unit 1 truss remains within original design basis allowable limits under applied seismic loading and remains fully capable of performing its intended safety functions (one containment spray pipe support, Sl-301 R-1-H202, as noted in Section of 6.5.3.4 of Enclosure 5 of the LAR submittal, requires replacement of the associated U-bolt to meet design code of record allowable values).

The PRA evaluation (Enclosure 4 of the LAR submittal) demonstrates that the associated risk for Unit 1, with the proposed top chord first panel point trims at six locations and modification to containment spray pipe support Sl-301 R-1-H202, meets the acceptable risk values in NRC Regulatory Guide 1.174.

No additional truss modifications are proposed for Unit 1 in the LAR submittal beyond the trimming of the six truss locations. The risk values associated with the proposed scope of modifications to the Unit 1 truss structure meets Regulatory Guide 1.174 acceptance values to ensure the health and safety of the public and minimizes potential safety risks for the station and workers (e.g., rigging and handling of large structural members at extreme elevations, potential for dropped objects). The PRA evaluation demonstrates that minimal risk margin would be gained by performance of additional modifications.

Response to RAl-4.b No modifications are proposed for the Unit 2 truss structure in the LAR submittal. Calculations 1100060-C-023, Thermal Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR, document the thermal and seismic analyses, respectively, of the as-found configuration of the Unit 2 truss. As noted in the calculations, the as-found truss structures and adjacent/supported equipment meet the established acceptance criteria noted in 1100060-RPT-002, Methodology and Criteria to Determine the Strength Capacity of the Point Beach Nuclear Plant Containment Dome Trusses and Attached/Adjacent Components in Support of a Risk-Informed License Amendment Request (summarized within Section 4.0 of of the LAR submittal).

Specifically, calculations 1100060-C-023 and 1100060-C-025 demonstrate that:

• The as-found Unit 2 containment dome truss structure (unmodified configuration) maintains structural integrity for applied loading from design basis accidents (thermal loading) and seismic loading.

o Truss members and connections (with limited exceptions, i.e., truss top and/or bottom chord members that use strain criteria, discussed below) maintain stress values within ANSl/AISC N690-1994(R2004) limits.

o Truss top and/or bottom chord members exceeding ANSl/AISC N690-1994(R2004) allowable limits remain within the permissible strain limit of 1.5%.

Page 13 of 54

• The truss to containment liner contact load remains below the calculated allowable limit.

• The attached VNCC ductwork remains within original design basis allowable limits and remains fully capable of performing its intended safety functions.

• The containment spray piping, for applied thermal loading, remains within original design basis allowable limits and remains fully capable of performing its intended safety functions.

• Other supported equipment (lighting, conduit, PACV piping), which have no specified safety functions, maintain seismic 2/1 capability (i.e., the supported SSCs maintain their own structural integrity).

Additionally, calculation 1100060-C-033, Evaluation of Unit 2 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, demonstrates that the containment spray piping that is attached to the as-found truss remains within original design basis allowable limits under applied seismic loading and remains fully capable of performing its intended safety functions.

The PRA evaluation (Enclosure 4 of the LAR submittal) demonstrates that the associated risk for Unit 2 (as-found configuration) meets the acceptable risk values in NRC Regulatory Guide 1.174.

As noted, no truss modifications are proposed for Unit 2 in the LAR submittal. The risk associated with the as-found Unit 2 truss structure meets Regulatory Guide 1.174 acceptance values to ensure the health and safety of the public and minimizes potential safety risks for the station and workers (e.g., rigging and handling of large structural members at extreme elevations, potential for dropped objects). The PRA evaluation demonstrates that minimal risk margin would be gained by performance of additional modifications.

Response to RAl-4.c The modifications detailed in Section 6.4.2.2 of Enclosure 5 of the LAR submittal reflect the minimum scope of modifications necessary to fully comply with ANSI/Al SC N690-1994(R2004) design allowable values, as demonstrated in calculation 1100060-C-038, Seismic Strength Capacity of Units 1 and 2 Containment Dome Trusses with Modifications to Meet AISC N690 Acceptance Criteria. Calculation 1100060-C-038 and the associated fragility values for the full code compliance modification as determined in calculation 1100060-C-028, Seismic Fragility Analysis of Containment Dome Trusses, were developed for the purpose of supporting the determination of ~CDF (differential core damage frequency), which compares the risk based on the fragility values for a fully modified truss configuration (as determined in 1100060-C-038) to the risk based on the fragility values calculated for the Unit 2 as-found configuration with no modifications. The ~CDF is used to support the PRA evaluation (PBN-BFJR-17-019, Point Beach Units 1 & 2 Construction Truss PRA Evaluation, Enclosure 4 of the LAR submittal) which concludes that the as-found configuration of the Unit 2 dome truss will not pose a hazard to the safe operation of Point Beach and does not pose a risk to the health and safety of the public.

As noted in the response to RAI 4.b. above, this conclusion is also supported by calculations 1100060-C-023 and 1100060-C-025, which independently demonstrate that the as-found configuration of the Unit 2 truss structures maintains structural integrity for the proposed design basis accident or seismic event.

The seismic fragilities for the Unit 2 as-found configuration and for the modified to full-compliance with ANSl/AISC N690-1994(R2004) configuration are calculated in calculation 1100060-C-028 based on input from calculations 1100060-C-025 and 1100060-C-038.

Page 14 of 54

The Unit 2 truss structure seismic fragility for the as-found configuration (unmodified) was determined to have a median capacity of 0.42g. The Unit 2 truss structure probability of failure vs. temperature curve for the as-found configuration (unmodified) was determined in calculation 1100060-C-031, Probability of Failure vs. Temperature for Unit 2 Containment Dome Truss in Support of Risk Informed LAR. The as-found configuration (unmodified) of the Unit 2 truss structure is the configuration proposed in the LAR submittal. The configuration noted in Section 6.4.2.2 of Enclosure 5 of the LAR submittal reflects the modifications proposed to meet ANSl/AISC N690-1994(R2004) limits and has a calculated median capacity of 0.53g. The proposed modifications to Unit 2 were only utilized in the determination of the L1CDF value, as shown in Enclosure 4 of the LAR submittal. Section 2.1.2 of Enclosure 4 of the LAR submittal reflects the median seismic capacities identified above, and the thermal fragility curve is identified in Section 2.2.1 of Enclosure 4 of the LAR submittal. Therefore, the proposed as-tound configuration of Unit 2 (unmodified) was used in the associated PRA evaluation (Enclosure 4 of LAR submittal).

Section 6.4.1 of Enclosure 5 of the submittal discusses the determination of the probability of truss failure as a function of temperature, which is used for the risk calculations in Sections 2 and 5 of Enclosure 4 of the submittal. The discussion states that a probability of failure was "assigned" and provides separate curves for the Unit 1 and Unit 2 trusses.

a. Describe the process used to "assign" the probability of failure as a function of temperature for the trusses including information from any expert elicitation, any guidance, such as NUREG/CR-6372 and NUREG/CR-6771 (ADAMS Accession Nos.

ML080090003 and ML022410135, respectively), used for the expert elicitation process, and a description of the qualification of the experts.

b. Section 2.2.1 of Enclosure 4 of the submittal uses a single "thermal fragility curve" for both units as opposed to the two different curves presented in Section 6.4.1 of Enclosure 5 of the submittal. Provide the technical justification for using a single curve to represent the "thermal fragility" of the trusses in both units.

c. Demonstrate, preferably quantitatively, the impact of changing the "assigned" probability of failure as a function of temperature for the trusses on the "bounding" and "demonstrably conservative" risk calculations.

Response to RAl-5.a Investigation and research were performed to identify available literature or guidance that discusses the probability of failure of a structure whose components are subjected to stresses that result from thermal loading; however, none could be located. Opinions were sought from senior consultants at Stevenson & Associates (currently A JENSEN HUGHES Company) who have many years of experience in the field of structural engineering, especially in the development of seismic fragilities for power plant systems, structures, and components. The consensus was that since literature was available that discussed probabilities of failure of structures that were subjected to seismic loads based on the component stress level, guidance from this literature could be used to assign a probability of failure of a structure subjected to thermal loads also based on the component stress level. The use of seismic guidance was considered conservative, given that the thermal loading being applied typically consists of a Page 15 of 54

single event, with the thermal loading being both gradual and unidirectional, while seismic loading is random and cyclical. The President of Stevenson & Associates was the senior consultant/technical advisor on this matter. He has over 40 years of experience in the nuclear power industry. He has vast experience in the field of structural engineering - more specifically, in the areas of structural vulnerabilities to the effects of seismic and other extreme loading phenomena. Additionally, he has vast experience in the development of seismic fragilities for power plant structures, systems, and components.

The Unit 1 and Unit 2 construction trusses were analyzed (see calculations 1100060-C-030, Probability of Failure vs. Temperature for Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-031, Probability of Failure vs. Temperature for Unit 2 Containment Dome Truss in Support of Risk Informed LAR) in the as-found configurations for a defined set of loading scenarios. The corresponding peak ambient temperatures (considering thermal expansion from 78°F) for the defined loading scenarios were assigned a probability of failure, as shown in the table below. The table is followed by discussion on the justification for each assigned probability of failure.

Unit 1 - As-found Configuration Unit 2 - As-found Configuration Probability of Failure vs. Temperature Probability of Failure vs. Temperature Temperature Probability Temperature Probability Description (oF) Description (oF) of Failure of Failure First Contact First Contact 78 1.0 E-12 211 1.0E-12 with Liner with Liner First Fully Design Basis Plastic 201 0.01 286 0.001 Temperature Hinge Design First Fully Basis 286 0.10 298 0.01 Plastic Hinge Temperature Capacity Capacity 318 0.99 378 0.99 Limit Limit First Contact with Liner The temperature at which contact between the construction truss and the containment steel liner would initially occur is determined for each unit. At this condition, the probability of failure is "essentially zero" and a value of (1.0 E-12) is assigned, because:

• no forces are developed in the construction truss due to thermal loading from the restraint imposed by the containment wall,

• there will only be negligibl.e localized loads in the bottom chord due to differential expansion between the construction truss and the Containment Spray piping, and

• the construction truss is carrying only its self-weight and the weight of attached components.

Page 16 of 54

First Fully Plastic Hinge The condition when a fully plastic hinge would first develop occurs in the Detail 4 clip angle connection, which is the connection detail for the T2 style truss located at the apex of the truss structure (see drawing C-125, Containment Structure Liner Support Trusses). This condition is similar to the C1% capacity (capacity corresponding to 1% probability of failure) for seismic loading given in EPRI Report 1025287, Seismic Evaluation Guidance - Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic. Per Page D-1 and Section 6.4.1 of EPRI Report 1025287, the C1% capacity may be determined using the Conservative Deterministic Failure Margin (CDFM) approach of EPRI Report NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin. Per page 6-18 of EPRI Report NP-6041-SL, plastic design methods of the AISC code may be used to determine the capacity, and per Equation 6-7 of EPRI Report NP-6041-SL, no amplification to the applied loads is required (i.e., load factor is 1.0). This allows the use of plastic section properties and yield stress as the allowable stress to determine the C1% capacity.

Therefore, the condition of the construction truss with one Detail 4 connection reaching its plastic capacity under thermal expansion loads corresponds to the definition of the C1% capacity for seismic loads. A probability of failure of 0.01 is assigned given that only one of the Detail 4 connections reached a fully plastic condition and the truss structure was demonstrated to maintain structural integrity for this condition in calculations 1100060-C-030 and 1100060-C-031.

Design Temperature in Unit 1 For the as-found Unit 1 construction truss, at the postulated containment design temperature of 286°F, multiple plastic hinges would form at the Detail 4 connections and multiple locations on the bottom chords of the T2 trusses at the intersection with the outermost horizontal braces would develop near full plastic hinges. Therefore, the probability of failure exceeds 0.01, which was applied when only one plastic hinge develops. However, the calculated displacement at the plastic hinges is minimal (less than 0.15"), signifying that loads would redistribute elsewhere within the structure.

Given the presence of plastic hinges at the Detail 4 connections and locations in the T2 bottom chord that are approaching plastic hinges concurrent with continued stability in the structure as a whole, a probability of failure of 0.10 is assigned. This is similar to the methodology in Section 7.1.2 of FEMA P695, Quantification of Building Seismic Performance Factors, which states:

The fundamental premise of the performance evaluation process is that an acceptably low, yet reasonable, probability of collapse can be established as a criterion for assessing the collapse performance of a proposed system.

In this Methodology, it is suggested that the probability of collapse due to Maximum Considered Earthquake (MCE) ground motions be limited to 10%.

This is also comparable to the methodology of Section 1.3 in ASCE/SEI 43-05, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities, which defines 10%

probability of unacceptable performance as the acceptance criteria for a ground motion equal to 150% of the DBE ground motion. As the status of the as-found Unit 1 truss structure at the Page 17 of 54

design temperature can be considered to be at the upper bound of acceptability, it is appropriate to assign a 0.10 probability of failure.

Design Temperature in Unit 2 For the Unit 2 construction truss, even though negligible elasto-plastic behavior is identified in the T1 chords at the location of liner contact, no plastic hinges would form at the design temperature of 286°F. A probability of failure of 0.001 is assigned given that no fully plastic hinges have formed (margin exists before the development of full plastic hinges), the liner contact force is less than the liner capacity, and overall loading does not challenge the integrity of the truss structure.

Near Collapse The temperature at which construction truss instability or unacceptable force on the containment steel liner would occur has the highest probability (0.99) as this represents either near collapse of the construction truss or exceedance of the maximum permissible strain of the containment steel liner.

Response to RAl-5.b The probability of failure as a function of temperature for the existing Unit 2 truss bounds the probability of failure as a function of temperature for the modified Unit 1 truss as discussed in Section 6.4 of calculation 1100060-C-030. Specifically, it is demonstrated in calculation 1100060-C-022, Thermal Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, that the modified Unit 1 truss structure (6 trim locations as proposed in Section 3.3.2.1 of Enclosure 1 of the LAR submittal) contacts the liner at 8 locations with a peak liner contact force of 33 kips, considering thermal expansion at 286°F. The Unit 2 as-found truss structure, for the same thermal loading condition, contacts the liner at 10 locations, with a peak liner contact force of 41.26 kips. Therefore, the probability of failure as a function of temperature curve that was developed for the Unit 2 truss structure is considered to bound the thermal condition of the modified Unit 1 truss structure. This single curve is therefore used in Section 2.2.1 of Enclosure 4 of the LAR submittal to address both the modified Unit 1 truss structure and the as-found Unit 2 truss structure.

Response to RAl-5.c Based on the responses to RAl-5.a and 5.b, no changes are considered necessary to the base case thermal fragility provided in the LAR submittal. However, a sensitivity study was performed to quantitatively demonstrate the impact of changing the probability of failure as a function of temperature for the trusses on the bounding and demonstrably conservative risk calculations [refer to Section 9.1.2.2 in PRA Evaluation PBN-BFJR-17-019, Revision 1 (Enclosure 2)]. The failure probabilities for the first three points (shown in the table below) were increased by an order of magnitude. The bounding case for core damage frequency increased from 4.83 E-8 to 4.83 E-7. The demonstrably conservative case increased core damage frequency from 1.48 E-9 to 1.48 E-8. The results of the sensitivity study demonstrate that the increase in CDF remains well within the guidelines of Regulatory Guide 1.174.

Page 18 of 54

Thermal Fragility Curve 1.00E +OO 1.00E-01 1.00E-02 1.00E-03 I I ,

Proposed Modified Unit 1 and Unmodified Unit 2 Configurati on

~

- ol" *I I I I I I I I I I

, I I

.2 0

1.00E-04 1.00E-05

f

'IS fl ,

,g- 1.00E-!X3

s

~ 11

~

.. 1.00E-07

.cl 0

II.

1.00E-08 I I I 1.00E-09 1.00E-10 1.00E-11 -

I I I I I I I I I I I I I I I I I I 1.00E-12  !

200 220 240 260 280 300 320 340 360 3 80 Temperalure( 0 f)

-.- Original Fragility - - Sensitivity Fragility Unit 2 - As-found Configuration Pro b a bTt11ty 0 f Fa1*1 ure vs. Temperature Probability of Probability of Failure Temperature Probability of (oF) Failure vs. Temperature Failure Original Sensitivity First Contact with Liner 211 1.00E-12 1.00E-11 Design Basis Temperature 286 0.001 0.01 First Fully Plastic Hinge 298 0.01 0.1 Capacity Limit (Sensitivity) 316 - 0.99 Capacity Limit (Original) 378 0.99 -

Section 3.1.2 of Enclosure 1 of the submittal states that "the peer review of the PRA

[probabilistic risk analysis] was conducted ... and the peer review of the seism ic and thermal frag ility analyses was conducted." The risk calculations presented in Enclosure 4 of the submittal do not include all the technical elements of a PRA as defi ned in Regulatory Guide (RG) 1.200, Revision 2 (ADAMS Accession No. ML090410014). Attachment C of Enclosure 4 of the submittal provides a "statement of compliance" against the supporting requirements (SRs) in the 2009 American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS)

PRA Standard for external hazard screening (Part 6 of the Standard) and seismic PRA (Part 5 of the Standard) . Further, Table 1 and Section 6 of Enclosure 4 of the submittal include core Page 19 of 54

damage frequency (CDF) and large early release frequency (LERF) values from different hazards. However, the sources of those values are not mentioned.

a. Provide clarification on the peer reviews referred to in Section 3.1.2 of Enclosure 1 of the submittal. Include the peer review reports or details of the peer reviews including information on the peer-review guidance that was followed, the specific part(s) of the ASME/ANS PRA Standard, and finding-level Facts and Observations (F&Os) and their corresponding resolution.

b. Explain the relevance to the current application of the "statement of compliance" against the SRs in Parts 5 and 6 of the 2009 AS ME/ANS PRA Standard provided in Attachment C to Enclosure 4 of the submittal.

c. Provide in a tabular format, information on the source for the CDF and LERF estimates for each hazard listed in Table 1 and Section 6 of Enclosure 4 of the submittal. If the source is a PRA model, include information on the status of the technical adequacy determination such as whether a full-scope peer-review against the ASME/ANS PRA Standard has been performed per an RG 1.200-endorsed peer review process, and the version of the Standard against which the peer review was performed. Include any findings-level F&Os which has not been closed per an NRG-approved process, any subsequent modifications to the associated PRA model indicating which modifications are considered "upgrades," and the results of any follow-on or focused scope peer-reviews.

d. If the seismic CDF and LERF values are from a seismic PRA model, justify not exercising that model for the current submittal. If the values are not derived from a seismic PRA model, describe the approach used to determine them and the technical justification for the selected approach.

e. Clarify whether the CDF and LERF values in Table 1 and Section 6 of Enclosure 4 of the submittal represent mean estimates. If not, provide mean estimates for each hazard per RG 1.174 or justify the use of point estimates for risk-informed decision-making.

Response to RAl-6.a The peer review referred to in Section 3.1.2 of Enclosure 1 of the LAR submittal was not a RG 1.200 peer review. This was an independent review contracted to consultants with expertise in the methodologies applied in the analyses supporting this LAR. The consultant recommendations and comments were addressed. Subsequently, these same reviewers were contracted to review the updated analyses supporting these RAls. The consultant comments are addressed in the revised analysis (Enclosure 2) and in the responses to this set of RAls.

Since this was not a RG 1.200 peer review, the ASME standard was not implemented and there were no finding-level Facts and Observations (F&Os).

Response to RAl-6.b The statement of compliance provided in the original PRA evaluation, PBN-BFJR-17-019, Revision 0, and in the revised analysis, PBN-BFJR-17-019, Revision 1 (Enclosure 2),

Attachment C, is the in-house assessment of the seismic SRs relative to the analyses and methodology applied in the PRA and structural calculations.

Page 20 of 54

Response to RAl-6.c The following table provides the source for the CDF and LERF estimates for each hazard listed in Table 1 in Section 1.4 of the revised analysis, PBN-BFJR-17-019, Revision 1(Enclosure2).

Table 1: Point Beach ALL HAZARDS PRA Results HAZARD CDF (1/Rx Yr) LERF (1/Rx Yr)

Reference Model Quality Unit 1 Unit 2 Unit 1 Unit 2 Internal Peer reviewed plant-specific model RG 1.200 Events 5.1£-06 5.1£-06 3.lE-08 3.6£-08 Rev2 at Power Internal Peer reviewed plant-specific model RG 1.200 Floods 3£-07 3£-07 2£-08 2£-08 Rev2 at Power Internal Fire Peer reviewed plant-specific RG 1.200 5.9£-05 6.9£-05 9.0E-07 1.1£-06 model at Power Rev2 Seismic 6.24£-06 6.24£-06 1.21£-06 1.21£-06 IPEEE updated with GMRS IPEEE at Power Other

<1E-06 <1E-06 <1E-07 <1E-07 Screened during IPEEE IPEEE Hazards TOTAL 7.2£-05 8.2£-05 2.3£-06 2.5£-06 Findings-level F&Os which have not been closed per an NRG-approved process are included in attachment A of the revised PRA evaluation; these findings are the product of follow-on or focused scope peer-reviews. The last series of reviews was completed in 2017. There have not been subsequent modifications to the associated PRA model that are considered "upgrades."

Response to RAl-6.d The bounding seismic analysis assumed core damage occurs at the time the construction truss is overstressed. Since this assumption bounds all plant SSCs and operator actions, a seismic model is not needed to calculate CDF. The CDF is calculated using the following equation:

Bounding Core Damage Frequency (CDF) =Hazard Frequency X CT Fragility The bounding seismic LERF is calculated using the following equation:

Bounding Large Early Release Frequency (LERF) =CDF x 0.5 x CT Fragility The development of these equations, their inputs, and associated assumptions are described in PBN-BFJR-17-019, Revision 1 (Enclosure 2) Section 2.1, Inputs and Assumptions, and Section 2.2, Seismic Analysis.

The demonstrably conservative seismic analysis is based on the Regulatory Guide 1.200 internal events and NFPA 805 models for Unit 1 and Unit 2. These models were refined and augmented to address the SSCs and operator actions that can potentially be impacted by the construction truss. These changes include seismic hazard data, SSC fragilities, and operator actions. PBN-BFJR-17-019, Revision 1 (Enclosure 2), Section 5.2 and Attachment F provide Page 21 of 54

additional detail regarding the development and application of the demonstrably conservative seismic model used in this application.

Response to RAl-6.e CDF and LERF values developed from PRA models are mean estimates.

Section 1.6 and Attachment C of Enclosure 4 of the submittal cites Part 6 of the 2009 ASME/ANS PRA Standard (ASME RA-Sa-2009) and states that "the bounding and demonstrably conservative analyses show that [Delta] CDF and [Delta] LERF are acceptably low for hazards challenging the [Containment Truss] CT design." The intent of Section 6-2.1 of the 2009 ASME/ANS Standard is the exclusion of an external hazard further consideration in a risk analysis. Further, Section 6-1.2 does not apply to earthquakes. The submittal is requesting a change to the plant's licensing basis. RG 1.174, Revision 2, states that "[t]racking changes in risk (both quantifiable and non-quantifiable) that are due to plant changes would provide a mechanism to account for the cumulative and synergistic effects of these plant changes .... "

Further, seismic events are identified as being directly relevant to the risk analysis. Based on the foregoing discussion:

a. Explain the relevance of citing Part 6 of the 2009 AS ME/ANS PRA Standard to the current application.

b. Clarify whether the results of the risk calculations, which represent the quantified risk to the facility from the proposed permanent configuration of the dome trusses, will be included in the baseline risk of the plant for future risk-informed applications to determine the cumulative impact of changes to the licensing basis per the guidance in RG 1.174.

c. Clarify the intent of submitting the "bounding" and the "demonstrably conservative" analyses as part of the submittal including the licensee's expectations of the scope of the staff's review and considering the response to item (b) of this request.

Response to RAl-7.a Part 6 of the 2009 ASME/ANS PRA Standard was cited to define the terms" bounding" and "demonstrably conservative analyses" and the applicable methodology; not to screen out hazards. Reference to Part 6 of the 2009 ASME/ANS PRA Standard was removed in the revised analysis, PBN-BFJR-17-019, Revision 1 (Enclosure 2).

Response to RAl-7.b The results of the demonstrably conservative risk calculations, which represent the quantified risk to the facility from the proposed permanent configuration of the dome trusses, will be included in the baseline risk of the plant for future risk-informed applications to determine the cumulative impact of changes to the licensing basis per the guidance in Regulatory Guide 1.174.

Page 22 of 54

Response to RAl-7.c The bounding analysis establishes an upper limit of the risk metrics that inherently include the worst credible outcome of all known possible outcomes of a construction truss overstress condition. It addresses all known uncertainties associated with systems, structures, components (SSC) potentially impacted by the construction truss. The demonstrably conservative analysis provides a more robust understanding of risk insights. However, because this analysis is based on a limited scope PRA, it uses assumptions such that the assessed outcome will be conservative relative to the expected outcome, i.e., if a full scope PRA was developed.

As discussed during the audit that was conducted on November 29 and 30, 2017 (ref.

ML17319A227), and as discussed in response to RAl-7.b above, the revised PRA document, PBN-BFJR-17-019, Revision 1 (Enclosure 2), presents a bounding case and a demonstrably conservative analysis. It is the demonstrably conservative analysis that is requested for review by NRC staff.

RAl-8 The fragility of the truss is used in both the "bounding" and "demonstrably conservative" analyses presented in Enclosure 4 of the submittal. Details of the conservative deterministic failure margin (CDFM) calculation used to determine the high confidence of low probability of failure (HCM, LPF) capacity of the truss are provided in Section 5. 7 of Enclosure 5 of the submittal. According to that information, the CDFM uses the site-specific ground motion response spectrum (GMRS). According to the licensee's submittal of the reevaluated hazard in response to Near Term Task Force (NTTF) Recommendation 2.1 (ADAMS Accession No. ML14090A275), which is referred to as "Ref. 6.1" in Enclosure 5 of the submittal, the peak ground acceleration (PGA) is 0.14 g for the GMRS. This value is used in the capacity calculation in Section 6.4.2 of Enclosure 5 of the submittal. That value appears to be based on the mean hazard curve. The CDFM approach, as described in Table 2-5 of the Electric Power Research Institute (EPRI) report NP-6041-SL, Revision 1, requires the use of the 84 percent non-exceedance hazard curve. Section 2.1.3 of Enclosure 4 of the submittal provides the calculation for the change in (or delta) CDF due to the seismic hazard. The calculation provided uses the difference between the CDF for the current configuration of the truss (with thermal modifications) and that from a configuration that includes all modifications which would be required to "fully meet seismic and thermal design requirements". The same approach for calculating the delta CDF is applied to the "bounding" and "demonstrably conservative" analyses. The analysis described in Section 2 of Enclosure 4 of the submittal assumes that the initiators of interest, seismic and thermal events, are independent. However, seismic events can result in consequential events such as loss-of-coolant accidents (LOCAs) which can, in turn, result in thermal loading of the trusses. Such consequential events have been excluded from the "bounding" and "demonstrably conservative" analyses without justification.

a. Provide the HCLPF and median failure probability for the unmodified and modified configuration of the trusses following the methodology in Table 2-5 of the EPRI report NP-6041-SL and Section 5 of EPRI report TR-103959, Revision 1, or justify the calculation in Section 5. 7 of Enclosure 5 of the submittal.

b. Describe the modifications that are credited for the trusses in Units 1 and 2 for the calculations based on the truss "modified to fully meet seismic and thermal design requirements," such as in Table 5 of Section 2.1.3 of Enclosure 4 of the submittal.

Page 23 of 54

c. Provide a seismic event tree to capture the structural failure of the truss along with other possible consequential events, including LOCAs, due to seismic initiators.

d. Provide qualitative or quantitative technical justification for the exclusion of any sequences from the seismic event tree that are not expected to impact the risk assessment for the trusses. Include information on any generic component fragilities used in the process.

e. Provide the re-quantified seismic CDF for the "bounding" and "demonstrably conservative" analyses including any changes due to the responses to parts (a) through (d) of this request or justify the need to not perform such a re-quantification.

Response to RAl-8.a The criteria considered for the development of the High Confidence of Low Probability of Failure (HCLPF), identified in Section 5.7 of Enclosure 5 of the LAR, are the same as those identified in Table 2-5 of the EPRI report NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin.

With respect to the selection of the Seismic Margin Earthquake (SME), Section 2 of EPRI NP-6041-SL discusses four (4) different alternatives as follows:

1. SME defined as a deterministic response spectrum anchored to a given horizontal peak ground acceleration (PGA). In this case, the variability in the ratio of response spectral acceleration and PGA is considered by using 84% non-exceedance probability (NEP) response spectral amplification factors anchored to the PGA.

2. SME defined as a response spectrum anchored to a given PGA and a uniform annual frequency of exceedance. This response spectrum is also called a uniform hazard spectrum. For this case, the shape corresponding to either the 84% NEP or the mean uniform hazard spectrum can be picked, depending on the objectives of the review.

3. SME defined as a seismic hazard defined in terms of a specific earthquake magnitude range with a specified epicentral distance range. The magnitude range in this alternative reflects the uncertainty in the size estimate of earthquakes local to the site.

4. SME defined as a standard (non site-specific) SME spectrum.

Section 2 of EPRI NP-6041-SL (page 2-10, 2nd paragraph) states: "It should be noted that irrespective of which of these alternatives is used to specify the response spectrum shape, it is always interpreted as being at the 84% NEP in the HCLPF SME level estimates, which reflects the peak-to-valley variability."

The site-specific ground motion response spectrum (GMRS) used in the evaluation of the construction trusses follows the requirements of Alternative 2. As noted in Section 2.4 of the submittal of the reevaluated hazard in response to Near Term Task Force (NTTF)

Recommendation 2.1 (ADAMS Accession No. ML14090A275), Uniform Hazard Response Spectra (UHRS) with annual probability of exceedances of 1E-04 and 1E-05 are used to compute the GMRS.

Page 24 of 54

Since the LAR requests approval of a risk-informed methodology where an annual frequency of exceedance is a relevant output (i.e., b.CDF), the use of a GMRS obtained from a UHRS (Alternative 2) is preferred over the use of a deterministic response spectrum with 84% NEP (Alternative 1). As discussed in Section 2 of EPRI NP-6041-SL, Alternative 2 produces HCLPF statements in terms of annual frequency of exceedance. On the other hand, Alternative 1 produces a resultant response spectrum which does not have a uniform annual frequency of exceedance over all frequencies, and therefore, does not fit well within the LAR risk-informed methodology.

Furthermore, the approach described in Section 5. 7 of Enclosure 5 of the LAR submittal anchors the HCLPF to the peak ground acceleration irrespective of the shape of the ground response spectra since the HCLPF is a capacity and independent of ground response spectra level (i.e., the fragility value calculated is dependent on component stress levels, and the resulting PGA is identified from the seismic demand that results in component member stresses equaling the permissible capacities for fragility).

Therefore, the use of the GMRS based on a UHRS is acceptable for the risk informed LAR.

Response to RAl-8.b Details, including associated sketches, pertaining to the proposed modifications to fully meet ANSl/AISC N690-1994(R2004), Specification for the Design, Fabrication, and Erection of Steel Safety-Related Structures for Nuclear Facilities, acceptance criteria for applied thermal and seismic loading (as identified in Section 6.4.2.2 of Enclosure 5 of the LAR submittal) are included in calculation 1100060-C-038, Seismic Strength Capacity of Units 1 and 2 Containment Dome Trusses with Modifications to Meet AISC N690 Acceptance Criteria, Attachments B.1 (Unit 1 Modifications) and B.2 (Unit 2 Modifications). The analyzed modification scope would include:

• Increasing the available horizontal clearance at the first panel point for all locations with clearances less than the postulated thermal expansion or seismic displacement (i.e., 14 locations on Unit 1 and 11 locations on Unit 2), by one of the following two methods, depending on the amount of available clearance at the panel point:

o Removal of the truss top chord flange and a portion of the web (as necessary) at the first panel point and installation of a new flange.

o Trimming of the tips of the truss top chord flange at the first panel point.

• Trimming of the tips of the truss top chord flange from the first panel point to the second panel point (specific to two truss locations in Unit 1).

• Installation of reinforcement along the bottom chord of trusses where the outermost horizontal brace connects (9 locations per unit), which consists of welding channel along the underside of the bottom chord flange and installation of structural angle (or fabricated angle from plate) between the flange and the web (includes details for addressing interferences from braces along the bottom chord). On two trusses per unit (T2 style trusses with containment spray piping anchors), the reinforcement extends beyond the containment spray piping anchor.

• Installation of plates between the built-up I-sections of the bearing housing.

• Installation of plate and bar stock at the interface between the truss support plate and the bearing box.

• Installation of an inward radial restraint along the inner face of the support brackets for the T1 trusses.

Page 25 of 54

The overall purpose of the various modifications is to eliminate contact with the containment liner under seismic loading or design basis accident thermal loading, increase member capacity and rigidity, and to reduce displacement of the truss in the inward direction during a seismic event.

Note: The proposed modifications are not meant to represent a final proposed solution, rather to provide a scope of modifications that would meet code allowable values. The resulting strength capacity is then used to support the determination of the change in risk as compared to the proposed configuration being submitted as part of the risk-informed LAR submittal to resolve the non-conformances associated with the construction trusses.

Response to RAl-8.c The revised PRA evaluation includes a new seismic event tree developed to capture the structural failure of the truss along with other possible consequential events. This event tree is more detailed and comprehensive than provided in the initial analysis, PBN-BFJR-17-019, Revision 0. The event tree is described in Attachment F of the revised PRA evaluation (Enclosure 2).

The revised event tree includes a small LOCA (SLOCA) that could be initiated by a random or seismic-induced failure of the Reactor Coolant System (RCS) pressure boundary with break sizes ranging from 3/8" to 2" equivalent diameter. This seismic-induced SLOCA is represented by a fragility curve provided in Figure 3.6 of NUREG/CR-4840, Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150.

The medium and large LOCA events were screened out at HCLPF capacity of 0.3g in the Point Beach IPEEE seismic PRA, and therefore, excluded from this evaluation.

Other consequential events are evaluated in the revised PRA evaluation, Attachment F, Section F.7. Section F.7 provides a comprehensive review of all the top events included in the IPEEE seismic PRA. Each event is assessed for its applicability to this evaluation.

Response to RAl-8.d Qualitative technical justification for the exclusion of any sequences from the seismic event tree is provided in Attachment F, Section F.6, of the revised PRA evaluation. Section F.7 specifically reviews top events, and since top events define sequences, exclusion of top events defines which sequences are excluded.

Response to RAl-8.e The requantified construction truss seismic CDF for the bounding and demonstrably conservative analyses, including changes due to the responses to parts (a) through (d) of this request, is provided in the revised PRA evaluation (Enclosure 2).

Section 2.1.4 of Enclosure 4 of the submittal discusses the convolution approach wherein the individual plant examination of external events (IPEEE) "plant fragility" is used. The same approach is also cited in Section 5.2.1 of Enclosure 4 of the submittal. Therefore, the "convolution" approach is used for both the "bounding" and "demonstrably conservative" Page 26 of 54

analyses. Section 2.1.4 of Enclosure 4 of the submittals states that "[a] more accurate characterization of the CT [completion time] risk can be obtained by combining the IPEEE seismic and the CT bounding results."

a. Justify the applicability of the IPEEE "plant fragility" for the "convolution" approach.

b. Justify the assumption that the truss failure and selected plant level contribution approach, such as the IPEEE "plant fragility", can be considered independent events.

Response to RAl-9.a The bounding seismic analysis assumes the postulated construction truss overstress always results in core damage. However, during a seismic event, other SSCs independent of the construction truss failure can also fail and lead to core damage. To account for these failures, plant fragility is used as a surrogate for the effect that concurrent and independent SSC seismic related failures will have on the seismic evaluation of the construction truss. Integrating seismic construction truss failures with seismic plant fragility will provide CDF and LERF values that more accurately characterizes the total seismic risk compared to considering construction truss failure only. Section 2.1.4 in PBN-BFJR-17-019, Revision 1 (Enclosure 2), provides a detailed basis for justifying the independence of construction truss failures and the failures considered in the plant fragility.

The plant seismic fragility is based on the updated Point Beach GMRS as calculated in PBN-BFJR-14-013, Revision 0. This is the same data used to develop the construction truss fragility curve, and as such, allows integrating the construction truss results with the IPEEE results.

The integration of the plant fragility and construction truss fragility results was not applied to the demonstrably conservative case. This case used many of the SSCs used in the seismic IPEEE evaluation. Most of these SSCs cannot be considered independent of the SSCs included in the plant fragility evaluation.

Response to RAl-9.b Failure of SSCs independent of postulated construction truss failures affects the calculation of

.6.CDF and .6.LERF associated with the construction truss.

During a postulated construction truss seismic overstress failure event, other SSCs independent of the construction truss failure can also fail and lead to core damage. Integrating these concurrent failures will result in CDF and LERF values that are higher and more realistic than those considering construction truss failure only. However the construction truss .6.CDF will decrease since the independent SSC failures leading to core damage will partially overshadow the construction truss CDF impact. For example, as SSC CDF contribution increases to 1.0, the construction truss .6.CDF will decrease to 0. If the independent SSCs always lead to core damage, the construction truss core damage will not have an effect on increased CDF; core damage probability cannot be greater than 1.0.

In the case of calculating .6.LERF, including the independent SSCs will result in a .6.LERF greater than that calculated for the construction truss failure alone. The probability that the independent SSCs can result in a containment breach must be considered otherwise the result will be nonconservative. To avoid underestimating LERF, SSC failures that can result in loss of Page 27 of 54

containment independent of construction truss failures must be included in the assessment of LERF. The dominant LERF contributor in the Point Beach Seismic IPEEE is containment isolation, which is represented in the IPEEE model as a top event Containment Isolation System.

Section 2.1.4 in PBN-BFJR-17-019, Revision 1 (Enclosure 2), provides a detailed basis for justifying the independence of construction truss failures and the failures considered in the plant fragility.

RAl-10 Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal provides the risk calculations for the "demonstrably conservative" analysis. Those sections provide "event trees" for various initiating events impacting the trusses. The split fractions at each node are the failure probabilities, based on an assessment described in Section 5 of Enclosure 4 of the submittal, of that particular equipment from the falling truss members. The final result is termed the "conditional core damage probability" and multiplied with the initiating event frequency. However, the "event trees" represent the component failure probabilities and do not appear to describe the sequences which would potentially lead to core damage following a seismic event resulting in failure of the truss. The event tree does not appear to be modeled based on the logic in the internal events PRA model. In addition, human actions related to the impact of the failure of each component, including the impact of the seismic event on such actions do not appear to have been considered. Therefore, the "event tree" does not appear to provide the conditional core damage probability (CCDP). It appears that deriving such a CCDP would require integration of the component failure probabilities in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal with a plant-specific PRA model (internal events and/or seismic).

a. Describe the logic used to develop the "event trees" in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal including the approach used to determine the "top events",

and to capture the sequences which can potentially lead to core damage following truss failure due to the selected initiating events. Provide a comparison of the "event trees" in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal with similar event trees from the licensee's internal events PRA model.

b. Considering the factors identified above, provide justification that the analysis in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal can either represent or bound any integration of the failure probabilities into a PRA model. Alternately, provide the mean seismic CDF and significant cutsets from such an integration.

c. The failure probabilities from the assessment described in Section 5 of Enclosure 4 of the submittal that are used for the "event trees" do not change based on the seismic acceleration. It is expected that at a certain threshold seismic acceleration level the fragility of the individual components will dominate the corresponding failure. The convolution with the IPEEE performed in Section 5.2.1 of Enclosure 4 of the submittal appears to be performed to account for such cases. However, the convolution is based on the "plant fragility" and there is no comparison of the fragility of each impacted component against the "plant fragility." Justify that use of the "plant fragility" is bounding for all the components that are found to be impacted by truss failure in the assessment.

Page 28 of 54

Response to RAl-1 O.a The logic used to develop the event trees in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the original LAR submittal, including the "top events," has been completely revised to address responses to this set of RAls. The event trees are now based on the RG 1.200 internal events PRA model. For seismic, Attachment F in the revised PRA evaluation provides a detailed description of the inputs, assumptions and methods used to develop this model. Also, the seismic model incorporates relevant elements of the Point Beach IPEEE seismic model. The thermal model is also based on the internal events PRA model. This model is fully described in Attachment E of the revised PRA evaluation (Enclosure 2).

Response to RAl-1 O.b As noted in the response to RAl-10. a, the seismic and thermal models are integrated into the internal events PRA model. As such, they represent the "integration of the failure probabilities into a PRA model." Cutsets generated by these models are included in Attachment E, Thermal, and Attachment F, Seismic, in the revised PRA evaluation (Enclosure 2).

Response to RAl-1 O.c The failure probabilities from the assessment described in Section 5 of Enclosure 4 of the LAR submittal, those used in the event trees, have been revised. The updated seismic model includes several types of failure probabilities:

1. Fragilities for seismic sensitive SSCs. These failures vary with seismic acceleration.

Note that some of the SSCs credited are seismically qualified, i.e., were screened out in the IPEEE, and as such, do not vary with seismic acceleration. The basis for screening these components is provided in Attachment F, Section F.7, in the revised PRA evaluation (Enclosure 2). However, their random failure probabilities are included.

2. Damage probabilities. These failure probabilities are fixed. They are the probability that a target will be damaged when hit by postulated construction truss debris. However, the probability of construction truss debris generation is based on construction truss fragility which does vary with seismic acceleration.

3. Random failures. The failures are the internal events PRA SSC probabilities incorporated into the construction truss seismic model. They do not vary with seismic acceleration.

4. Human Error Probabilities (HEP). HEPs associated with short term action have their failure probabilities vary based on seismic acceleration.

Fragilities, damage probabilities, and HEPs increase their dominance as seismic intensity increases. This is evident in the comparison of the results between the bounding seismic analysis and the demonstrably conservative analysis. Section 9.4 of the revised PRA evaluation (Enclosure 2) shows that when HEPs are set to 1.0, the delta CDF approaches the bounding delta CDP value. Section F.11 compares the variations of CDF versus acceleration for the bounding and the demonstrably conservative analysis CDF. As acceleration increases, the demonstrably conservative analysis CDF increases because it is less likely that mitigating functions and operator actions will be successful. For the bounding CDF, the trend is the opposite - it is dominated simply by the frequency of the hazard since there is no credit for mitigating functions.

Page 29 of 54

For the bounding analysis, the plant level fragility is bounding for all components not impacted by the construction truss. The plant level seismic fragility curve is derived from the HCLPF documented in the NRC Gl-199 safety/risk assessment. The IPEEE plant level fragility curve is similar to the Gl-199 curve as shown in the following plot.

Point Beach Seismic Plant-Level Fragility 1.0 QJ

0.9 I II I III I I.of

-lJ

- I I I I ~~ ri I 11

-8!. 0.8

.~

0 0.7 0.6 I I &~ I I I I I 11.. ' I I

I I I I

IPEEE II I I I I

I JJc-_L

~ 0.5 II II £ I

..c I I 11 I I I - Gl-199 I e o.4 0..

-(1J 0.3 I I I i II ' II II IIII II u

c0 0.2

+:i

c c

0.1 0 0.0 0

I I I I l- 1 0 .2 j

~ .,

~

I 0.4 II 0.6 II I

II I I I I 0.8 I

1 II I I 1.2 I I II I I II 1.4 I

Peak Ground Acceleration (g)

The Gl-199 Point Beach plant fragility data are based on Am=0.45g and 13c=0.45. The Point Beach IPEEE is based on Am=0.45g and 13c=0.40. The IPEEE plant fragility is derived from a quantification of the IPEEE seismic systems logic model, component seismic fragility data, random failure probabilities, and human error probabilities. Therefore, integrating the Gl-199 seismic plant level fragility with the bounding seismic construction truss model results appropriately accounts for failures of seismic sensitive equipment not-directly-impacted-by -

postulated falling construction truss debris.

RAl-11 to Enclosure 4 of the submittal provides a description of the human reliability analysis (HRA) used for the "demonstrably conservative" analysis by inclusion in the "event trees" used in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the submittal. The description in Attachment B states that the operators will have more than 30 minutes to perform feed and bleed (F&B). Further, the analysis also uses "simplified [performance shaping factor] PSF adjustments" based on the seismic acceleration level. However, Section 5.2 of Enclosure 4 of the submittal states that the "PORVs [pilot-operated relief valve]" top "event" uses the baseline internal events value for F&B human error probability (HEP).

a. Justify the time available to initiate F&B used for the HRA analysis including a summary of any relevant engineering evaluations.

b. Justify the multipliers used for the PSF adjustments including the basis and methodology used to derive the multipliers for different seismic intensities.

c. Clarify whether the baseline internal events HEP for F&B is used across all seismic acceleration levels in the analysis in Sections 5.2.1 through 5.2.3 of Enclosure 4 of the Page 30 of 54

submittal and if so, justify such an approach given the analysis in Attachment B to Enclosure 4 of the submittal.

d. The baseline HEP for F&B is expected to assume the availability of instrument air for the PORVs. The determination of the impact of truss failure on instrument air availability does not appear to have been performed as part of the assessment described in Section 5 of Enclosure 4 of the submittal for the "demonstrably conservative" analysis.

However, it appears that instrument air is considered unavailable during a seismic event.

Describe and justify the assumption regarding the availability of instrument air following truss failure.

e. If the response to part (d) of this request for additional information (RAI) credits the planned nitrogen supply modifications for F&B to justify the use of the baseline HEP, justify the credit taken for the planned nitrogen supply modification as a method that maintains appropriate safety margins as mentioned in Section 3.1 of Enclosure 1 of the submittal.

f. Attachment B to Enclosure 4 of the submittal states that removing the dependency for instrument air reduces the HEP. However, the reduction seems to be based on a simple removal of the step in the procedure ("step 36 in the current procedure") for restoration of instrument air. Justify the HEP accounting for any actions and/or steps necessary to be performed for entering into and following the procedure for using the nitrogen supply subsequent to not restoring instrument air including the consideration of dependencies in intra- and inter-procedure actions or provide and use a different value.

Response to RAl-11.a The time available to initiate F&B used in the HRA analysis is based on Modular Accident Analysis Program (MAAP) run SBIC04_4D. SBIC04_4D is a Point Beach Nuclear Plant Steam Line Break Inside Containment with Auxiliary Feedwater failure and bleed success. The results of this MAAP run have been included in the revised PRA evaluation (Enclosure 2), as Human Error Probability analysis, HEP-RCS-CSPH1-12-SEISMIC-LO, and can be found in Attachment B of the revised PRA evaluation.

Response to RAl-11.b Multipliers are no longer used for the PSF adjustments. Adjustments are based on the EPRI methodology outlined in EPRI Report 3002008093, An Approach to Human Reliability Analysis for External Events with a Focus on Seismic, dated December 2016. Chapter 6, Detailed Quantification, was used to calculate the seismic HEPs, except for High Damage States where a minimum value of 1E-1 was applied in accordance with Section 6.5.2 of the EPRI document.

Response to RAl-11.c The baseline internal events HEP for F&B is not used across all seismic acceleration levels in the revised PRA evaluation (Enclosure 2).

Response to RAl-11.d The baseline HEP for F&B does not credit instrument air availability for pressurizer power operated relief valve (PORV) operation in the revised PRA evaluation. It is assumed that Page 31 of 54

instrument air is unavailable during a seismic event. Therefore, the impact of a postulated truss failure on instrument air availability is not assessed.

Response to RAl-11.e The PRA evaluation for LAR 278 presented a bounding analysis and a demonstrably conservative analysis. Although the structural analyses demonstrated the construction trusses maintained structural integrity, and supported/adjacent systems remained capable of performing the associated safety functions, the bounding analysis conservatively postulated a structural failure of the truss would always occur when the trusses are overstressed which always leads to core damage. The bounding analysis conservatively did not credit PORV availability for F&B capability.

PORV availability was credited in the demonstrably conservative analysis for LAR 278. The PORV modifications to provide a backup motive force (nitrogen system) for the PORVs in each Unit were cited as providing additional safety margin by increasing the availability of F&B, considering the bounding case. For the demonstrably conservative analysis, the backup motive force modifications maintain the safety margin by ensuring the availability of F&B should instrument air become unavailable.

The nitrogen supply to the PORVs provides safety margin because the nitrogen supply system is independent, redundant and diverse. The nitrogen supply system is independent from the non-seismic instrument air supply to the PORVs and provides a redundant means for operating the PORVs. The nitrogen supply system and the instrument air system do not depend on each other. They are redundant in that, if the instrument air system is not available, the nitrogen supply system to the PORVs remains fully functional, and vice versa. They are diverse because the instrument air system uses compressors, after coolers, dryers and 480 VAC power. The nitrogen supply to the PORVs uses pressurized tanks of nitrogen and does not use 480 VAC power. The nitrogen supply system meets seismic qualification requirements and was installed in accordance with station design standards.

The modifications to install the nitrogen supply to the PORVs were completed in both Unit 1 and Unit 2. The modifications installed the nitrogen supply tubing and actuation control circuits in a configuration such that they are considered protected from a postulated falling object.

Walkdowns that were performed to validate the availability of SSCs for the demonstrably conservative analysis identified that the original, as-built control cables for one bleed path in Unit 2 (block valve 2RC-515 and PORV 2RC-431C) are not routed in a manner that would provide protection from a postulated falling object. Therefore, a new modification is being initiated to reroute the control cables for 2RC-515 and 2RC-431 C to ensure they are protected from a postulated falling object, consistent with the assessment for other SSCs in the target assessment that supports the PRA evaluation. This new modification will be implemented during the Spring 2020 Unit 2 refueling outage. All other Unit 1 and Unit 2 PORV control cables were determined to be adequately protected, given the original design configuration.

Response to RAl-11.f Nitrogen is automatically aligned to the PORVs upon reduced instrument air pressure to the PORVs. This is accomplished through the use of check valves and a self-regulating pressure valve.

Page 32 of 54

Prior to implementing the PORV nitrogen supply modification, the operator had to reset the containment isolation signal to allow the instrument air supply valves to containment to be opened. The operator also had to successfully reset B-03 and B-04 non-safeguards equipment lockouts so the instrument air compressors could be loaded back onto buses B-03 and/or B-04. The operator could then open the instrument air containment isolation valves to allow instrument air into the containment. At that point, the operator could attempt to open the PO RVs.

With implementation of the modification to provide a backup nitrogen system for the PORVs, the operator attempts to open the PORVs first, which can be performed without resetting the containment isolation signal since the nitrogen system is located in containment. Buses B-03 and B-04 do not require non-safeguards equipment lockouts reset because the instrument air compressors are not required for PORV operation when using the nitrogen system. The instrument air containment isolation valves do not need to be opened. If the nitrogen system does not work, the operator is directed to reset containment isolation and non-safeguards equipment lockouts and open the instrument air containment isolation valves.

RAl-12 The seismic and/or thermal failure of the equipment supported from the trusses in the "bounding" analysis in Section 2 of Enclosure 4 of the submittal may increase the overall risk contribution. Enclosure 5 of the submittal compared the supported equipment and the supporting mechanism (e.g., anchors) against the design criteria using the GMRS and thermal loading. However, the risk assessment is not confined to the GMRS or the design basis.

According to Enclosure 2 of the submittal, the licensee is also committing to a modification to the containment spray pipe support. It is unclear if a fragility for the equipment supported by the trusses and the corresponding supports was determined which in turn, can be used to obtain the risk from corresponding failures across the seismic hazard curve as well as the thermal loading. Further, the mitigating systems employed for the thermal loading mitigation calculations provided in Section 2.2.4 of Enclosure 4 of the submittal are based solely on the random failure probability without consideration of failure due to the thermal or seismic hazard (such as through an operating reactor gate). The thermal loading mitigation calculations are applicable to both the "bounding" and the "demonstrably conservative" analyses. Section 2.2.2 of Enclosure 4 of the submittal uses information from EPRI report 302000079, Revision 3, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments," to determine the initiating frequency for steam line breaks and feedwater line breaks inside containment. The initiating frequencies are then used in both the "bounding" and the "demonstrably conservative" analyses. Section 5.1

("PWR [pressurized-water reactor] High-Energy Piping Systems") of the cited EPRI report states that the feedwater piping " ... system boundary considered in this evaluation consists of the piping from the low-pressure heaters ... up to the outboard containment isolation valves."

Similarly, the high pressure steam piping is considered to be" ... upstream of the [high pressure]

HP turbine throttle valve and extends to the outboard containment isolation valves." Therefore, the initiating frequencies for the piping from the cited EPRI report are for breaks outside containment and are inapplicable ta the risk assessment in the submittal.

a. Provide a quantitative assessment of the impact on the submitted risk calculations of the failure of the equipment supported by the trusses due to the seismic hazard and thermal loading or justify not including such impacts for the "bounding" as well as the "demonstrably conservative" cases.

Page 33 of 54

b. Provide an estimate, preferably using quantitative approaches such as the median fragility, of the extent to which the defense-in-depth due to containment sprays and containment air recirculation cooling systems is preserved beyond the plant's seismic design basis.

c. Provide the results of the thermal analysis using relevant initiating frequencies for the breaks of interest. If the updated initiating frequencies are partitioned by break size, provide the technical justification and methodology for the partitioning. Consider the responses to previous parts of this request in the re-quantification. Include any initiating frequency determined from the development of the seismic event tree as requested in RAl-8.

Response to RAl-12.a Containment spray is not credited after a postulated construction truss seismic overstress event that generates falling debris. Ventilation ductwork supported by the construction truss is never credited as functional. The postulated debris generated by equipment supported by the construction truss is bounded by the assumptions used to characterize debris generated by the construction truss. For example, the T1 truss weight is approximately 6000 lbs, much heavier than the piping and ductwork supported by the truss.

For thermal initiating events, the containment spray system is initially credited to limit the temperature excursion within containment. If containment spray fails to mitigate a construction truss overstress, the construction truss is assumed to generate debris in the same way a seismic overstress will. Section 2.3.4 in PBN-BFJR-17-019, Revision 1 (Enclosure 2), examines failures of systems that mitigate containment temperature transients and how they were considered in the thermal model. The thermal model includes the containment spray system.

Response to RAl-12.b The containment spray piping ring headers that are supported from the Unit 1 and 2 truss structures (including a portion of upstream piping) were evaluated for seismic loading in calculations 1100060-C-032, Evaluation of Unit 1 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, and 1100060-C-033, Evaluation of Unit 2 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, respectively. The peak interaction ratio (IR) for pipe stress was concluded to be 0.72 for Unit 1 and 0.79 for Unit 2 (compared against code of record stress limits; allowable stress limits from American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (B&PVC) Section Ill, 1977 through Winter 1978 Addenda, with allowable values taken from USAS 831.1 Power Piping, 1967). All associated pipe supports were demonstrated to remain within code of record stress limits (excluding the Unit 1 support, Sl-301 R-1-H202, that is proposed to be modified, as noted in Section 6.5.3.4 of Enclosure 5 of the LAR submittal). The piping analyses performed in calculations 1100060-C-032 and 1100060-C-033 used seismic response spectra developed from the seismic demand (time history from the anchor locations on the truss structures) that was used to evaluate the truss structures as part of the LAR submittal. Higher permissible operability limits for piping and support stress are described in site design guidelines DG-M09, Design Requirements for Piping Stress Analysis, and DG-M10, Pipe Support Guidelines, which includes pipe stress limits (consistent with ASME B&PVC Section Ill, Appendix F limits) that may be increased to 2xFy and pipe support allowable stresses that may exceed yield strength (developed from material ultimate strength values).

Page 34 of 54

As demonstrated in calculations 1100060-C-032 and 1100060-C-033, available design margin against code of record allowable values remains for pipe and pipe support stresses from the applied seismic accelerations developed from the site specific ground motion response spectra (GMRS). Further margin exists when the stresses are compared against higher operability limits for piping and pipe supports. Considering the permissible operability limits, significant capacity for the containment spray piping remains beyond the evaluated seismic accelerations developed from the GMRS. Therefore, the containment spray piping is considered to have a significantly higher median capacity than that calculated for the truss structures.

Analysis of the containment air recirculation cooling system (VNCC) ductwork (for applied seismic loading) was performed in calculations 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR. The bounding IR was identified as 0.35 for Unit 2. Considering the peak interaction ratios calculated, the VNCC ductwork loading has significant margin to design allowable limits. Considering a linear increase only, applied seismic forces can increase by a factor of 2 and the VNCC ductwork would remain within design allowable limits (simplified consideration, neglecting effects on truss structure). Therefore, the VNCC ductwork is considered to have a significantly higher median capacity than that calculated for the truss structures.

Response to RAl-12.c The results of the thermal analysis using relevant initiating frequencies for the breaks of interest are provided in Section 2.3.2 in PBN-BFJR-17-019, Revision 1 (Enclosure 2).

The updated initiating frequencies are not partitioned by break size.

RAl-13 Section 2.5 of RG 1.174, Revision 2, discusses uncertainties in risk analysis and states that

" ... comparison of the PRA results with the acceptance guidelines must be based on an understanding of the contributors to the PRA results and on the robustness of the assessment of those contributors and the impacts of the uncertainties." Section 9 of Enclosure 4 to the submittal states that "[t]he uncertainties are addressed by the simple bounding case and sensitivity analyses applied in this evaluation ... " However, neither the impact of the quantifiable uncertainties in the seismic hazard and seismic fragility is captured in the submittal nor is it demonstrated that the "qualitative factors" in Section 4 of Enclosure 4 to the submittal adequately capture such uncertainties. The "thermal sensitivity analysis" in Section 2.2.6 of to the submittal expands the initiating event frequency but does not address the uncertainties in those frequencies. Further, the submittal does not include a discussion of the sources of uncertainty and their impact for the "demonstrably conservative analysis". Justify the lack of sensitivity studies to capture the impact of key sources of uncertainties on the analyses presented in the submittal, considering the guidance in NUREG-1855, Revision 1. Alternately, describe, with justification, the approach used and provide the results (CDF, delta CDF, LERF, and delta LERF) from the following considering the response to RAl-7c:

a. A sensitivity study to address the uncertainty in the seismic hazard and in the seismic fragility for the "bounding case."

b. A sensitivity study to address the uncertainty in the initiating events identified for the thermal analysis and in the thermal fragility for the "bounding case." Include justification Page 35 of 54

for the uncertainty bounds and distribution selected for the thermal fragility for use in the sensitivity study.

c. A sensitivity study to address the uncertainty in the calculation inputs, such as the seismic hazard, the seismic fragility, the assessment results described in Section 5 of Enclosure 4 of the submittal, and the HEP, for the "demonstrably conservative case" of seismic evaluation. Include justification for the uncertainty bounds and distribution selected for the assessment results and the HEP for use in the sensitivity study.

d. A sensitivity study to address the uncertainty in the calculation inputs, such as initiating events identified for the thermal analysis, in the thermal fragility, in the assessment results, and the HEP, for the "demonstrably conservative case" of thermal evaluation.

Include justification for the uncertainty bounds and distribution selected for the thermal fragility, assessment results, and the HEP for use in the sensitivity study.

In addressing the above requests, consider the responses to RAls 5, 10, and 14.

Response to RAl-13 PRA evaluation PBN-BFJR-17-019, Revision 1 (Enclosure 2), Section 9.0, provides sensitivity studies that capture the impact of key sources of uncertainties on the analyses presented in the LAR submittal, based on the guidance in NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, Revision 1. In addition, responses are provided for each RAl-13 sub-part.

Response to RAl-13.a The bounding analysis in the PRA evaluation provides an upper limit of CDF and LERF based on the worst credible outcome of all known possible outcomes. No credit is provided for operator success or mitigating functions. This bounding analysis is based on the assumption that a construction truss overstress condition generates falling debris that leads to core damage, i.e., a conditional core damage probability of 1.0. Thus, the analysis is bounding both in terms of the potential outcome and the likelihood of that outcome; it bounds all uncertainties and potential risk contributors not included in the demonstrably conservative PRA model.

The two inputs used to assess the bounding CDF are the Gl-199 plant specific seismic hazard and the construction truss fragility curve. The probability distribution associated with the hazard was used to assess CDF, LERF, LiCDF and LiLERF for the 95% and 5% hazard values. The results are summarized in the following table. The mean values are also included for comparison.

Page 36 of 54

Mean Seismic Hazard Values MODIFICATIONS CDF ACDF LERF ALERF Al Thermal Mod Unit 1, Unit 2 Unmodified 6.30E-06 1.58E-06 2.69E-06 7.20e-07 B I All Design Basis Mods {Base CDF) 3.61E-06 8.64E-07 95% Seismic Hazard Values MODIFICATIONS CDF ACDF LERF ALE RF Al Therm al Mod Unit 1, Unit 2 Unmodified 2.35E-05 6.03E-06 9.83E-06 2.71e-06 B I All Design Ba sis Mods {Ba se CDF) 1.36E-05 3.31e-06 5% Seismic Hazard Values MODIFICATIONS CDF ACDF LERF ALERF Al Thermal Mod Unit 1, Unit 2 Unmodified 2.48E-07 4.31E-08 1.33E-07 2.45E-08 B I All Design Ba sis Mods {Base CDF) l.14E-07 1.86E-08 The PRA evaluation, Section 9.0, evaluates additional uncertainties, including Parameter, Completeness, and Model Uncertainties.

Response to RAl-13.b For the bounding thermal analysis, a new fault tree was created in the Point Beach NFPA 805 model which integrated the internal events model. This fault tree was used to calculate the probability that the construction truss would fail given a thermal initiating event and given the fragility of the construction truss . This analysis credited containment mitigating functions; all other mitigating functions are assumed to fail. The functions are described in Section 2.3 of the revised PRA evaluation . The SSCs and HEPs associated with these functions use the probability distribution in the internal events model, consistent with the Regulatory Guide 1.200 supporting requirements.

The thermal fragility data does not have an associated distribution. Structural analyses do not specifically address uncertainty when evaluating structural components for applied stresses.

The uncertainty for structural components is captured within the use of code guidance to determine allowable loads. Code guidance employs factors of safety to ensure that sufficient design margin is maintained to ensure that component performance remains predictable.

Additionally, material allowable strengths used in the code guidance for the evaluation of structural components uses the minimum published values to assure that stress levels in a component beyond code guidance is avoided . Typical material strength values exceed the minimum design value , and serve as further design margin. The use of factors of safety and minimum strength values ensures that component structural integrity is attained; however additional capacity that may be available is unaccounted. Considering the fragility values calculated from minimum properties and code guidance, the calculated values will result in under-predicting the actual capacity.

The uncertainties associated with this model were calculated using the UNCERT software, Version 4 .0. UNCERT is t.he EPRI R&R Workstat.ion tool to perform unc~rtainty analysis on cutsets created by CAFTA, Computer Aided Fault Tree Analysis System. The resulting uncertainties are listed in the following table (see PRA evaluation, Section 2.3.5.1):

Page 37 of 54

BOUNDING THERMAL ANALYSIS CDF Parameter Estimate Confidence Range Point Estimate 4.83E-08 Samples (Monte Carlo) 50000 Mean 4.85E-08 [4.7E-08, 5.0E-08]

5% 1.51E-09 [1.5E-09 , 1.6E-09]

Median 1.50E-08 [1.5E-08, 1.5E-08]

95% 1.83E-07 [1.8E-07, 1.9E-07]

Standard Deviation 1.55E-07 Skewness 22.57251 The PRA evaluation, Section 9.0, evaluates additional uncertainties, including Parameter, Completeness, and Model Uncertainties. Section 9.1.2 .2 provides a sensitivity study that evaluates the impact of changing the probability of failure as a function of temperature for the trusses on the bounding and demonstrably conservative risk calculations.

Response to RAl-13.c For the demonstrably conservative seismic analysis, a new event tree and model were created using the Point Beach NFPA 805 "Go Live" model that includes internal events and a fire model.

The model contains fragilities for all seismic sensitive SSCs and HEPs, some of which vary based on seismic acceleration. Attachment F of the PRA evaluation describes the inputs, assumptions, and logic used to develop the seismic model. The SSCs and HEPs used in this model apply the same probability distributions in the internal events model, or new distributions are developed consistent with the RG 1.200 supporting requirements. These probability distributions were evaluated in total by applying a Monte Carlo simulation using the UNCERT software, Version 4.0, to the demonstrably conservative cutsets generated by the model. The results are provided in the following table (see PRA evaluation, Attachment F, Section F.8):

DEMONSTRABLY CONSERVATIVE SEISMIC ANALYSIS CDF Parameter Estimate Confidence Range Point Est 1.21E-06 Samples 50000 Mean 1.19E-06 [1.4E-09, 1.6E-09]

5% 2.05E-07 [1.2E-11, 1.3E-11]

Median 7.36E-07 [2 .1E-10, 2.2E-10]

95% 3.42E-06 [4.7E-09, 5.1E-09]

Standard Deviation 1.95E-06 Skewness 19.42763 Smp Size @ 10% 1032 Smp Size@ 2% 25803 The PRA evaiuation, Section 9.0, evaluates additional uncertainties, including Parameter, Completeness, and Model Uncertainties.

Page 38 of 54

Response to RAl-13.d For the demonstrably conservative thermal analysis, a new fault tree was created in the NFPA 805 model which integrated the internal events model. This model includes initiating events identified for the thermal analysis, thermal fragility, HEPs, random SSC failures, bounding SSC construction truss debris damage probabilities, as well as the balance of the internal events model. This model was used to calculate the probability that the construction truss would fail given a thermal initiating event of the construction truss. The details of this model are described in Attachment E of the revised PRA evaluation .

As discussed in the response to RAl-13.a, the fragility data does not have an associated distribution. The distributions applied in the internal events model are consistent with the RG 1.200 supporting requirements, including HEPs. The distribution for the bounding SSC construction truss debris damage probabilities were developed based on the methods described in Attachment G of the revised PRA evaluation.

The uncertainties associated with this model were calculated using UNCERT software, Version 4.0. UNCERT is the EPRI R&R Workstation tool to perform uncertainty analysis on cutsets created by CAFTA, Computer Aided Fault Tree Analysis System. The resulting uncertainties are listed in the following table (see PRA evaluation, Section 9.0):

DEMONSTRABLY CONSERVATIVE THERMAL ANALYSIS CDF Parameter Estimate Confidence Range Point Estimate 1.40E-09 Samples (Monte Carlo) 50000 Mean 1.49E-09 [1.4E-09, 1.6E-09]

5% 1.23E-11 [1.2E-11, 1.3E-11]

Median 2.18E-10 [2.lE-10 , 2.2E-10]

95% 4.94E-09 [4.7E-09, 5.lE-09]

Standard Deviation 1.49E-08 Skewness 85 .39294 The PRA evaluation, Section 9.0, evaluates additional uncertainties, including Parameter, Completeness, and Model Uncertainties.

RAl-14 Section 6 of Enclosure 4 of the submittal discusses the LERF calculation which uses a CLE RP

[conditional large early release probability] of 0.2 based on the information for different hazards.

The CLERP is then applied to the results for the change in CDF from the "bounding" and the "demonstrably conservative" analyses. It appears that the impact of the truss failure on LERF via component failures has not been considered. Further, it is expected that instrument air will be required for containment isolation valves and the determination of the impact of truss failure on instrument air availability does not appear to have been performed as part of the assessment

'described in Section 5 of Enclosure 4 of the submittal. Such failures can be accounted for by .

exercising the Level 2 or simplified LERF model in conjunction with the component fa ilure probabilities. In light of the factors identified above, provide an estimate of LERF that quantitatively considers the failure of components and systems that can impact containment integrity or justify that the current approach bounds such impacts.

Page 39 of 54

Response to RAl-14 The method used to assess LERF has been revised. Section 2.1 in the revised PRA evaluation describes the simplified LERF model that incorporates bounding probabilities for failures impacting containment integrity. This model accounts for containment penetrations damaged from postulated falling construction truss debris and independent containment failures due to seismic events.

A bounding failure probability of 0.5 was developed for containment penetrations struck by falling construction truss debris. This value was used in the bounding analyses. A more realistic, but still conservative, failure probability of 0.1 was used in the demonstrably conservative analysis. Section 2.1.2 in the revised PRA evaluation provides the basis for these values.

Failure of containment isolation due to a seismic event is based on the IPEEE seismic fragility fault tree for the containment isolation system (CIS). The IPEEE CIS fragility was updated to consider subsequent modifications made to improve containment isolation seismic robustness.

Section 2.1.4.1 in the revised PRA evaluation provides a description of how this fragility was developed.

Note that Instrument Air is not required for the containment isolation valves to perform their containment isolation function. The valves return to their desired position for containment isolation on loss of instrument air. UFSAR Section 5.2, Containment Isolation System, states "Air operated valves which are designed as automatic trip isolation valves are designed to fail to the closed position upon loss of control air or electric services."

RAl-15 Section 5 of Enclosure 4 to the submittal discusses the "demonstrably conservative analysis" and summarizes the results of the assessment performed in support of that analysis. The discussion cites a proprietary assessment report, Reference 3, in Enclosure 4 to the submittal.

The following are related to the assessment:

a. Provide Reference 3 in Enclosure 4 to the submittal or the details of the assessment used to include and exclude different structures, system and components (SSCs) as well as determine the probability of failure given truss failure in the "demonstrably conservative" analysis as summarized in Sections 5.1 and 5.2, respectively, of Enclosure 4 to the submittal.

b. Based on the discussion in Section 5.1 of Enclosure 4 to the submittal it appears that "perforation/penetration" is the only failure mode considered as part of the assessment.

However, the rationale for the selection has not been provided. Discuss the various structural failure modes that were considered in the assessment for the SSCs impacted by falling truss debris and provide the basis for the determination of perforation/penetration as the only failure mode.

c. Describe how qualitative, quantitative, or a combination of both approaches was used in the assessment summarized in Section 5.1 of Enclosure 4 of the submittal. If any equations/formulae were used to determine the ability of falling debris to damage a particular SSC, provide the basis to support the applicability of those equations/formulae to the current assessment.

Page 40 of 54

d. One of the assumptions made in the assessment appears to be that" ... debris targeting critical SSCs are assumed to be oriented in a way that maximizes damage to targeted SSCs."

i. Describe the approach to determine the orientation(s) of the falling truss debris that "maximizes damage to targeted SSC."

ii. Justify any assumptions made in determining the orientation(s) of the falling truss debris that "maximizes damage to targeted SSC" and for any other orientations of the falling truss debris.

iii. Describe whether and how the probability of a particular orientation of the falling truss debris was determined, and provide details of the approach used to incorporate those probabilities in the "qualitative evaluation of the impact of trusses and cross members" performed in the assessment.

iv. Section 5.1 of Enclosure 4 of the submittal discusses the assessment of the impact of the truss debris on the polar crane and cites the proprietary assessment report. Justify the conclusion reached for the polar crane hook in Section 5.1 of Enclosure 4 of the submittal considering the potential impact of the truss debris on the cable holding the crane hook.

Response to RAl-15.a Reference 3 in Enclosure 4 of the LAR is document PBN-BFJR-17-020, Point Beach Construction Truss Target Assessment, Revision 0. The Target Assessment document was recently revised to support the revised PRA evaluation. NextEra is transmitting a copy of the revised Target Assessment by separate letter as the document contains security-related sensitive information.

Response to RAl-15.b In addition to perforation and penetration, crushing a fragile object was also considered as a failure mode. For example, the 3" auxiliary feedwater supply pipe connecting to the main feedwater pipe was considered failed if it was crushed by postulated falling construction truss debris.

Response to RAl-15.c The assessment construction truss missile damage uses equations based on empirical methods/data to estimate local damage. They consider the ability of a target to absorb energy based on the dynamic properties of the target, support conditions and other imposed loads at the time of impact. Structural specifications were reviewed to determine the structural response and determine if the target will remain stable after missile impact. Calculations of perforation and penetration of an object are based on equations from BC-TOP-9A, Topical Report, Design of Structures for Missile Impact, Revision 2. This reference is an accepted industry reference for missile impact studies. The application of the equations is described in the Target Assessment, document PBN-BFJR-17-020, Revision 1, Section 3.2. Missile orientation and contact area factors are described in the Target Assessment, Section 3.3.

Page 41 of 54

Response to RAl-15.d.i The missile orientation that maximizes damage to the targeted SSC is a normal orientation (perpendicular to the tangent plane of the target) that aligns with the smallest missile contact area and with the center of gravity of the missile. Missile orientation and contact area factors are described in the Target Assessment, Section 3.3. For example, the following equation from BC-TOP-9-A shows that the diameter of a missile is inversely proportional to the damage to the target (thickness of element to be just perforated). As the missile diameter increases, the damage to the target decreases.

The thickness of a concrete element that will just be perforated by a missile is given by:

T = 427 /../f' c x W /D 1 *8 x ( 1 :~ 0 ) 1

• 33 (Equation 3)

Where:

T = Thickness of concrete element to be just perforated (inches)

W =Weight of missiles (lbs)

D = Diameter of missiles (inches)

Note: For irregularly shaped missiles, an equivalent diameter is used. The equivalent diameter is taken as the diameter of a circle with an area equal to the circumscribed contact, or projected frontal area, of the non-cylindrical missile.

Vs = Striking velocity of missile (ft/sec) rc = Compressive strength of concrete (psi)

Response to RAl-15.d.ii Assuming a normal orientation (perpendicular to the tangent plane of the target) that maximizes the damage to a targeted SSC, is a bounding assumption. Realistically, normal alignment is unlikely due to following: 1) random detachment and disassembly of the truss ligaments,

2) contact with obstacles, rotating and 3) spinning at random angles and speeds.

Response to RAl-15.d.iii The probability of a particular orientation was qualitatively studied to develop a more realistic understanding of target damage probability (see Section 3.3 in the Target Assessment, PBN-BFJR-17-020, Revision 1). It is not practical to evaluate the precise orientation of a construction truss generated missile when it hits a target.

Response to RAl-15.d.iv During normal power operations, the containment polar crane (1/2Z-13) is positioned adjacent to the access ladder in each unit, which is directly under Truss 15 (as numbered per Attachment A of the structural calculations that support the LAR submittal, such as 1100060-C-022, Thermal Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR). Truss 15 is a T2 style truss, per drawing C-125, Containment Structure Liner Support Trusses. Prior to storage, station practice is to position the trolley at the end of the crane near the access ladder, to facilitate personnel access during the following outage.

Page 42 of 54

The main hoist bottom block for the containment polar crane weighs 8550 lbs, per drawing 463TA, 1Z13 Containment Crane Trolley Layout (463TB, 2Z13 Containment Crane Trolley lists the same weight for Unit 2). This weight exceeds the bounding weight of the truss components evaluated within the assessment (PBN-BFJR-17-020, Point Beach Construction Truss Target Assessment) performed as input for the PRA evaluation (Enclosure 4 of the LAR submittal).

Given the nature of the polar crane, the trolley can be positioned either nearer or farther away from the containment liner, as compared to the auxiliary hoist (as depicted on drawings 463BA, 1Z13 Containment Crane Bridge Layout, and 463BB, U2 Z13 Containment Crane Bridge Layout). When positioned away from the containment liner in the storage configuration, the center of the drum is approximately 14'-5W' from the containment liner (considering the dimensions per drawings 463TA, 463TB, and C-125). In this position, the main hoist drum would be located approximately under the second panel point of the bottom chord (closer to the truss support by approximately 2').

The main hoist cable uses a 1-1/8" diameter, improved plow steel, 6x37 wire rope with a fiber core. As documented in Marks' Standard Handbook for Mechanical Engineers, 1oth Edition, the listed nominal strength for 1-1/8" 6x37 wire rope is 52.6 tons. The wire rope is wrapped around the main hoist drum with no overlapping. As depicted on drawing 463H9A, 1&2Z-13 Containment Crane Main Hoist Drum, the drum has a 7/16" deep groove for the wire rope.

Considering postulated impact from overhead debris, the load would likely be distributed across several wraps of the wire rope. As the weight of the block represents approximately 8% of the total wire rope capacity, only a portion of the wire rope is required to maintain support of the main hoist block. The portion of the cable below the upper edge of the groove is considered to be afforded protection by load distribution to the main hoist drum. Additionally, given the nature of the wire rope, impact from postulated overhead debris would likely result in spreading of the wires within the strands, and strands within the wire rope, prior to shear failure of the rope.

Considering the potential for energy dissipation from spreading apart of the wire rope, the relative height of objects above the truss, and the protected portion of the wire rope in the groove of the drum, failure of the wire rope is not postulated.

RAl-16 The NRC staff noted that in Section 6.4.2.1 of Enclosure 5 to the submittal, the licensee discussed the development of seismic fragility for Unit 1 with Limited Modification and Unit 2 Unmodified. The licensee applied additional capacity adjustment factors, such as those for load redistribution and inelastic energy absorption, to the calculations of the equivalent PGA [ground peak acceleration] (licensee uses the term PGAc in the submittal) and indicated that those factors are reasonable for the calculations. The licensees concluded that the PGAc calculated from the equivalent static analysis is higher than that calculated from the elastic analysis. Using the higher PGAc, the licensee derived the delta CDFs for both the "bounding" and "demonstrably conservative" analyses presented in Enclosure 4 of the submittal. However, the staff noted that the lower PGAc calculated from the elastic analysis would yield a larger delta CDF result that may be greater [than] 1E-05 per year. The licensee has not justified why the PGAc calculated from the elastic analysis should not be used. Furthermore, the licensee has not provided the explanation about the differences in applying the capacity adjustment factors in the PGAc calculations.

a. Clarify the differences in the capacity adjustment factors applied in the PGAc calculations.

Page 43 of 54

b. Provide justification for using the higher PGAc from the equivalent static analysis as opposed to that from the elastic analysis.

Response to RAl-16.a Two different sets of capacity adjustment factors are used to determine the HCLPF, depending on the type of analysis that was used as the basis for the HCLPF.

As shown in calculation 1100060-C-028, Seismic Fragility Analysis of Containment Dome Trusses, the two peak ground accelerations (PGAc is used in this response to differentiate between HCLPF peak ground acceleration and the peak ground acceleration for the ground motion response spectra, PGA) calculated for the HCLPF were derived based on the results from the structural analyses performed within calculations 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR.

The first HCLPF acceleration, based on the elastic analysis, was calculated considering the PGA at which the limiting truss member demand was equal to the capacity, as determined in accordance with ANSl/AISC N690-1994(R2004), Specification for the Design, Fabrication, and Erection of Steel Safety-Related Structures for Nuclear Facilities (i.e., the maximum calculated member stress interaction ratio was equal to 1.0 using the allowable stresses). The ratio (capacity to demand) that was applied to the structural calculations was used to scale the PGA from which the ground motion response spectra is anchored (i.e., scale factor, taken as 0.44 to envelope both Unit 1 and Unit 2, multiplied by 0.14g). Due to the inherent limitation of the elastic analyses, credit is not taken for load redistribution within the truss structures or inelastic energy absorption (through the development of plastic hinges), therefore, capacity adjustment factors are selected to increase the PGAc associated with the elastic analyses.

The second HCLPF acceleration is based on the equivalent static analyses. Calculations 1100060-C-024 and 1100060-C-025 demonstrate that the truss structures maintain structural integrity when evaluated for seismic loading developed from the GMRS, which is anchored to a PGA of 0.14g. Unlike the elastic analysis, the equivalent static analysis uses the proposed acceptance criteria of 1100060-RPT-002, Methodology and Criteria to Determine the Strength Capacity of the Point Beach Nuclear Plant Containment Dome Trusses and Attached/Adjacent Components in Support of a Risk-Informed License Amendment Request, which provides strain criteria for truss members (the top and/or bottom chord members) that exceed ANSl/AISC N690-1994(R2004) allowable values. The equivalent static analysis accounts for load redistribution and inelastic energy absorption as part of the nature of the analysis.

The elastic analysis does not exceed code allowable limits, therefore, larger capacity adjustment factors are used to determine a HCLPF to account for load redistribution and inelastic energy absorption as compared to the equivalent static analysis. The same capacity factors are considered for the calculation of the HCLPF for both of the structural analyses; however, for the equivalent static analysis, no increase is considered for load redistribution (permissible elastic stress has been exceeded resulting in load redistribution) and a reduced increase (i.e., reduced from 1.5 to 1.2) is taken for inelastic energy absorption from the value used in the elastic analysis to reflect a limited number of members that have stress exceeding permissible values.

Page 44 of 54

Response to RAl-16.b The PGAc determined for the equivalent static analysis is chosen over the elastic analysis approach since it provides a more realistic structural assessment to be used in the determination of the HCLPF by using the Methodology and Criteria discussed in document 1100060-RPT-002. The equivalent static analysis addresses the load redistribution capacity of the truss structures as compared to the limitations and inherent conservatism in the elastic analysis approach. The only capacity factor that is used to adjust the HCLPF for the equivalent static analysis is the load redistribution factor of 1.2. This is considered acceptable, as the equivalent static analysis demonstrates that margin remains on the acceptable strain limit (i.e.,

maximum calculated strain of 1.22%, for Unit 2, compared to an allowable value of 1.5% strain).

Increasing the maximum strain by 20% results in a strain limit (1.46%) that is still below the allowable strain limit. The use of the equivalent static analysis is considered the analysis that most accurately reflects the response of the truss structures, while maintaining margin on the maximum allowable limit, and is therefore considered appropriate for calculation of the seismic fragility.

RAl-17 The construction trusses in each unit were originally installed to provide support for the containment dome liner and initial dome concrete pour during original station construction. After the initial concrete pour cured, the truss structures were lowered a few inches away from the containment liner, no longer providing structural support to the dome, and remained in place.

The trusses were then used as an attachment point for containment spray piping, ventilation ductwork, post-accident containment ventilation (PACV) piping, and miscellaneous lights and associated conduits. An initial analysis of seismic adequacy was performed by the construction vendor. LAR Section 2.1.1 stated that "the trusses were not included in the original FSAR seismic classification tables. They were subsequently added to the UFSAR in 2013 as a Seismic Class I structure supporting Class I piping and ductwork."

a. LAR Section 2.1.1 indicates that the containment dome truss is now qualified as a "Seismic Class I" structure. This statement contradicts the information in Section 1.0 of the LAR. Please clarify whether the containment dome trusses are qualified as "Seismic Class I" or the original intended seismic criteria.

Response to RAl-17.a Section 2.1.1 of Enclosure 1 of the LAR submittal intended to document that the truss structures were not originally included in the Point Beach original FSAR. The truss structures were added to the UFSAR as a Seismic Class I structure to conservatively reflect the design functions of the truss structures, which includes:

o Maintaining structural integrity before, during, and after a design basis accident or event; o Not impeding the design function of equipment adjacent to or supported by the truss structures, which includes:

• Containment liner and building

• Containment spray piping

• Containment air recirculation cooling system (VNCC) ductwork

• Other miscellaneous loads (PACV piping, lighting, conduits)

Page 45 of 54

The function of supporting Seismic Class I systems was conservatively used as the basis for classifying the truss structures as being required to meet Seismic Class I criteria in the 2013 revision of the UFSAR. However, no qualification or assessments exist that currently demonstrate the trusses meet Seismic Class I criteria (i.e., material classifications, weld certifications, etc.). Therefore, the truss structures will be stated in the UFSAR as Seismic Class Ill structures. Classifying the truss structures as Seismic Class Ill structures, with the design function of supporting Seismic Class I systems (i.e., containment spray piping and the containment air recirculation cooling system, VNCC), reflects the original truss design/qualification following construction. Supporting analyses for the LAR submittal (i.e.,

calculations 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR) have demonstrated that the design functions of the truss structures are maintained for the proposed configurations, using the methodology described in Section 4.0 of Enclosure 5 of the LAR submittal.

RAl-18 LAR Section 2.0 "Detailed Description" states that "The construction trusses were subsequently reanalyzed and walkdowns and reviews of plant photos discovered a discrepancy between the as-built configuration of the trusses and the design drawing that the analysis was based on.

Specifically, the lower diagonal bracing framework of the trusses, and the bottom lower diagonal bracing location on the truss, were different than shown on the design drawing.

Consequently, these activities and the refinements of the analysis resulted in identifying non-conformances to the design COR, "AISC [American Institute of Steel Construction] Specification for the Design, Fabrication, and Erection of Structural Steel for Buildings," April 1963, 6th Edition, for postulated seismic loads. Follow-on inspection of the trusses during initial resolution activities further identified a nonconformance with regard to the available clearance between a limited number of locations on the construction trusses and the containment liner in each Unit."

LAR Section 2.1.1 "Construction Trusses" stated that "The trusses were not included in the original FSAR [final safety analysis report] seismic classification tables. They were subsequently added to the UFSAR in 2013 as a Seismic Class I structure supporting Class I piping and ductwork."

a. Clarify whether structural assessments and modifications were performed consistent with licensing basis AISC, April 1963, 6th Edition. If other criteria was used, identify the criteria and discuss the basis for selecting criteria other than the licensing basis.

Response to RAl-18.a The only physical modifications that have been performed to the truss structures (between original construction and the LAR submittal) were those identified in Section 3.3.1 of of the LAR submittal. The specific modifications relocated to the center of the slots of the bearing housing base plate the mounting bolts that were not centered.

For Unit 1, the bearing housing anchor bolts were repositioned at 12 truss locations (specifically, truss locations 1, 5, 6, 7, 8, 10, 11, 12, 13, 15, 17, and 18).

For Unit 2, the bearing housing anchor bolts were repositioned at 7 truss locations (specifically, truss locations 1, 6, 12, 13, 15, 17, and 18).

Page 46 of 54

These modifications were performed to align the truss structures' configuration to the original installation drawings. The scope of the modifications did not impact any requirements associated with slotted holes per AISC Manual Steel Construction, 61h Edition.

No other modifications have been implemented.

RAl-19 Section 3.1.3 of Enclosure 1 of the submittal (page 15 of 26) discusses how sufficient safety margins are maintained with the proposed change to the licensing basis. According to Regulatory Guide (RG) 1.174, Revision 2, assurance of sufficient safety margins following risk-informed licensing basis changes needs to consider whether, "[s]afety analysis acceptance criteria in the [licensing basis] LB (e.g., final safety analysis report (FSAR), supporting analyses) are met. .. " Safety analysis and containment integrity analysis are documented in Chapter 14 of the licensee's UFSAR (ADAMS Accession No. ML16251A166).

a. Clarify, citing relevant portions of the licensee's UFSAR, whether the UFSAR Chapter 14 analyses have adequately considered the following as a result of the abandonment of the containment dome truss in place:

i. Impact on the containment available volume and containment total heat sinks due to the truss material.

ii. Alternately, provide adequate justification that the UFSAR, Chapter 14, analyses remains bounding.

b. If the truss material is credited for accident and/or containment analyses, clarify whether the credited material reflects the as-designed or the as-built trusses indicating the difference between the two in case the as-designed truss material is credited.

c. Provide details about the amount of truss material that is to be removed as part of the proposed modifications and justify not reassessing the safety analyses and containment analyses to ensure that the assumptions for those analyses are valid and the acceptance criteria continue to be met.

d. Provide quantitative or qualitative technical justification that the collapse of the dome truss does not result in accidents other than those analyzed in the licensee's UFSAR.

Response to RAl-19.a The containment pressure and temperature responses to a loss-of-coolant accident (LOCA) and a main steam line break (MSLB) are determined in calculations CN-CRA-08-6, LOCA Mass and Energy Release and Containment Response Analysis for the [Extended Power Uprate] EPU Program; and CN-CRA-08-43/CN-CRA-12-27, Point Beach EPU: Units 1 (WEP) and 2 (WIS)

[Steam Line Break] SLB Inside Containment Response, both of which are referenced within Chapter 14 of the Point Beach UFSAR.

Heat Sinks The containment heat sinks are an integral part of the GOTHIC containment model, which is used in the evaluation of the containment pressure and temperature responses. The GOTHIC Page 47 of 54

containment model is developed in calculation CN-CRA-07-55, Point Beach GOTHIC Containment Model for LOCA and MSLB Analysis, for both sets of analyses (i.e., LOCA and MSLB).

The source of the heat sinks used in the development of the GOTHIC model is calculation 2001-0036, Heat Sinks for MAAP 5 Containment Reanalysis (Materials, Distributed, & Lumped),

which modeled the containment dome truss steel as a lumped heat sink. Calculation 96-0242, Summary of Containment Structural Heat Sinks, provided the input for the weight and surface area for the miscellaneous steel in the dome compartment used for modeling the lumped heat sink, which was developed from the associated structural drawing for the truss structures, drawing C-125, Containment Structure Liner Support Trusses.

Containment Free Volume Similar to the heat sinks discussed above, the containment free volume is also included within the development of the GOTHIC containment model used when evaluating the containment pressure and temperature responses to a LOCA and an MSLB.

The GOTHIC model treats the containment as a single control volume, citing the free volume as 1,000,000 cu. ft., as reflected in UFSAR Table 14.3.4-24, Containment Integrity LOCA Analysis Parameters. The source of the volume used in the GOTHIC model is calculation 2001-0028, Auxiliary Section of Parameter File for MAAP 5 Containment Reanalysis.

The source calculation for the free volume, calculation 2001-0028, considered the truss steel in the discussion of the containment dome volume, but the calculation concluded the truss steel was a negligible detractor from the free volume. Therefore, the steel in the containment dome truss is not explicitly accounted as a displacing volume. Rather, the calculation for free volume conservatively neglects some second-order voids by modeling them as solid displacements (e.g., the polar crane rail girder, the polar crane box beams, the feedwater piping and insulation, and the main steam lines and associated insulation are modeled as solid displacements). This is done explicitly to conservatively bound the actual free volume by under-estimating it. The following text is excerpted from the discussion in the calculation:

"A ranked list of the various enveloped (positive) and displacing (negative) volumes of containment was then prepared from the supporting spread sheets and the resulting curves plotted. The curves illustrate that as the volumes credited and debited become more refined, there is an asymptotic approach to an ultimate value of approximately 1,000,000 cu. ft."

Below is a depiction of the curves that combine both the contributing volumes and the displacement volumes:

Page 48 of 54

Containment Volume 1.3E+06 1.2E+06 ~ \

1.1E+06

/ \

I ~

1.0E+06 9.0E+05 I I

8.0E+05 7.0E+05 6 .0E+05 5.0E+05 4.0E+05 1 3 5 7 9 1113151719 21232527 29 3133353739 41434547 49 51535557596163656769 717375 7779 81 83 Number of Sub-Volumes Accounted For Response to RAl-19.b The truss structures are not explicitly included in the containment free volume calculation, but the truss structures are credited as passive heat sinks in the containment accident analysis.

The surface area and weight of the truss structures was determined in calculation 96-0242 using the as-designed dimensions of the truss structures per drawing C-125.

Calculation 96-0242 determines the surface area per foot of the major structural members (e.g.,

structural tees for the top and bottom chords, double angle bracing, wide flange beams for the horizontal bracing), using the member's overall dimensions, and multiplies the surface area per foot by the member length to get the total surface area. This surface area value was then used to calculate an effective thickness for the member. Some member lengths (top framing) were conservatively calculated, underestimating the overall length (specifically, the radial top framing members used only the horizontal distances and neglected the vertical distance rather than calculating the actual lengths). Additionally, some members were not included for simplicity of the calculation (e.g. , tension tie rods, outermost bottom horizontal bracing, vertical bracing in every other bay, center hexagonal plate, tabs connecting multiple members, the bearing housings, etc.). The reduction in surface area was a simplification that ensured conservatively low values were used for the mass and surface areas for steel in the containment.

As noted in Enclosure 1 of the LAR submittal, two discrepancies in the as-found configuration of the truss structures (associated with the nonconformances) were identified: .

• the outermost bottom horizontal brace framed into the bottom chord away from the truss support point (discrepancy that was inconsistent with the as-designed truss structure per drawing C-125) and

• the direction of the bottom chord bracing does not match the direction identified on drawing C-125 (the direction was a mirror image for some of the truss locations).

Page 49 of 54

The outermost diagonal brace was not included in the calculation of the total heat sink area (member was conservatively neglected) and the direction of the diagonal braces (mirror image) would not impact the overall length (and subsequently the corresponding surface area).

Therefore the as-found discrepancies did not impact the originally calculated surface area of the truss structures.

Response to RAl-19.c The proposed scope of modifications consists of trimming the top chord of six individual trusses in Unit 1 (at the first panel point above the truss support) and no modifications to the Unit 2 truss structure. The trimming will consist of:

• Removal of a portion of the flange and web for five trusses. The flange will be removed (in its entirety) back no more than 5" in either direction from the panel point. The web will be trimmed away from the containment liner no more than 2" in the horizontal direction with the maximum web trim at the panel point, reducing back to the location where the flange was removed. The total portion to be removed (flange and web) will be a triangular shaped piece. A new plate will then be welded to replace the flange that was removed.

• For the remaining truss (sixth location), the outer face of the flange will be trimmed by removing a portion of each end of the flange adjacent to the containment liner.

The proposed modifications to the Unit 1 truss structure are depicted in Attachment H of calculation 11 Q0050-C-022, Thermal Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR.

As identified on drawing C-125, the top chords of the T1 and T2 trusses at the first panel point are fabricated using ST12WF34 and ST9WF32 members, respectively. Using the web and flange dimensions for an ST12WF34 member as bounding, the surface area of the removed portion (using the conservative trim dimensions above) is calculated as:

=

tf 0.582 in. Flange thickness, per AISC Manual of Steel Construction, 5th Edition tw = 0.415 in. Web thickness, per AISC 5th Edition b = 8.951 in. Flange width of structural tee, per AISC 5th Edition

=

d 11.85 in. Depth of structural tee, per AISC 5th Edition Lflange =5 in. Length of removed flange

=

dweb 2 in. Depth of removed web Calculate the surface area for the removed portion of flanges; consider two sections that are 5 in. long:

SAflange = 2 * {b + {2

• tf) + {b - tw))

• Lflange SAflange =2 * (8.951 in.+ (2

• 0:582 in.)+ (8.951 in. - 0.415 in.))* 5 in.

=

SAflange 224.04 in 2

= 1.55 ft 2

Calculate the length of the cut along the web, considering the maximum web depth as 2 in.:

2 2 Lweb = (Lflange - dweb )% = ((5 in.)2- (2 in.)2)% = 5.55 in.

Page 50 of 54

Calculate the surface area of the removed portion of flanges, considering both sides:

SAweb =2 * (Lweb

• dweb) =2 * (5.66 in.

• 2 in.) =22.63 in =0.157 ft 2 2 Calculate the total surface area of the removed portion of the truss top chords, conservatively considering the same material removed at all six truss locations and taking no credit for the replacement flange:

SAtotal =6 * (SAtlange + SAweb) =6 * (1.56 ft 2 + 0.157 ft 2) =10.3 ft2 As determined in calculation 96-0242, the total surface area calculated for the truss steel was 20, 734 ft2. The removed portion of the top chords represents approximately 0.05% of the total calculated surface area (conservatively neglects the surface area of the replacement flange) and is considered to have a negligible impact on the containment response calculations.

Therefore, the containment response calculations are considered to remain acceptable.

Response to RAl-19.d The postulated collapse of the truss structures is the approach taken in the PRA evaluation (Enclosure 4 of the LAR submittal) to assess the risk associated with the truss structures for design basis accident and event (seismic, based on the site specific ground motion response spectra, GMRS) loading. Calculations 1100060-C-022, 1100060-C-023, Thermal Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR, 1100060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR, and 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR, evaluate the proposed truss structure configurations (six top chord first panel points trimmed on the Unit 1 truss structure, and the as-found Unit 2 truss structure) and demonstrate that the truss structures maintain structural integrity for the applied design basis thermal and site-specific seismic loading. The systems, structures, and components (SSCs) supported by or adjacent to the truss structures have also been demonstrated to maintain the ability to satisfy the associated design basis functions (demonstrated in the calculations listed above and calculations 1100060-C-032, Evaluation of Unit 1 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR, and 1100060-C-033, Evaluation of Unit 2 Containment Spray Piping under Seismic Loading Using GMRS Input in Support of Risk Informed LAR). Therefore, with the truss structures maintaining structural integrity and all associated equipment maintaining the ability to perform its intended design functions, no new accidents are considered other than the accidents currently postulated within the updated final safety analysis report (UFSAR).

RAl-20 RG 1.174, Revision 2, indicates that in implementing risk-informed decision making, licensing basis changes are expected to meet a set of key principles. One of the five principles states that

the proposed change maintains sufficient safety margins." The NRC staff noted that in Table 4-2 of Enclosure 5, the licensee identified the alternative criteria/methods for the licensee's risk-informed approach.

a. Section 2 of Enclosure 5 of the March 31, 2017, submittal, indicates that damping factor used in the design of welded steel framed and bolted steel framed structures are 2 percent and 5 percent for the Hypothetical Earthquake in the UFSAR. In Section 5.3, the licensee stated that the damping value used in the analyses is 7 percent for bolted Page 51 of 54

steel with bearing connections. The applicant stated that while each of the individual 18 trusses is a welded planar truss assembly, the transfer of load between the 18 trusses is through a bolted brace system and concluded that the use of 7 percent damping is appropriate.

i. Justify that the as-built conditions of each of those 18 truss assemblies are consistent with the assumption that the transfer of load is through a bolted brace system.

ii. Explain how the safety margins are impacted by the use of a 7 percent damping factor and whether sufficient safety margins are maintained.

b. Results in Section 6.5.1.2 of Enclosure 5 of the March 31, 2017, submittal identify locations that would exceed the ANSl/AISC N690-1994(R2004) allowable stress. The licensee explained in Section 5.5 of Enclosure 5 of the March 31, 2017, submittal that it is acceptable to use a strain-based acceptance criteria. The NRC staff noted that NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 3.8.4.111.5, states that the staff should evaluate the justification provided to show that structural integrity will not be affected if the licensee proposes to exceed some of these limits.

i. Justify the use of the proposed 1.5 percent strain acceptance criterion as it relates to structural integrity.

ii. Explain how the safety margins are impacted by the proposed 1.5 percent strain acceptance criterion and whether sufficient safety margins are maintained.

Response to RAl-20.a.i The truss structure consists of the following connections:

The base of each planar truss top and bottom chord is welded to a horizontal connection plate to the bottom of which a second plate is welded. The lower second plate is milled to a radius of 2'-0", and therefore, acts as a rocker. The rocker allows each truss to pivot at that location.

Each rocker rests in a pocket, which is on top of a bearing box, which fits into a bearing housing (i.e., the truss bears on the top of the bearing box under self-weight with no other physical connection to the bearing box). The bearing housing is welded to a baseplate that is bolted to a support beam. The bolt holes in the baseplate are slotted in the radial direction, with the anchor bolts installed in the center of the 5 in. long slotted hole. Two %"thick graphite plates are placed between the baseplate and the support beam. The slotted bolt holes and graphite plates allow each truss to move radially. The bolts bear on the long side of the slotted holes and provide lateral (tangential) restraint to the trusses.

At the apex of the structure, the T1 trusses are bolted to a built-up hexagon-shaped plate frame, while the T2 trusses are bolted to a hexagon-shaped built-up beam system, which is bolted to the top chord of the T1 truss.

The top chords are connected to each other with 8WF beams that are bolted to tabs that are welded to the WT sections. The bottom chords of adjacent trusses are connected in every other bay with horizontal double angle bracing that is bolted to gusset plates that are welded to the WT sections. The top chords are connected to the adjacent bottom chords in every other bay Page 52 of 54

with double angle vertical (diagonal) bracing that is bolted to gusset plates that are welded to the WT sections.

As described above, the transfer of load between each of the trusses, and between the trusses and the containment building, is through bolted connections. Therefore, the use of 7% damping is deemed appropriate.

Response to RAI-20.a.ii The 7% damping used is as shown in Table 3-2 of ASCE/SEI 43-05, Seismic Design Criteria for Structures, Systems, and Components in Nuclear Facilities, for Response Level 2, which is applicable when the ratio of the total elastic demand (De) to the code capacity (C) is between 0.5 and 1.0 (Table 3-3 of ASCE 43-05). This condition is applicable to most of the highly stressed truss components.

When the ratio D6 /C is greater than or equal to 1.0, as occurs in a select number of locations in the truss bottom chords, Response Level 3 is applicable. In accordance with Table 3-2 of ASCE 43-05, 10% damping may be used. Additionally, no credit is taken for the low friction provided by the graphite plates between the bearing housing and the support bracket that would further reduce accelerations. Therefore, additional margin is considered to exist when using 7%

damping.

Response to RAI-20.b.i Strain-based acceptance criteria for the truss top and bottom chords is used to account for the significant ductility present in steel components subject to varied loading conditions. The allowable strain limit of 1.5% is considered acceptable for demonstrating that structural integrity of open cross-section flexural members is maintained considering published ductility factors from historic testing and code guidance.

As documented in 1100060-RPT-002, Methodology and Criteria to Determine the Strength Capacity of the Point Beach Nuclear Plant Containment Dome Trusses and Attached/Adjacent Components in Support of a Risk-Informed License Amendment Request, the average maximum ductility factor attained for open-cross section structural members (which is consistent with the truss members) was 26.4, which was based on historic static tests performed at the University of Illinois on Sand M sections. ANSl/AISC N690-1994(R2004), American National Standard Specification for the Design, Fabrication, and Erection of Steel Safety-Related Structures for Nuclear Facilities, specifies an allowable ductility factor of 20 for closed sections and a reduced allowable ductility factor of 12.5 is specified for open cross-section flexural members (W, S, WT, etc.).

For a ductility factor of 20 with respect to the strain at yield (0.00124), an allowable strain of 0.0248, or approximately 2.5% is determined, and for a ductility factor of 12.5 relative to the strain at yield, an allowable strain of 0.0155, or approximately 1.5%, is computed. Therefore, the allowable strain limit of 1.5% is considered acceptable for demonstrating that structural integrity of the truss structures' top and bottom chords is maintained.

Response to RAI-20.b.ii The 1.5% strain acceptance criterion is slightly larger than the strain value (1.4%) at which strain-hardening begins, based on the stress-strain curve shown in 1100060-RPT-002 for Page 53 of 54

ASTM A36 steel using minimum material properties. The region where strain hardening occurs, i.e., strains between 1.4% and 12% (strain at minimum tensile strength), is considered additional margin and ensures an acceptable performance of the trusses under extreme loading conditions. (The maximum calculated strain limit in the analyses supporting the LAR submittal was 1.22%, which was determined in the seismic analysis of the Unit 2 truss structure, calculation 1100060-C-025, Seismic Evaluation of Unit 2 Containment Dome Trusses in Support of Risk Informed LAR.)

Additionally, typical material strength of steel members exceeds the minimum properties provided, which provides additional design margin (see discussion in RAl-13.b).

Page 54 of 54

ENCLOSURE 2 PBN-BFJR-17-019, REVISION 1 POINT BEACH UNITS 1 & 2 CONSTRUCTION TRUSS PRA EVALUATION (163 pages follow)

PBN-BFJR-17-019 Rev. 1

1.0 INTRODUCTION

.................................................................................................................................................... 4

1.1 BACKGROUND

......................................................................................................................................................... 4 1.2

SUMMARY

OF ISSUES EVALUATED .......................................................................................................................... 5 1.3 RISK ACCEPTANCE GUIDELINES ............................................................................................................................... 6 1.4 TOTAL PLANT CDF ................................................................................................................................................... 6 1.5 PRA MODEL SCOPE ................................................................................................................................................. 7 1.5.1 BOUNDING ANALYSIS ......................................................................................................................................... 7 1.5.2 DEMONSTRABLY CONSERVATIVE ANALYSIS ....................................................................................................... 7 1.6 RESULTS

SUMMARY

................................................................................................................................................ 9 1.6.1 SEISMIC RISK ....................................................................................................................................................... 9 1.6.2 THERMAL RISK .................................................................................................................................................... 9 1.6.3 TOTAL RISK ......................................................................................................................................................... 9 2.0 BOUNDING ANALYSIS ......................................................................................................................................... 10 2.1 INPUTS AND ASSUMPTIONS.................................................................................................................................. 10 2.1.1 CT OVERSTRESS IS ASSUMED TO RESULT IN CORE DAMAGE. .......................................................................... 10 2.1.2 TARGETS LEADING TO CORE DAMAGE ARE DIFFERENT THAN THOSE LEADING TO LARGE EARLY RELEASE. .. 10 2.1.3 RATIO OF [LARGE EARLY RELEASE]/[CORE DAMAGE] TARGET EXPOSURE IS 0.50. .......................................... 11 2.1.4 FAILURE OF SSCS INDEPENDENT OF CT FAILURES ............................................................................................ 14 2.2 SEISMIC ANALYSIS ................................................................................................................................................. 23 2.2.1 SEISMIC HAZARD .............................................................................................................................................. 23 2.2.2 SEISMIC FRAGILITY ANALYSIS ........................................................................................................................... 24 2.2.3 SEISMIC BOUNDING ANALYSIS........................................................................................................................... 25 2.2.4 INTEGRATION OF GI-199 AND BOUNDING CT RESULTS ................................................................................... 26 2.3 THERMAL BOUNDING ANALYSIS ........................................................................................................................... 29 2.3.1 THERMAL CONSTRUCTION TRUSS FRAGILITY ....................................................................................................... 29 2.3.2 THERMAL INITIATING EVENT FREQUENCY ............................................................................................................ 30 2.3.2.1 STEAM LINE BREAK INSIDE CONTAINMENT (SBIC)....................................................................................... 30 2.3.2.2 LOCA ............................................................................................................................................................. 30 2.3.2.3 FEED LINE BREAK INSIDE CONTAINMENT (FBIC) .......................................................................................... 30 2.3.2.4 THERMAL INITIATING EVENT FAULT TREE ................................................................................................... 31 2.3.3 INPUTS AND ASSUMPTIONS.................................................................................................................................. 31 2.3.4 MITIGATING SYSTEMS........................................................................................................................................... 32 2.3.5 THERMAL PRA MODEL .......................................................................................................................................... 34 3.0 TOTAL RISK - BOUNDING CASE........................................................................................................................... 36 4.0 QUALITATIVE FACTORS....................................................................................................................................... 37 5.0 DEMONSTRABLY CONSERVATIVE ANALYSIS ....................................................................................................... 38 5.1

SUMMARY

OF TARGET ASSESSMENT INSIGHTS .................................................................................................... 39 5.2 SEISMIC DEMONSTRABLY CONSERVATIVE ............................................................................................................ 41 5.3 DEMONSTRABLY CONSERVATIVE THERMAL CASE ................................................................................................ 42 6.0 DEMONSTRABLY CONSERVATIVE TOTAL RISK .................................................................................................... 44 7.0 SHUTDOWN RISK ................................................................................................................................................ 45 8.0 PRA QUALITY ...................................................................................................................................................... 46 8.1 BOUNDING ANALYSIS............................................................................................................................................ 46 8.2 DEMONSTRABLY CONSERVATIVE ANALYSIS (DCA) ............................................................................................... 46 9.0 UNCERTAINTIES .................................................................................................................................................. 47 9.1 PARAMETER UNCERTAINTY .................................................................................................................................. 47 9.2 COMPLETENESS UNCERTAINTY............................................................................................................................. 51 9.3 MODEL UNCERTAINTY .......................................................................................................................................... 55 9.4 IPEEE UNCERTAINTY ANALYSIS .............................................................................................................................. 60

10.0 REFERENCES

....................................................................................................................................................... 63 ATTACHMENT A OPEN FINDINGS ................................................................................................................................. 64 2 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT B HUMAN RELIABILITY ANALYSIS (HRA) ............................................................................................... 69

2.0 PURPOSE

.................................................................................................................................................................... 69 3.0 EVALUATION ................................................................................................................................................................ 69 3.1 DETERMINATION OF HEPS TO BE EVALUATED ....................................................................................................... 69 3.2 SCREENING OF HEPS ............................................................................................................................................... 72 3.3 SCREENED HEPS SET TO TRUE ................................................................................................................................ 74 3.4 CONSTRUCTION TRUSS HEPS .................................................................................................................................. 74

4.0 CONCLUSION

.............................................................................................................................................................. 75

5.0 REFERENCES

............................................................................................................................................................... 75 ATTACHMENT C ASME/RG 1.200 PRA QUALITY SUPPORTING REQUIREMENTS ............................................................ 76 ATTACHMENT D EPRI FRANX 4.3 HAZARD EDITOR OUTPUT ......................................................................................... 84 ATTACHMENT E CONSTRUCTION TRUSS THERMAL MODEL DEVELOPMENT ................................................................. 86 ATTACHMENT F DEMONSTRABLY CONSERVATIVE SEISMIC PRA MODEL DEVELOPMENT ........................................... 110 F.1 SEISMIC CT MODEL ..................................................................................................................................................... 111 F.2 QUANTIFICATION ....................................................................................................................................................... 111 F.3 FRAGILITIES ................................................................................................................................................................ 112 F.4 EVENT TREE ................................................................................................................................................................ 117 F.5 TOP EVENTS ................................................................................................................................................................ 119 F.6 SEQUENCE DESCRIPTIONS .......................................................................................................................................... 122 F.7 REVIEW OF TOP EVENTS USED IN THE POINT BEACH SEISMIC IPEEE PRA ................................................................... 125 F.8 RESULTS ...................................................................................................................................................................... 131 F.9 CUTSETS ..................................................................................................................................................................... 132 F.10 IMPORTANCES .......................................................................................................................................................... 138 F.11 INSIGHTS .................................................................................................................................................................. 146 TTACHMENT G TARGET DAMAGE PROBABILITY .......................................................................................................... 147 G.1 INPUTS AND ASSUMPTIONS ...................................................................................................................................... 147 G.2 ASSESSMENT OF MSL A BREAK PROBABILITY ......................................................................................................... 148 G.3 ASSESSMENT OF MSL B BREAK PROBABILITY ............................................................................................................. 151 G.4 ASSESSMENT OF AFW A/B DAMAGE PROBABILITY .................................................................................................... 155 G.5 IN-CORE INSTRUMENTATION SEAL TABLE ................................................................................................................. 158 ATTACHMENT H EXTERNAL HAZARDS SCREENING ...................................................................................................... 161 3 of 163

PBN-BFJR-17-019 Rev. 1

1.0 INTRODUCTION

This evaluation supports a risk informed license amendment request (LAR) that demonstrates the Point Beach Unit 1 and Unit 2 Construction Truss (CT) configurations meet the requirements of Regulatory Guide (RG) 1.1741 which allows for plant changes as long as the increase in CDF and LERF is small. This evaluation also demonstrates that the configuration remains consistent with the defense-in-depth philosophy and maintains adequate safety margins. The information provided in this evaluation also meets the requirements of RG 1.1772 for risk-informed LARs and documents conformance to the technical standards outlined in RG 1.2003.

1.1 BACKGROUND

The current CT configuration does not conform to the design criteria for seismic or thermal events. The CT is a legacy structure originally used to support the containment dome during its construction but is no longer required to support the containment dome and is no longer in contact with it. The CT is used to support the safety related containment spray (CS) ring headers, post-accident containment ventilation (PVAC) system, a portion of the containment ventilation ductwork (VNCC) and other, non-safety related, equipment such as lighting and miscellaneous conduit.

Key CT design and configuration issues:

The CT and the CS piping and supports do not meet original design code criteria for design basis earthquake and thermal4 transients.

Some clearances between the CT and containment liner are smaller than desired and may not prevent overstress due to contact with the liner resulting from thermal expansion under Design Basis Accident (DBA) temperatures.

Reference 15 describes the technical issues of the structural non-conformances relating to the CT and attached components.

BASIS FOR OPERABILITY:

SEISMIC Prompt operability determination (POD) 02131629-02 concluded that the Unit 1 and Unit 2 CT will remain stable and will not experience a catastrophic failure. from a ground motion response spectra (Housner) based seismic event.

THERMAL Unit 1: POD 01962836-01 concluded that the Unit 1 CT, while non-conforming to the design code of record, would maintain integrity and supported components remained acceptable for the design 1

REGULATORY GUIDE 1.174, Revision 3, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant Specific Changes to the Licensing Basis.

2 RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications."

3 RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities."

4 CT does not meet original design code criteria for thermal, however CS piping and supports are acceptable for thermal load.

4 of 163

PBN-BFJR-17-019 Rev. 1 basis thermal loading. Applied loads resulting in plastic strain develop but overall integrity is maintained and liner is not breached. Therefore containment integrity is maintained, and the containment spray piping remains acceptable.

Unit 2: POD 01986553-01 concluded that the configuration for Unit 2 CT was bounded by the configuration of the U1 CT, and the CT, while non-conforming to the design code of record, would maintain integrity and supported components remained acceptable for the design basis thermal loading. Containment integrity is maintained, and the containment spray piping remains acceptable.

CT MODIFICATION Trimming is needed at several Unit 1 CT top chord first panel point locations to reduce the contact load between the CT and containment liner during a DBA thermal condition and to reduce stresses in truss components.

The proposed scope of modifications consists of trimming the upper chord of six (6) individual trusses in Unit 1 (at the first panel point above the truss support) and no modifications to the Unit 2 truss structure. The trimming will consist of:

Removal of a portion of the flange and web for five (5) trusses. From the panel point, the flange will be removed (in its entirety) back no more than 6 in either direction. The web will be trimmed away from the containment liner no more than 2 in the horizontal direction with the maximum web trim at the panel point, reducing back to the location where the flange was removed. The total portion to be removed (flange and web) will be a triangular shaped piece. A new plate will then be welded to replace the flange that was removed.

For the remaining truss, the outer face of the flange will be trimmed by removing a portion of each end of the flange adjacent to the containment liner.

Details of the proposed modification to the Unit 1 trusses are contained within Attachment H of calculation 11Q0060-C-022 [Reference 12a].

PORV Modification This evaluation assumes that all PORV components will survive a postulated CT failure.

Basis: A new modification is being initiated to reroute the PORV control cables for 2RC-515 and 2RC-431C to ensure they are protected from a postulated falling object, consistent with the assessment for other SSCs in the target assessment that supports this PRA evaluation. This new modification will be implemented during the spring 2020 Unit 2 refueling outage.

1.2

SUMMARY

OF ISSUES EVALUATED This evaluation provides quantitative and qualitative risk insights for the following issues:

SEISMIC. The CT is assumed to be within normal operating temperature (below 120 F) prior to the seismic event. CT overstress is assumed to occur at the initiation of the seismic event, at T=0. Sections 2.2 and 5.2 evaluate seismic risk.

5 of 163

PBN-BFJR-17-019 Rev. 1 THERMAL. The CT overstress due to thermal growth occurs sometime after the thermal transient initiating event, at T > 0. Sections 2.3 and 5.3 evaluate the thermal events that can initiate this challenge.

1.3 RISK ACCEPTANCE GUIDELINES CT risk has been evaluated against guidelines from RG 1.1745 which allows licensing basis plant changes as long as the increase in risk (CDF and LERF) is small. RG 1.174 Figures 4 and 5 illustrate the acceptance guidelines. A CDF between 1E-6 and 1E-5 per year is acceptable if the total plant CDF for all hazards does not equal or exceed 1E-4. LERF acceptance is an order of magnitude less.

NRC RG 1.174 FIGURE 4 NRC RG 1.174 FIGURE 5 TOTAL CDF - ALL HAZARDS TOTAL LERF - ALL HAZARDS 1.4 TOTAL PLANT CDF The Point Beach ALL-HAZARDS risk establishes the baseline risk metric for CDF and LERF along the x-axis of RG 1.174 figures 4 and 5 respectively. The following table summarizes the Point Beach ALL-HAZARDS risk [Ref 19].

Table 1: Point Beach ALL HAZARDS PRA Results HAZARD CDF (1/Rx Yr) LERF (1/Rx Yr)

Reference Model Quality Unit 1 Unit 2 Unit 1 Unit 2 Internal Events Peer reviewed plant-specific 5.1E-06 5.1E-06 3.7E-08 3.6E-08 model RG 1.200 Rev 2 at Power Internal Floods Peer reviewed plant-specific 3E-07 3E-07 2E-08 2E-08 model RG 1.200 Rev 2 at Power Internal Fire Peer reviewed plant-specific 5.9E-05 6.9E-05 9.0E-07 1.1E-06 model RG 1.200 Rev 2 at Power Seismic 6.24E-06 6.24E-06 1.21E-06 1.21E-06 IPEEE updated with GMRS IPEEE at Power Other Hazards <1E-06 <1E-06 <1E-07 <1E-07 Screened during IPEEE IPEEE TOTAL 7.2E-05 8.2E-05 2.3E-06 2.5E-06 Note: No modifications have been made to the associated PRA model since their respective peer reviews that are considered "upgrades.

The ALL HAZARD CDF totals for both units are below 1E-4 and thereby establish CDF <1E-5 as the x-axis location on RG 1.174 figure 4. The LERF totals are less than 1E-5 and thereby establish LERF <1E-6 as the x-axis location on RG 1.174 figure 5.

5 RG 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant Specific Changes To The Licensing Basis.

6 of 163

PBN-BFJR-17-019 Rev. 1 1.5 PRA MODEL SCOPE The two types of evaluations used in this evaluation are:

Bounding PRA Demonstrably conservative analysis 1.5.1 BOUNDING ANALYSIS The bounding analysis assumes CT overstress always generates debris missiles that lead to core damage; conditional core damage probability (CCDP) is assumed to be 1.0.

CT missiles causing core damage are different than those resulting in large early release. Also, the population of missiles leading to large early release is less than those leading to core damage. However, the subset of missiles that do strike penetrations are assumed to directly lead to a large early release, i.e. CLERP = 1.0.

The bounding LERF calculation also includes independent failures that could affect containment integrity. For example, containment isolation (CI) failures due to a seismic event leading to CI support system failures not attributed to CT overstress. Basis and evaluation is provided in Section 2.1.4.1.

Key attributes of the bounding analysis:

CCDP = 1.0, conditional on CT overstress.

Based solely on site specific seismic, thermal hazard, and CT fragility data.

Provides an upper limit of the risk metrics that inherently include the worst credible outcome of all known possible outcomes of a CT overstress.

Addresses all known uncertainties and is bounding in terms of the potential and likelihood of outcome.

Consistent with RG 1.174 which states that a PRA should include a full understanding of the impacts of the uncertainties through either a formal quantitative analysis or a simple bounding or sensitivity analyses.

A variation of this case is quantified by integrating the GI-199 seismic plant hazard and fragility data with the seismic bounding results. Section 2.1.4 describes the method used and results.

1.5.2 DEMONSTRABLY CONSERVATIVE ANALYSIS To understand the contributors to risk and a more robust understanding of risk insights a demonstrably conservative analysis was developed using a limited scope PRA. This analysis uses assumptions such that the assessed outcome will be conservative relative to the expected outcome.

This analysis assumes it is unlikely that a CT collapse will always lead to core damage. The analysis credits mitigating functions and CT missile damage probabilities less than 1.0. However, the bounding assumption that the CT will generate debris if overstressed is retained.

7 of 163

PBN-BFJR-17-019 Rev. 1 Note that the engineering calculations determined that the construction trusses will retain their structural stability and will not catastrophically fail or result in a seismic II/I interaction (dropped object) as a result of a design basis seismic or thermal event.

For this assessment the following aspects of a CT failure and its consequences were studied:

How the CT fails when overstressed Trajectory of components from the failed CT Vulnerability of risk significant components to falling CT debris Location and robustness of the barriers that would protect critical components from the falling CT debris.

The results of this assessment [Ref 3] identified systems, structures, and components (SSCs) that are likely to survive a CT failure and operator actions that remain viable under seismic or thermal transients that overstress the CT. Although this analysis is more realistic than the bounding analysis, conservative assumptions were applied to assure key uncertainties are addressed or bounded. Some of the key assumptions include the following:

The CT structure is always assumed to immediately generate falling debris when overstressed.

CT debris targeting critical SSCs is assumed to be oriented in a way that maximizes damage to targeted SSCs.

Performance shaping factors, factors affecting operator actions, were increased to address additional stress and concurrent critical actions that would reduce the reliability of operator actions.

Section 2.1 provides a comprehensive list of inputs and assumptions.

Seismic and thermal events are evaluated separately.

8 of 163

PBN-BFJR-17-019 Rev. 1 1.6 RESULTS

SUMMARY

The results of the bounding and demonstrably conservative analysis show that the modified Unit 1 CT and existing Unit 2 CT CDF and LERF are within the RG 1.174 guidelines. Results bound both units.

1.6.1 SEISMIC RISK The seismic risk is acceptable based on Region II guidelines for both units for Case 1a and 1b. Case 1c meets the more restrictive RG 1.174 Region III guidance, CDF <1E-6 and LERF <1E-7.

Case CDF LERF 1a Seismic Bounding Analysis [section 2.2.3] 2.69E-06 7.16E-07 1b Seismic Bounding integrated with Seismic GI-199 [section 2.2.4] 1.88E-06 7.31E-07 Seismic Demonstrably Conservative 1c 2.17E-07 5.19E-08

[the higher Unit 2 value is listed - section 5.2]

1.6.2 THERMAL RISK The thermal bounding and demonstrably conservative cases meet the more restrictive RG 1.174 Region III guidance.

Case CDF LERF 2 Thermal Bounding [section 2.3.5.1] 4.83E-08 2.42E-08 3 Thermal Demonstrably Conservative [section 5.3] 1.48E-09 7.40E-10 1.6.3 TOTAL RISK Total risk is acceptable based on Region II guidance for both units for the bounding case. The demonstrably conservative case meets the more restrictive RG 1.174 Region III guidance.

Case CDF LERF Seismic Bounding integrated with Seismic GI-199 + Thermal 1.93E-06 7.55E-07 Bounding , Cases 1b + 2 Seismic + Thermal Demonstrably Conservative [Case 1c + 3] 2.19E-07 5.26E-08 Adding the CDF and LERF values in the table above to the ALL HAZARDS total (table 1) will not change the RG 1.174 region applicable to this evaluation.

9 of 163

PBN-BFJR-17-019 Rev. 1 2.0 BOUNDING ANALYSIS This section provides the assumptions, methods, results and sensitivity analyses used to perform the bounding analysis described in section 1.6.1.

2.1 INPUTS and ASSUMPTIONS 2.1.1 CT overstress is assumed to result in core damage.

To bound uncertainties associated with the potential and likelihood of outcome associated with CT overstress, conditional core damage probability, CCDP, is set to 1.0. CDF is calculated as follows:

[Point Beach Seismic Hazard Frequency x CT Fragility] x CCDP = Core Damage Frequency CT overstress is postulated to immediately generate falling debris which targets SSCs below which are then damaged and lead to core damage.

2.1.2 Targets leading to core damage are different than those leading to large early release.

The CT structure covers the entire containment interior planar area and is above all equipment in the containment volume. If the CT is overstressed and postulated to generate falling debris missiles, the population of missiles directed to targets leading to core damage will be different from those leading to large early release.

The basis for assuming different probabilities for each of these two target categories is based on the following inputs.

a) Targets that could potentially lead to core damage are located and distributed throughout the containment volume.

b) Targets that could lead to a large early release are limited to containment penetrations located on the periphery of the containment wall. Refer to figure 3.

c) Perforation6 of the containment liner is unlikely, penetration is possible7. The liner is 1/4" plate steel placed against the containment concrete wall. Deformation (puncture) of the shell will push against the concrete which will be crushed, absorb energy, and reduce the likelihood of perforation. In the event the shell is perforated the release pathway will be blocked by the intact concrete containment structure.

d) The reinforced concrete containment structure will not be perforated by falling CT debris. It is a robust barrier that has a nominal wall thickness of 3 ft. 6 in. (FSAR Section 5.1.2.1). Moreover, it is unlikely the structure will be hit since the CT debris trajectories will likely be parallel to the vertical surface of the containment structure precluding a highly energetic impact of a truss normal8 to the surface. If deflected, debris energy will be reduced and contact with a target less consequential. Still, if the largest postulated debris missile, a 6000 lb. truss, falls unobstructed from 100 feet and strikes the containment wall in a normal orientation, and is aligned with the smallest missile contact area (transferring maximum energy), the 3 ft.

6in. containment wall will not be perforated based on application of the concrete perforation equation in section 3.2.1.2 of BC-TOP-9-A, Revision 2,.

6 As applied in BC-TOP-9A, Design of Structures for Missile Impact, Perforation is defined as a missile striking an object and then passing through it. Penetration is defined as a missile striking an object and entering or distorting the surface but not passing through.

7 Structural calculations [Ref 12] evaluate the CT interaction with the liner and conclude that under certain assumptions and seismic conditions the liner allowable stress may be exceeded.

8 Perpendicular to the tangent plane of the target 10 of 163

PBN-BFJR-17-019 Rev. 1 These inputs are used to develop a Target Exposure Ratio for core damage targets versus large early release targets in the following section, 2.1.3.

2.1.3 Ratio of [Large Early Release]/[Core Damage] Target Exposure is 0.50.

The SSCs supporting the inside containment isolation function are potential targets of falling CT debris. The containment function is also susceptible to failure of SSCs independent of CT failure, and operator error; these failure modes are discussed in sections 2.1.4.1 and 2.1.4.3 respectively.

It is reasonable to assume a LERF related inside containment target exposure that is less than that assumed for core damage since containment penetrations are segregated into a smaller containment planar area and volume as compared to targets that can lead to core damage. A reasonable bounding ratio of 0.50 can be justified based on these inputs:

1. Containment penetrations are grouped in columnar sections of the containment wall that span < 33% of the containment circumference. This grouping is illustrated in figure 3; the area bounded by the red rectangle.

2. Containment penetration barriers extend inward a few feet from the containment wall and as such have a minimal exposure to falling CT debris. Also, due to the way the truss is supported, at its circumference, falling debris will tend to fall away from the containment wall and avoid striking these penetrations. In addition, barriers in the direct path of debris that may target these penetrations will deflect the debris or absorb energy and thereby reduce the energy transferred to the target, i.e. minimize damage. These factors are considered in the uncertainty analysis in section 9.1.3.4.

3. Penetrations below the 66 elevation are unlikely to be damaged by falling debris because they are protected by the floor and other robust barriers above this elevation. There are only a few penetrations above the 66 elevation, taking this into account reduces their effective exposed area to much less than 10%;

refer to blue shaded region in figure 3. To address uncertainties a bounding CLERP of 0.50, versus a conservative value of 0.10, is assumed to represent this smaller target area.

4. Penetrations are robust and/or their failures are not consequential. There are 7 penetrations above the 66 elevation:

i. Two Main Steam Line Penetrations. MSL containment penetrations are a conical steel pyramid seal that surrounds the 30 inch MSL lines; refer to figure 3. These seals are installed inside the containment structure only and welded to the containment liner. This seal is fabricated from 1 thick steel plates that are welded together and located at EL 88. It is unlikely that these penetrations would be perforated by falling CT debris [Ref 3].

Because of its location, tight along the containment wall, it is unlikely these penetrations will be struck by a truss which will tend to fall away from the containment wall. To just perforate this penetration, the penetration must be directly hit by the heaviest CT component, a 6000 lbs. T1 truss, striking the conical barrier at a normal orientation and in a way that maximizes energy transfer (smallest contact area). Also, the truss trajectory would have to be unobstructed by barriers (which would absorb energy from the falling truss). The ~1 thick main steam line is similarly robust and in the unlikely event it is perforated the release pathway will be isolated outside containment - refer to FSAR figure 5.2-1 below. Also the release path outside containment is blocked by the main steam isolation valve located outside containment.

Perforation and penetration calculations are available in the CT Truss Target notebook [Ref 3].

11 of 163

PBN-BFJR-17-019 Rev. 1 ii. Two Main Steam Vent Line Penetrations. The main steam vent line penetrations P57 and P58 are the located at El 88. They are small targets and unlikely to be hit. If hit the outside containment isolation valve will block the release path outside containment. However the vent lines are fragile and will likely be damaged by falling CT debris.

Main Steam Vent Lines and have a diameter of 11/2 inches with a wall thickness of 0.218 inches. The lines are located at 105 FT EL, above the main steam lines. These vent lines follow the length of, and above, the Main Steam Lines and thereby have a significant exposure to falling CT debris. This piping is normally isolated outside containment by valves MS-223(A) and MS-248(B). Inside containment isolation valves MS-211 and MS-212 are locked open (Reference FSAR Figures 5.2-57 and 5.2-58; and CL 13A, MS Valve Lineup Unit 1) and as such are pressurized. Vent lines are only fully open during start-up.

iii. One Personnel Hatch. This hatch has a robust cover and seal inside and outside containment and in the unlikely event the inside cover is perforated the outside cover will block the release pathway.

iv. Containment Vent Purge Supply and Exhaust. Containment Vent Purge Supply and Exhaust (penetrations V-1 and V-2 are at El 98) system is not normally operating during power operation; there is a normally closed valve outside and the inside is blank flanged. These penetrations are always isolated with the Blind Flange installed during Mode 4 to Mode 1, Reference FSAR Figures 5.2-V1 and 5.2-V2. The valve that hangs off each of the flanges (VNPSE-60 & 61) is protected by the crane rail and not large enough to cause 12 of 163

PBN-BFJR-17-019 Rev. 1 a large early release. While the containment vent supply and exhaust ducts are not rigid, the structural designs of their containment penetrations are robust and will remain leak-tight in the event of truss impact. The penetrations, themselves, are heavy-section welded steel inserts with bolted flange connections (photo below) giving them a high level of strength, stiffness, and ductility. In addition, as these penetrations are located relatively high in the containment, have minimal protrusion, and are shielded by the polar crane ring girder, they are unlikely to be subjected to direct impact.

CONTAINMENT PENETRATIONS Main Steam Line and Vent Penetrations (2)

(Typical construction for feedwater)

Containment purge supply and exhaust 66Elevation Floor Personnel Hatch Figure 3 13 of 163

PBN-BFJR-17-019 Rev. 1 2.1.4 FAILURE OF SSCS INDEPENDENT OF CT FAILURES Failure of SSCs independent of CT failures affects the calculation of CDF, LERF, CDF and LERF associated with the CT. The following sections provide the method for integrating independent failures with CT failures.

Treatment of seismic failures and thermal related failures are evaluated separately.

2.1.4.1 INTEGRATION OF INDEPENDENT SSCS - SEISMIC During a CT seismic overstress failure event, other SSCs independent of the CT failure can also fail and lead to core damage. Integrating these concurrent failures will result in CDF and LERF values that are higher and more realistic than those considering CT failure only. However the CT CDF will decrease since the independent SSC failures leading to core damage will partially overshadow the CT CDF impact. For example, as SSC CDF contribution increases to 1.0 the CT CDF will decrease to 0; if the independent SSCs always lead to core damage, the CT core damage will not have an effect on increased CDF; core damage probability cannot be greater than 1.0. This relationship is illustrated by the logic shown in figure 4 and described by equations 1 through 5 below.

CONSTRUCTION TRUSS SEISM IC CDF INTEGRA TED WITH INDEP ENDENT P LA NT SEISM IC CDF CDF_CT+INDEP ENDENT CONSTRUCTION TRUSS SEISM IC CDF INDEP ENDENT P LA NT SEISM IC CDF CT_CDF INDEP ENDENT_SSC_CDF Figure 4 Equation 1

( ) = () + () ( )

Equation 2 Expanding using Boolean logic:

( ) ( )

Expanding equation using arithmetic operators:

[ ( ) () ( ) ()]

[ ( ) () ( ) ()]

Equation 3 Equation 2 can be rewritten as:

( ) ( ) () [ ( )

( )]

Since ( ) ( ) =

Then ()

14 of 163

PBN-BFJR-17-019 Rev. 1 As () 1 then zero, As () zero then will be equal to CDFCT ( the value for CDF without considering SSC failures)

Conclusion:

Independent SSC failures reduce when they are considered jointly with CT failures.

In contrast to CDF, Including the independent SSCs will result in a LERF greater than that calculated for the CT failure alone; refer to equation 4. The probability that the independent SSCs can result in a containment breach must be considered otherwise the result will be non-conservative as shown by equations 4 and 5.

LERF LERF_CT_IP EEE Co ntaiment Fragility - Co nstructio n CDF Co nstructio n Truss and IP EEE Truss and IP EEE CONT_FRA G CDF_CT_IP EEE Co nstructio n Truss Co ntaiment IP EEE Co ntainment Iso latio n Fragility Fragility CT_CONT_FRA G IP EEE_CONT_FRA G Figure 5 Equation 4

[(( ) ( )]

[(( ) ( )]

Equation 5 Expanded equation:

[(( ) + ( ) (( )

( )] [(( ) + ( ) (( )

( )]

As SSCbreach approaches 1, LERF approaches CDFCT+SSC, or Equation 2:

[(( ) + ) (( ) )]

[(( ) + ) (( ) )]

Which reduces down to Equation 2:

[()] [()] = =

As SSCbreach approaches 0, LERF approaches the LERF associated with CT failure only:

[(( ) + ) ] [(( ) +

) ]

15 of 163

PBN-BFJR-17-019 Rev. 1

= ( ) ( )

Conclusion:

Including containment fragilities associated with independent SSC seismic failures in the assessment of LERF is realistic. Omitting these failures leads to non-conservative results for LERF; therefore independent failures leading to containment failure must be included in the bounding analysis.

Equations 1 through 5 show that accurate assessment of CDF and LERF must consider independent SSC failure impacts. For the bounding case, the plant fragility and containment isolation fragility will be integrated with the CT core damage and large early release assessment, respectively.

CORE DAMAGE - INDEPENDENT SSC SEISMIC IMPACT The independent SSC seismic core damage impact, (p(SSC) in equation 1, is based on the plant seismic fragility calculated in PBN-BFJR-14-013, Revision 0 [Ref 20]. The plant-level seismic fragility curve is derived from the High Confidence of Low Probability of Failure (HCLPF) documented in the NRC GI-199 safety/risk assessment. The PBN-specific HCLPF of 0.16g is calculated using the plant-level fragility data in Table C-2 of Appendix C of the NRC GI-199 safety/risk evaluation. The GI-199 safety/risk evaluation assumes a composite variability, , of 0.45. This is the same data used to calculate CT damage probability, or CDF in the bounding case [section 2.2.3].

As the HCLPF capacity is approximately defined as 1% of the conditional probability of failure on the mean fragility curve: the relationship between HCLPF and the median capacity (Am, or C50 in Table C-2 of Appendix C of the NRC GI-199 safety/risk evaluation) is described by the following equation:

c HCLPF = Am e-2.33 Plant Fragility Curve Data GI-199, Appendix C, Table C-2 HCLPF 0.16 c 0.45 Am 0.45 The median capacity evaluated with equation (1) is therefore 0.45 g. The median capacity and the composite variability can be then used to generate a fragility curve, using the following equation.

( )

() = (

)

Where: is the standard Gaussian cumulative distribution.

This equation yields the estimated plant-level fragility curve plotted in Figure 6 and the values listed in Table 3.

The GI-199 Point Beach plant fragility data are based on Am=0.45g, and C=0.45. The Point Beach IPEEE is based on Am=0.45g, and C=0.40 [Ref 16, section 3.1.5.3]. The results of both are plotted in Figure 6 and their values listed in Table 3. The IPEEE plant fragility is derived from a quantification 16 of 163

PBN-BFJR-17-019 Rev. 1 of the IPEEE seismic systems logic model, component seismic fragility data, random failure probabilities, and human error probabilities. The two curves are similar, however the IPEEE data has a lower fragility for seismic bins %G01 through %G04. The GI-199 plant fragility curve will be used in this evaluation.

Point Beach Seismic Plant-Level Fragility 1.0 Conditional Probability of Failure 0.9 0.8 0.7 0.6 IPEEE 0.5 GI-199 0.4 0.3 0.2 0.1 0.0 0 0.2 0.4 0.6 0.8 1 1.2 1.4 Peak Ground Acceleration (g)

Figure 6 - PBN Plant-Level Seismic Fragility Curves TABLE 3: Point Beach Plant-Level Fragility Data Bin Bin Bin GI-199 IPEEE ID PGA Range PGA Midpoint Plant Fragility Plant Fragility

%G01 0.05g to <0.12g 0.0775 4.64E-05 5.48E-06

%G02 0.12g to <0.23g 0.1661 1.34E-02 6.36E-03

%G03 0.23g to <0.34g 0.2796 1.45E-01 1.17E-01

%G04 0.34g to <0.45g 0.3912 3.78E-01 3.63E-01

%G05 0.45g to <0.56g 0.5020 5.96E-01 6.08E-01

%G06 0.56g to <0.67g 0.6125 7.53E-01 7.80E-01

%G07 0.67g to <0.78g 0.7229 8.54E-01 8.82E-01

%G08 0.78g to <0.89g 0.8332 9.14E-01 9.38E-01

%G09 0.89g to <1g 0.9434 9.50E-01 9.68E-01

%G10 >1g 1.1 9.76E-01 9.87E-01 CONTAINMENT FRAGILITY- INDEPENDENT SSC SEISMIC IMPACT [

Reference:

Point Beach IPEEE Section 3.0]

As shown by Equation 5, to avoid underestimating LERF, SSC failures that can result in loss of containment independent of CT failures must be included in the assessment of LERF. The dominant LERF contributor in the Point Beach Seismic IPEEE is containment isolation which is represented in the IPEEE model as top event CIS (Containment Isolation System). The IPEEE states:

A review of Table 4.7-4 of the Point Beach IPE indicates that only bypass sequences and sequences involving containment isolation failure will meet this Large, Early Release condition. Table 3.1.6-1 provides a summary of sequences that result in early containment failure with significant release.

17 of 163

PBN-BFJR-17-019 Rev. 1 Other SSCs that can lead to containment failure were screened out in the IPEEE. Refer to table 3.1.3-7 in the IPEEE.

The IPEEE CIS top event represents successful containment isolation after a seismic initiating event. CIS failure is represented by a fault tree which models key seismic sensitive components and actions needed to isolate the RCS and containment atmosphere from the environment.

With the exception of the MS and FW penetrations, systems which could become connected to the RCS or containment atmosphere as a result of, or subsequent to, the event are isolated. To achieve isolation, at least two barriers are provided between the RCS or containment atmosphere and the environment. System design is such that no manual action is required for immediate isolation with the exception of the MS and FW penetrations which provide only one, but very robust, barrier between the containment atmosphere and the environment as described in section 2.1.3.

The IPEEE Seismic-induced CIS failure includes:

1) Seismic failure of Block Walls 5-5/2A and 5-29/2A (which fail containment isolation pressure transmitters 1PT-947/948 and 2PT-947/948 respectively)

2) Seismic failure of radiation monitor 1 sample line isolation valves RM A0V-3200A and B.

3) Operator action to manually initiate containment isolation.

The following CAFTA [Ref 21] fault tree reproduces the CIS failures develop in IPEEE [Ref 16]

Appendix B page 6 of 29:

CIS Failure - Seismic CIS CI Instrumentation Failure - Seismic RM Containment Valves Failure -

Seimic CIS-INSTRUMETATION RM-CONTAINMENT-VALVES Containment Isolation Failure to Manually Initiate RM AOV-3200A Failure - Seismic RM AOV-3200B Failure - Seismic Instrumentation Fails to Auto Isolate Containment Isolation

- Seismic CONT-ISOLATION-INSTRUMENTION OP-INITIATE-CONT-ISOLATION RM-AOV-EQ-3200A RM-AOV-EQ-3200B Seismic Failure of Block Wall 5-5/2A Seismic Failure of Block Wall Fails 1PT-947 & 948 5-29/2A Fails 2PT-947 & 948 BLOCK_WALL_5-5/2A BLOCK_WALL_5-29/2A Figure 7 The data used to calculate CIS fragility was developed from IPEEE Am and c data for the basic events in the fault tree above [reference table 3.1.4-2, IPEEE]:

18 of 163

PBN-BFJR-17-019 Rev. 1 Am c RM-3200A/B 0.80 0.40 Block Wall 5-5/2A 0.75 0.40 Block Wall 29/2A 2.69 0.40 The value for the HEP basic event OP-INITIATE-CONT-ISOLATION is based on data from IPEEE table 3.1.3-12 [Ref 16] for Human Failure Event CI--EOP--FO-00024. BIN probabilities for basic event OP-INITIATE-CONT-ISOLATION are listed in the table below.

Operator Fails to Manually Initiate Containment Isolation BIN Seismic Initiator BIN Midpoint HEP

%G01 (0.05g to <0.12g) 0.0775 1.00E-02

%G02 (0.12g to <0.23g) 0.1661 2.28E-02

%G03 (0.23g to <0.34g) 0.2796 5.62E-02

%G04 (0.34g to <0.45g) 0.3912 8.44E-02

%G05 (0.45g to <0.56g) 0.502 1.00E-01

%G06 (0.56g to <0.67g) 0.6125 1.00E-01

%G07 (0.67g to <0.78g) 0.7229 1.00E-01

%G08 (0.78g to <0.89g) 0.8332 1.00E-01

%G09 (0.89g to <1g) 0.9434 1.00E-01

%G10 (>1g) 1.1 1.00E-01 The modifications completed after the IPEEE submittal include the following:

1 Check valve RM-3200AA which was added in series with RM-3200A [Ref FSAR Figure 5.2-X2].

Addition of an AOV RM-3200C which is in series with RM-3200B and is not damaged by a block wall falling. The valves which were added are very close to the 66 ft personnel air lock and a walkdown determined there is a low probability of failure given CT collapse.

The following is the post-IPEEE CIS fault tree reflecting these modifications:

CIS Failure - Seismic CIS CI Instrumentation Failure - Seismic RM Containment Valves Failure -

Seismic CIS-INSTRUMETATION RM-CONTAINMENT-VALVES Containment Isolation Failure to Manually Initiate RE-211/RE-212 MONITOR RETURN RE-211/RE-212 MONITOR SUPPLY Instrumentation Fails to Auto Isolate Containment Isolation - Seismic Not Isolated - Seismic Not Isolated - Seismic

- Seismic CONT-ISOLATION-INSTRUMENTION OP-INITIATE-CONT-ISOLATION RE-211/RE-212-RETURN RE-211/RE-212-SUPPLY Seismic Failure of Block Wall 5-5/2A Seismic Failure of Block Wall RM AOV-3200A Failure - Seismic RM AOV-3200AA Failure - Seismic RM AOV-3200B Failure - Seismic RM-AOV-3200C Failure - Seismic Fails 1PT-947 & 948 5-29/2A Fails 2PT-947 & 948 BLOCK_WALL_5-5/2A BLOCK_WALL_5-29/2A RM-AOV-3200A RM-AOV-3200AA RM-AOV-3200B RM-AOV-3200C Figure 8 19 of 163

PBN-BFJR-17-019 Rev. 1 Fragilities were calculated for the original CIS IPEEE fault tree and the post modification fault tree. Their respective faults trees were quantified for each BIN using the Direct Probability Calculator (DPC)9 quantification tool. The resulting fragilities listed in the table below show the safety margin improvements resulting from these modifications.

IPEEE CIS CIS with Mods BIN Seismic Initiator BIN Midpoint Probability Probability

%G01 (0.05g to <0.12g) 0.0775 5.42E-09 6.96E-11

%G02 (0.12g to <0.23g) 0.1661 8.68E-05 1.87E-06

%G03 (0.23g to <0.34g) 0.2796 8.95E-03 4.20E-04

%G04 (0.34g to <0.45g) 0.3912 7.64E-02 7.08E-03

%G05 (0.45g to <0.56g) 0.502 2.41E-01 4.49E-02

%G06 (0.56g to <0.67g) 0.6125 4.58E-01 1.50E-01

%G07 (0.67g to <0.78g) 0.7229 6.57E-01 3.27E-01

%G08 (0.78g to <0.89g) 0.8332 8.02E-01 5.29E-01

%G09 (0.89g to <1g) 0.9434 8.93E-01 7.04E-01

%G10 (>1g) 1.1 9.58E-01 8.67E-01 1.00 0.90 CIS FRAGILITIES 0.80 0.70 CIS - IPEEE Probability 0.60 0.50 0.40 0.30 CIS - MODS 0.20 0.10 0.00 0 0.2 0.4 0.6 0.8 1 1.2 Figure 9 Peak Ground Acceleration (g)

This evaluation will use the CIS with Mods fragility data.

9 Direct Probability Calculator' (DPC) is an EPRI tool for calculating an exact top event probability (or frequency) of a fault tree logic model without employing cutset-based methods. DPC is used to calculate the exact probability of the gates in most fault trees. This avoids problems inherent in quantifying fault tree via cutsets, including avoiding the rare-event approximation and the approximations associated with negated logic 20 of 163

PBN-BFJR-17-019 Rev. 1 2.1.4.2 THERMAL ANALYSIS - INDEPENDENT SSCS The thermal analysis addresses independent events by adding thermal fragilities to the RG 1.200 Point Beach internal events model and linking them to the appropriate initiating events. Only initiating events that can increase containment temperature above 250oF are considered as described in the table below. 250oF is the temperature at which the probability of a CT overstress is

~1E-7 [reference figure 11 in section 2.3.1 in this evaluation].

Initiating Events (IE) Screening for Containment Thermal Transients Impacting the Construction Truss Conditional on Thermal Transient > 250oF PRA IE Description Basis for Inclusion/Exclusion INIT-A INITIATING EVENT LARGE LOCA > 6 Included - can exceed 250F INITIATING EVENT EXCESSIVE LOCA (VESSEL Omitted - This event will result in temperatures > 250F. However this event INIT-EXC FAILURE) independently results in core damage, CCDP=1 INIT-FBIC FEEDLINE BREAK INSIDE CONTAINMENT Included - can exceed 250F INIT-FBOC FEEDLINE BREAK OUTSIDE CONTAINMENT Excluded - High energy release occurs outside containment.

INIT-FIRE GENERIC INITIATOR TO CALCULATE FIRE CCDP Included - Fire initiators which result in very small, small and medium LOCAs.

Excluded - internal flooding screened all initiators except T3, Transient with PCS INIT- INITIATING EVENT INTERNAL FLOOD (ALL available. Sequences which would result in high energy release inside IFLOOD SCENARIOS) containment were screened.

Excluded - Low probability of occurrence. From Table 11 in PRA 2.0, Initiating INITIATING EVENT INTERFACING SYSTEMS INIT-ISL Events Notebook, Category 5, ISL for Unit 1 is 2.10E-7/yr and Unit 2 is 2.16E-LOCA 7/yr.

Excluded - transient releases steam outside containment or into RCS. Steam INIT-R INITIATING EVENT SGTR does not challenge containment.

INIT-S1 INITIATING EVENT MEDIUM LOCA >2 TO 6 INIT-S2 INITIATING EVENT SMALL LOCA 3/8 TO 2 Included - can exceed 250F INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT Excluded - OUTSIDE CONTAINMENT, transient unlikely to result in >250F inside INIT-SBOC STEAMLINE BREAK OUTSIDE CONTAINMENT containment.

INIT-T1G GRID-RELATED LOOP INIT-T1GB GRID BLACKOUT LOOP INIT-T1P PLANT-CENTERED LOOP INIT-T1W WEATHER-RELATED LOOP INIT-SBO STATION BLACKOUT INIT-T2 INITIATING EVENT TRANSIENT w/o PCS Excluded - transient unlikely to result in >250F inside containment. AFW used to remove decay heat outside containment.

INIT-T3 INITIATING EVENT TRANSIENT w PCS INITIATING EVENT LOSS OF COMPONENT INIT-TCC COOLING INIT-TD1 INITIATING EVENT LOSS OF BUS D-01 INIT-TD2 INITIATING EVENT LOSS OF BUS D-02 INIT-TIA INITIATING EVENT LOSS OF INSTRUMENT AIR INIT-TSW INITIATING EVENT LOSS OF SERVICE WATER Excluded - based on low probability of occurrence. Gate ATWS-T, Transfer Logic, which provides ATWS initiators, was solved using the Unit 1 5.02 internal events PRA model of INIT- record at a truncation of 2E-13 which is the same truncation used for the 5.02 internal ATWS ATWS events model of record. The same flag file and recovery rule file were used as the Unit 1 5.02 model of record. The Quantification of gate ATWS-T resulted in a probability of 1.42E-6/yr.

INIT-FIRE INDUCED MEDIUM LOCA Included - can exceed 250F

1. FIRE-S1 INIT-FIRE INDUCED SMALL LOCA Included - can exceed 250F

1. FIRE-S2 Excluded - very low probability that a high wind event will lead to a thermal event that will challenge the CT. The ~3.5 thick concrete containment HIGH WINDS structure is robust and will not be penetrated by highly energetic wind driven missiles.

21 of 163

PBN-BFJR-17-019 Rev. 1 Initiating Events (IE) Screening for Containment Thermal Transients Impacting the Construction Truss Conditional on Thermal Transient > 250oF PRA IE Description Basis for Inclusion/Exclusion Excluded - very low probability that a seismic event will lead to a thermal event that will challenge the CT.

The IPEEE top events that could lead to seismically initiated thermal transients include SLOCA, MLOCA, LLOCA, and Steamline/Feedline break. With the exception of SLOCA, these events have a high HCLPF capacity (0.3g) and were screened out in the IPEEE. Should a seismically induced SLOCA occur it would likely be mitigated by containment cooling functions. These functions and their SEISMIC probability of failure are evaluated in section 2.3.4 of the PRA Evaluation. In addition the fragility associated with SLOCA is much lower than the CT fragility

[Attachment F, section F.3 in the PRA Evaluation]; the CT is more likely to fail due to a seismic event than due to piping failure associated with a SLOCA. The impact of a seismically induced SLOCA is negligible and bounded by the assumptions used in the bounding and demonstrably conservative analysis.

Attachment F, Section F.7, in the PRA Evaluation provides the bases for excluding or including IPEEE top events in this evaluation.

Excluded -Other external hazards were screened from applicability to PBNP, Units 1 and 2 per a plant-specific evaluation in accordance with GL 88-20 and OTHER EXTERNAL EVENTS updated to use the criteria in ASME PRA Standard RA-Sa-2009. POINT BEACH UNITS 1 & 2 CONSTRUCTION TRUSS PRA EVALUATION, REV1, ATTACHMENT H, provides the bases for screening.

Excluded - Feed and Bleed was also considered for thermal events. Feed and Bleed sequences in the various transient event trees will inject mass/energy into containment. While F&B scenarios are not initiators in the traditional sense, F&B sequences were evaluated and dispositioned.

The frequency of successful F&B events is determined by finding the RAW for a basic event that defeats F&B all the time (e.g., an operator action or CCF of PORVs). The frequency of successful F&B would then be the increase in CDF FEED & BLEED assuming F&B failed with probability 1.0. For the Point Beach models this basic event is the CCF of PORVs which defeats F&B in all cases, basic event RC-

-POR-CM-PORV. This event was set to 1.0. The table below summarizes the results for Unit 1 for each hazard; Unit 2 results would be similar.

10 The small frequency for success of Feed and Bleed events of 2.475142E-6/rx yr would increase the initiating event frequency for thermal events from 1.87813E-3 to 1.880605E-3 which is not risk significant. Therefore, feed and bleed is excluded.

2.1.4.3 OPERATOR RELIABILITY For the bounding analyses, operator reliability is subsumed by the previous assumptions that apply a conditional failure probability of 1.0 to any condition that overstresses the CT. No credit is provided for operator success or mitigating functions.

10 FEED & BLEED INITIATING EVENT FREQUENCY F&B F&B Success Frequency HAZARD CDF RAW = CDF*(RAW-1)

Internal Events U1 6.05092E-6 1.095 5.748374E-7.

NFPA 805 U1 GO_LIVE_MODEL_FINAL 5.29727E-5 1.031 1.642154E-6 Internal Flooding U1_FLOOD_CDF_INIT.cut 2.99294E-6 1.001 2.99294E-8.

DCA Seismic 06-18-CT-RASP, U1 -2 OF 2 PORVs - RASP, 2.70821E-6 1.071 2.28221E-7.

G-CT-SEISMIC-CDF-POST-IPEEE.cut High Winds Common mode failure of PORVs do not N/A U1 PBU1-503-CDF-E-12, 11-15-2017 contribute to CDF for High Winds TOTAL= 2.475142E-6 22 of 163

PBN-BFJR-17-019 Rev. 1 2.2 SEISMIC ANALYSIS This section provides the seismic analysis results along with inputs and methods used to perform the analysis.

2.2.1 SEISMIC HAZARD The seismic evaluation uses site specific seismic hazard data to develop discrete seismic initiating events that are convolved with the fragility data to calculate CDF and LERF.

The following table provides the Point Beach seismic hazard data from Point Beach Seismic Hazard and Screening Report (Ref 4). The mean values from this table are used to calculate the frequencies for the seismic initiating events used in this evaluation.

Table 6: POINT BEACH 1E-03 PEAK GROUND ACCELERATION (PGA)

Point Beach Mean PGA Annual Frequency of Exceedance PGA 5% Mean 95% 1E-04 0.050 5.35E-05 3.69E-04 1.20E-03 1E-05 0.075 1.84E-05 1.67E-04 5.50E-04 0.100 8.23E-06 9.41E-05 3.14E-04 1E-06 0.150 2.60E-06 4.14E-05 1.42E-04 0.300 3.05E-07 9.28E-06 3.28E-05 1E-07 0.500 5.27E-08 2.66E-06 1.01E-05 1E-08 0.750 1.11E-08 8.43E-07 3.37E-06 1.000 3.42E-09 3.36E-07 1.40E-06 1E-09 1.500 5.12E-10 8.07E-08 3.52E-07 3.000 9.11E-11 5.89E-09 2.68E-08 Source: NRC 2014-0024, Appendix A, Table A1-a. Mean and Fractile Seismic Hazard Curves for PGA at Point Beach SEISMIC INITIATING EVENT frequencies were developed using EPRI FRANX software [Ref 2] based on the mean hazard data from Table 6 above. Attachment D provides the FRANX Hazard Editor output. Ten bins of seismic initiating events were developed. Ten bins provided the same results as 20 bins; the results were no longer stable when 8 or fewer bins were used. The resulting hazard bins and their mean frequencies are provided below [Reference attachment D]. These events are integrated with their respective seismic conditional failure probabilities to estimate the mean annual frequency of occurrence as described in the next section.

23 of 163

PBN-BFJR-17-019 Rev. 1 2.2.2 SEISMIC FRAGILITY ANALYSIS The conditional failure probability used to calculate the CDF and LERF associated with a CT failure is a function of the seismic hazard frequency and seismic fragility as defined by equations 6 and 7 and assumptions in section 2.1:

Core Damage Frequency (CDF) = Hazard Frequency X CT Fragility Equation 6 Large Early Release Frequency (LERF) = CDF x 0.5 x CT Fragility Equation 7 CT fragility is calculated based on guidance from Reference 9, section 4.1.1 Fragility Model. The following excerpts from that document provide background for derivation, calculation and application of fragility:

Excerpt from Seismic Probabilistic Risk Assessment Implementation Guide EPRI TR 3002000709 With perfect knowledge of the failure mode and parameters describing the ground acceleration capacity (i.e., only accounting for the random variability, R), the conditional probability of failure, fo , for a given peak ground acceleration level, a, is given by Equation 2-2:

( )

Where [ ] is the standard Gaussian (normal) cumulative distribution of the term in brackets.

The relationship between fo and a is the median fragility curve for a component with a median ground acceleration capacity Am.

The mean fragility curve is obtained using Eq. 2-2 but replacing R with the composite variability:

C = (R2 + U2)1/2 Where U is the modeling uncertainty.

Based on this guidance the following equation was used to calculate the mean fragilities for each of the discrete initiating events applied to this analysis:

( )

Conditional Failure Probability = Equation 8 Where:

is the standard Gaussian (normal) cumulative distribution a = PGA level ( based on the geometric mean of the upper and lower range of the hazard, the square root of their product, was calculated for each initiating event.)

Am = CT median acceleration capacity c = (r 2 + u 2)1/2 = composite or mean standard deviation r = logarithmic standard deviation of the capacity and represents variability due to randomness in earthquake and structural characteristic u = logarithmic standard deviation of median capacity which represents uncertainty in models.

Equation 8 is used to calculate the CT fragility which is assumed to be a catastrophic CT overstress condition.

24 of 163

PBN-BFJR-17-019 Rev. 1 Am, r, u , and c values were obtained from structural calculation 11Q0060-C-028 [Ref 6]:

Am u r c Unit 1Thermal Mod, Unit 2 Unmodified 0.42 0.32 0.24 0.40 All Design Basis Mods 0.53 0.32 0.24 0.40 CT that meets GMRS-based seismic event requirements 2.2.3 SEISMIC BOUNDING ANALYSIS The seismic hazard and fragility data from the previous section are used in the bounding case to calculate CDF and LERF using the following equations:

Core Damage Frequency (CDF) = Hazard Frequency x CT Fragility Equation 6 Large Early Release Frequency (LERF) = CDF x 0.5 x CT Fragility Equation 7 The following tables provide CDF and LERF results for the post-LAR as-built CT and the fully design compliant CT:

TABLE 8a: SEISMIC HAZARD ANNUAL FREQUENCY OF OCCURRENCE Unit 1 with THERMAL MODIFICATIONS11, UNMODIFIED Unit 2 Seismic Initiating Hazard CT Fragility 0.5*CT Events Frequency a Am c (as built)

CDF Fragility LERF ID PGA Range

%G01 0.05g to <0.12g 3.04E-04 0.0775g 0.42 0.40 1.20E-05 3.63E-09 6.00E-06 2.18E-14

%G02 0.12g to <0.23g 4.82E-05 0.1661g 0.42 0.40 1.02E-02 4.91E-07 5.10E-03 2.50E-09

%G03 0.23g to <0.34g 1.01E-05 0.2796g 0.42 0.40 1.55E-01 1.56E-06 7.75E-02 1.21E-07

%G04 0.34g to <0.45g 3.36E-06 0.3912g 0.42 0.40 4.30E-01 1.44E-06 2.15E-01 3.10E-07

%G05 0.45g to <0.56g 1.54E-06 0.5020g 0.42 0.40 6.72E-01 1.04E-06 3.36E-01 3.49E-07

%G06 0.56g to <0.67g 7.72E-07 0.6125g 0.42 0.40 8.27E-01 6.39E-07 4.14E-01 2.64E-07

%G07 0.67g to <0.78g 4.34E-07 0.7229g 0.42 0.40 9.13E-01 3.96E-07 4.57E-01 1.81E-07

%G08 0.78g to <0.89g 2.56E-07 0.8332g 0.42 0.40 9.57E-01 2.45E-07 4.79E-01 1.17E-07

%G09 0.89g to <1g 1.54E-07 0.9434g 0.42 0.40 9.78E-01 1.51E-07 4.89E-01 7.38E-08

%G10 >1g 3.36E-07 1.1000g 0.42 0.40 9.92E-01 3.33E-07 4.96E-01 1.65E-07 CDF = 6.30E-06 LERF = 1.58E-06 TABLE 8b: SEISMIC HAZARD ANNUAL FREQUENCY OF OCCURRENCE All Design Basis Mods Unit 1 and Unit 2 MODIFIED to FULLY MEET SEISMIC and THERMAL DESIGN REQUIREMENTS Seismic Initiating Hazard CT Fragility 0.5*CT Events Frequency a Am c (design mods)

CDF Fragility LERF ID PGA Range

%G01 0.05g to <0.12g 3.04E-04 0.0775g 0.53 0.40 7.68E-07 2.33E-10 3.84E-07 8.95E-17

%G02 0.12g to <0.23g 4.82E-05 0.1661g 0.53 0.40 1.86E-03 8.97E-08 9.30E-04 8.34E-11

%G03 0.23g to <0.34g 1.01E-05 0.2796g 0.53 0.40 5.49E-02 5.55E-07 2.75E-02 1.52E-08

%G04 0.34g to <0.45g 3.36E-06 0.3912g 0.53 0.40 2.24E-01 7.52E-07 1.12E-01 8.42E-08

%G05 0.45g to <0.56g 1.54E-06 0.5020g 0.53 0.40 4.46E-01 6.87E-07 2.23E-01 1.53E-07

%G06 0.56g to <0.67g 7.72E-07 0.6125g 0.53 0.40 6.41E-01 4.95E-07 3.21E-01 1.59E-07

%G07 0.67g to <0.78g 4.34E-07 0.7229g 0.53 0.40 7.81E-01 3.39E-07 3.91E-01 1.32E-07

%G08 0.78g to <0.89g 2.56E-07 0.8332g 0.53 0.40 8.71E-01 2.23E-07 4.36E-01 9.71E-08

%G09 0.89g to <1g 1.54E-07 0.9434g 0.53 0.40 9.25E-01 1.42E-07 4.63E-01 6.57E-08

%G10 >1g 3.36E-07 1.1000g 0.53 0.40 9.66E-01 3.25E-07 4.83E-01 1.57E-07 CDF = 3.61E-06 LERF = 8.64E-07 11 Unit 1 thermal modifications result in a configuration that is bounded by Unit 2 for applied thermal loads.

25 of 163

PBN-BFJR-17-019 Rev. 1 Assuming a CCDP of 1.0, the CDF is 2.69E-06 and LERF is 7.16E-07 when compared to a CT that meets GMRS-based seismic event requirements.

The following tables summarize the results based on applying mean, 5%, and 95% hazard values. 5%

and 95% hazard values were calculated based on error factors generated by FRANX as listed in Attachment D.

Mean Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 6.30E-06 1.58E-06 2.69E-06 7.16E-07 B All Design Basis Mods (Base CDF) 3.61E-06 8.64E-07 95% Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 2.35E-05 6.03E-06 9.99E-06 2.72E-06 B All Design Basis Mods (Base CDF) 1.36E-05 3.31e-06 5% Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 2.48E-07 4.31E-08 1.34E-07 2.45E-08 B All Design Basis Mods (Base CDF) 1.14E-07 1.86E-08 2.2.4 Integration of GI-199 and BOUNDING CT Results This section evaluates integrating the CT bounding mean CDF and LERF results (previous section) with the GI-199 seismic plant fragility [Ref 20]. The GI-199 seismic plant fragility does not include CT failures; these fragilities are independent of CT failures. Combining these two risk metrics more accurately characterizes the seismic total risk and change in risk. Section 2.1.4.1 develops a basis for this conclusion.

Earthquakes simultaneously affect multiple components, leading to many different concurrent failures and accident sequences, many of which would not involve or affect the CT. Omitting independent failures overestimates the CDF but underestimates the LERF associated with a CT failure; equations 1 through 5 in section 2.1.4 illustrate the basis for these relationships.

To evaluate the combined effect of the GI-199 and CT bounding results, the CDF and LERF associated with the CT and GI-199 were ORd for each hazard bin12. Figure 4 illustrates this logic using a CAFTA fault tree. The GI-199 data was used to develop the CT fragility curve and as such allows integrating the CT results with the plant fragility curve [Ref 20] based on GI-199.

The following information summarizes the fragility data used to combine CT and GI-199 risk results.

Case Am Bu Br Bc HCLPF 1 CT U1 Mod, U2 As is 0.42 0.32 0.24 0.40 0.17 2 CT All Design Basis Mods 0.53 0.32 0.24 0.40 0.21 3 GI-199 - plant fragility 0.45 0.45 0.16 12 For any given acceleration core damage can occur as a result of CT overstress or a result of a failure not related to a CT failure. There is also the probability that both could concurrently lead to core damage. The logical OR function deletes this overlapping probability, i.e. it avoids double counting core damage probability. The OR function is represented by the following equation: P(A,B) = P(A) + P(B) - P(A)*P(B). In this application the two functions, CT probabilities as a function of acceleration and IPEEE probabilities as a function of acceleration, are convolved, or integrated, using this logical OR function.

26 of 163

PBN-BFJR-17-019 Rev. 1 Fragilities and CDFs were developed for each of these three cases, and then the GI-199 based plant CDF results, Case 3, were integrated with each of the two CT CDF results, cases 1 and 2. The integration is based on using the logical OR functions to combine the CT and plant fragility results. A comprehensive set of results are provided in Table 9 and are summarized in the table below.

CT GI-199 CT CIS Case CDF CDF LERF CDF LERF 1 CT U1 Mod, U2 As is 6.30E-06 Case 1 OR Case 3 = 9.36E-06 2.42E-06 1.88E-06 7.31E-07 2 CT All Design Basis Mods 3.61E-06 Case 2 OR Case 3 = 7.49E-06 1.69E-06 3 GI-199 5.97E-06 CDF and LERF meet Region II criterion of <1E-05 and <1E-06 respectively.

27 of 163

PBN-BFJR-17-019 Rev. 1 The following table provides details of the calculation of fragilities, probabilities, and CDF for each case.

TABLE 9 CT No Mod Case Integrated with GI-199 CDF LERF Independent CASE1 + CASE3 -

CT U1 Mod, U2 As Is [CASE 1] (CASE1*CASE3)

[CASE 3] CIS 0.5*CT Integrated LERF Hazard INTEGRATED Fragility Fragility Fragility Hazard CT CT Plant Plant CT CDF X*C ID Description Frequency Fragility CDF Fragility CDF Fragility A B AB=C X

%G01 Seismic Initiator (0.05g to <0.12g) 3.04E-04 1.20E-05 3.63E-09 4.64E-05 1.41E-08 5.83E-05 1.77E-08 5.42E-09 6.00E-06 6.00E-06 1.06E-13

%G02 Seismic Initiator (0.12g to <0.23g) 4.82E-05 1.02E-02 4.91E-07 1.34E-02 6.45E-07 2.34E-02 1.13E-06 8.68E-05 5.10E-03 5.10E-03 5.76E-09

%G03 Seismic Initiator (0.23g to <0.34g) 1.01E-05 1.55E-01 1.56E-06 1.45E-01 1.47E-06 2.77E-01 2.80E-06 8.95E-03 7.75E-02 7.75E-02 2.17E-07

%G04 Seismic Initiator (0.34g to <0.45g) 3.36E-06 4.30E-01 1.44E-06 3.78E-01 1.27E-06 6.45E-01 2.17E-06 7.64E-02 2.15E-01 2.17E-01 4.71E-07

%G05 Seismic Initiator (0.45g to <0.56g) 1.54E-06 6.72E-01 1.04E-06 5.96E-01 9.18E-07 8.68E-01 1.34E-06 2.41E-01 3.36E-01 3.56E-01 4.77E-07

%G06 Seismic Initiator (0.56g to <0.67g) 7.72E-07 8.27E-01 6.39E-07 7.53E-01 5.82E-07 9.57E-01 7.39E-07 4.58E-01 4.14E-01 4.86E-01 3.59E-07

%G07 Seismic Initiator (0.67g to <0.78g) 4.34E-07 9.13E-01 3.96E-07 8.54E-01 3.71E-07 9.87E-01 4.28E-07 6.57E-01 4.57E-01 6.17E-01 2.64E-07

%G08 Seismic Initiator (0.78g to <0.89g) 2.56E-07 9.57E-01 2.45E-07 9.14E-01 2.34E-07 9.96E-01 2.55E-07 8.02E-01 4.79E-01 7.39E-01 1.88E-07

%G09 Seismic Initiator (0.89g to <1g) 1.54E-07 9.78E-01 1.51E-07 9.50E-01 1.46E-07 9.99E-01 1.54E-07 8.93E-01 4.89E-01 8.37E-01 1.29E-07

%G10 Seismic Initiator (>1g) 3.36E-07 9.92E-01 3.33E-07 9.76E-01 3.28E-07 1.00E+00 3.36E-07 9.58E-01 4.96E-01 9.27E-01 3.11E-07 Total CDF 6.30E-06 5.97E-06 Total CDF 9.36E-06 Total LERF 2.42E-06 CT All Design Basis Mods Case Integrated with GI-199 CDF LERF Plant CASE2 + CASE3 -

CT All Design Basis Mods [CASE 2]

Fragility CDF (CASE2*CASE3)

%G01 Seismic Initiator (0.05g to <0.12g) 3.04E-04 7.68E-07 2.33E-10 4.64E-05 1.41E-08 4.71E-05 1.43E-08 5.42E-09 1.50E-02 3.84E-07 5.49E-15

%G02 Seismic Initiator (0.12g to <0.23g) 4.82E-05 1.86E-03 8.97E-08 1.34E-02 6.45E-07 1.52E-02 7.34E-07 8.68E-05 1.50E-02 9.30E-04 6.83E-10

%G03 Seismic Initiator (0.23g to <0.34g) 1.01E-05 5.49E-02 5.55E-07 1.45E-01 1.47E-06 1.92E-01 1.94E-06 8.95E-03 1.50E-02 2.75E-02 5.33E-08

%G04 Seismic Initiator (0.34g to <0.45g) 3.36E-06 2.24E-01 7.52E-07 3.78E-01 1.27E-06 5.17E-01 1.74E-06 7.64E-02 1.00E-01 1.14E-01 1.99E-07

%G05 Seismic Initiator (0.45g to <0.56g) 1.54E-06 4.46E-01 6.87E-07 5.96E-01 9.18E-07 7.76E-01 1.20E-06 2.41E-01 3.20E-01 2.46E-01 2.95E-07

%G06 Seismic Initiator (0.56g to <0.67g) 7.72E-07 6.41E-01 4.95E-07 7.53E-01 5.82E-07 9.12E-01 7.04E-07 4.58E-01 5.50E-01 4.04E-01 2.85E-07

%G07 Seismic Initiator (0.67g to <0.78g) 4.34E-07 7.81E-01 3.39E-07 8.54E-01 3.71E-07 9.68E-01 4.20E-07 6.57E-01 7.40E-01 5.70E-01 2.39E-07

%G08 Seismic Initiator (0.78g to <0.89g) 2.56E-07 8.71E-01 2.23E-07 9.14E-01 2.34E-07 9.89E-01 2.53E-07 8.02E-01 8.50E-01 7.17E-01 1.81E-07

%G09 Seismic Initiator (0.89g to <1g) 1.54E-07 9.25E-01 1.42E-07 9.50E-01 1.46E-07 9.96E-01 1.53E-07 8.93E-01 9.25E-01 8.29E-01 1.27E-07

%G10 Seismic Initiator (>1g) 3.36E-07 9.66E-01 3.25E-07 9.76E-01 3.28E-07 9.99E-01 3.36E-07 9.58E-01 1.00E+00 9.25E-01 3.11E-07 Total CDF 3.61E-06 5.97E-06 Total CDF 7.49E-06 Total LERF 1.69E-06 CDF 1.88E-06 LERF 7.31E-07 28 of 163

PBN-BFJR-17-019 Rev. 1 2.3 THERMAL BOUNDING ANALYSIS The yearly frequency of a CT thermal overstress condition is based on multiplying the CT thermal fragilities (probability of failure as a function of temperature), with the thermal initiating event frequencies. Failure is defined as an overstress condition only. Note that the structural calculations, Ref 12.a and 12.b, did not include an assessment of the consequences of overstress, i.e. the extent to which overstress would affect the stability of the CT or its components, or the likelihood of deconstruction, collapse, etc. As such it is assumed that the CT structure disassembles into its component elements with the welded trusses remaining intact as large heavy missiles targeting components below. This assumption bounds any uncertainty regarding the consequences of CT overstress.

2.3.1 THERMAL CONSTRUCTION TRUSS FRAGILITY The method used to develop the thermal fragility data is described in section 6.4 of Engineering Evaluation 2017-0008 [Ref 15]. The following table lists fragility data from that evaluation. These data apply are calculated for Unit 1 which bounds Unit 2.

Thermal Fragility Results Temperature (°F) Probability of Failure 211 1E-12 286 0.001 298 0.01 378 0.99 29 of 163

PBN-BFJR-17-019 Rev. 1 2.3.2 THERMAL INITIATING EVENT FREQUENCY This section develops the CT thermal hazard curve based on the total frequency of all applicable thermal initiating events [section 2.1.4.2] versus the maximum containment air temperatures expected for these events. Total frequency is based on the sum of the frequency of all initiating events that result in containment temperatures greater than 250oF, section 2.1.4.2.

The thermal events considered include:

Large, Medium and Small LOCAs.

Steam Line Breaks Inside (SBIC) Containment Feed Line Breaks Inside (FLBI) Containment Medium and Small Fire induced LOCAs Section 2.1.4.2 provides the basis for excluding/including consideration of initiating events in this evaluation.

2.3.2.1 STEAM LINE BREAK INSIDE CONTAINMENT (SBIC)

From SPAR Initiating Event Data and Results 2015 Parameter Estimation Update: SBIC = 3.01E-04.

This data is an update of data in PRA 2.0, Rev 6.

2.3.2.2 LOCA The Small, Medium and Large LOCA initiating event frequencies listed in the table below are obtained from the references provided.

LOCA FREQUENCIES PRA Frequency PRA Description Designator per year Large LOCA - greater than 6-inch diameter break Point Beach A 1.33E-06 Initiating Events Notebook, PRA 2.0, Revision 6.

Medium LOCA - 2 to 6-inch diameter break Point Beach Initiating S1 5.61E-04 Events Notebook, PRA 2.0, Revision 6.

S2 5.77E-04 Small LOCA - less than 2-inch diameter break NUREG/CR-6928 Fire Induced Medium LOCA INIT-#FIRE-S1 1.18E-05 Calculated By Solving Gate #Fire-S1, Fire Induced Medium LOCA Fire Induced Small LOCA INIT-#FIRE-S2 4.01E-04 Calculated By Solving Gate #Fire-S2, Fire Induced Small LOCA 2.3.2.3 FEED LINE BREAK INSIDE CONTAINMENT (FBIC)

The frequency for the feed line lengths in the following table are based on a 3-inch equivalent diameter pipe or greater, but not greater than 16 inches [Ref 23].

30 of 163

PBN-BFJR-17-019 Rev. 1 Feed Line Break Inside Containment Frequencies Break size U1 (ft.) U1 Freq. U2 (ft.) U2 Freq.

3" to 8" 248 1.7E-05 230 1.6E-05 8" to 16" 248 8.1E-06 230 7.5E-06 The Feed Line Break initiating event frequencies are obtained from adding the 3 to 8 and 8 to 16 frequencies. Unit 1 is the higher of the two and was used in the thermal event tree 2.50E-05.

2.3.2.4 THERMAL INITIATING EVENT FAULT TREE The following fault tree was developed for use in both the thermal bounding and demonstrably conservative analyses. The parameter data described in the previous sections was used.

Quantification of the top event GINIT-CT-THERM results in a probability of 1.8768E-03.

2.3.3 INPUTS AND ASSUMPTIONS

1. Steam Line Break inside Containment (SBIC) is the controlling event with regard to the design basis temperature of 286oF and 60 psig inside containment [Ref 1]. The design basis SBIC is a 1.4 31 of 163

PBN-BFJR-17-019 Rev. 1 ft2 break. The limiting break size is based on the flow restricting orifice in the main steam line flow path.

2. LOCA, SBIC, FIRE S, and FLBI are conservatively assumed to result in a 250oF or greater challenge to the CT. For feedwater line breaks, the total energy released to the containment is lower because much of the feedwater flows directly into containment without being boiled in the SG.

2.3.4 MITIGATING SYSTEMS This section examines failures of systems that mitigate containment temperature transients.

Insights from this review determine what system failures must be considered in the thermal model.

CT overstress due to thermal growth occurs sometime after the thermal transient initiating event, at T>0. As shown in the chart (Figure 11) in Section 2.3.1, the probability of CT failure increases with temperature. Although there is some thermal lag due to the thermal resistance and thermal capacity of the CT structure, the systems required to mitigate containment thermal transients must respond within minutes and as such there is very little time for their recovery if they malfunction.

SEQUENCE DESCRIPTIONS The containment thermal mitigation function evaluation is based on 5 different system sequences, each sequence evaluates different combination of failures of systems credited for thermal transient mitigation. These systems include:

ACT, Containment Safeguards Actuation Trains CFC, Containment Fan Coolers (4 coolers total, 2 per train)

CS, Containment Spray (2 pump trains)

FIV, Feedwater Isolation Valve and Feedwater Regulating Valve

• CASE 1 -represents the situation with no failures. 2 of 2 Safeguards Actuation Trains are successful, 4 of 4 Containment Fan Coolers are Successful, both trains of Containment Spray are available and Feedwater Isolation occurs.

• CASE 2 -failure of one train of safeguards actuation, 2 of 4 containment fan coolers, 1of 2 trains of containment spray and success of feedwater isolation.

• CASE 3 -success of both trains of safeguards actuation, all containment fan coolers, both trains of containment spray but failure of feedwater isolation to containment.

• CASE 4 - success of one train of safeguards actuation, 2 of 4 containment fan coolers and successful feedwater isolation. Both trains of containment spray are failed.

• CASE 5 - success of one train of safeguards actuation, 1 of 4 containment fan coolers, 1 of 2 trains of containment spray and feedwater isolation.

EVENT TREE The GTHERMAL-CASES event tree was developed to calculate the probabilities of various containment cooling configurations. The expected temperatures for each case are thermal transient analysis from calculation CN-CRA-08-43.

32 of 163

PBN-BFJR-17-019 Rev. 1 Containment safeguards pressure signals automatically actuate containment fan coolers (CFC) and containment spray (CS) systems. Both these systems support containment heat removal.

The following top events are used in the GTHERMAL-CASES event tree:

• TABLE 10 THERMAL CASES. This top event is set to 1.0 to calculate the probability of reaching various end states given a thermal event has occurred. These probabilities are summarized in Table 10.

• GACT - SAFEGUARDS ACTUATION. This top event represents the safeguards actuation system and its support systems. At Point Beach, there are two trains of safeguards actuation for each unit, Train A and Train B. The Safety Actuation System logic relay cabinets each contain two redundant logic trains, A and B, which are physically and electrically independent.

• GCFC - CONTAINMENT FAN COOLERS. This top event represents the containment fan coolers and its support systems. The containment air recirculation system consists of four fan cooler units, a duct distribution system, and the associated instrumentation and controls.

• GCS - CONTAINMENT SPRAY. This top event represents the containment spray system and its support systems. There are two trains of containment spray for each unit. The principal components of the containment spray system which provide containment cooling consist of two pumps, spray ring headers and nozzles, and the necessary piping and valves.

• FIV - FEEDWATER ISOLATION VALVE AND FEED REG. VALVE. This top event represents feedwater isolation and its support systems. The feedwater isolation system for purposes of this analysis includes the feedwater isolation valve and the feedwater regulating valve. Feedwater isolation prevents continued injection of heated water into the steam generator and exceeding the design pressurization of containment.

The following table summarizes the probabilities calculated by quantifying the event tree. The table also includes design basis GOTHIC model results for a 1.4 ft2 break, ~ 16 inches, for various mitigating system configurations.

33 of 163

PBN-BFJR-17-019 Rev. 1 Table 10: Containment Cooling System Configuration Probabilities and Temperatures Containment Configuration Case ACT CFC CS FIV Temperature Basis Temp[1] (F) Probability o Assumption based on results from 2 of 2 4 of 4 2 of 2 <270 F 1 AVAILABLE 0.997 Case 2. All trains available should (No Failures) (No Failures) (No Failures) estimated result in temperatures less than 270F.

1 of 2 2 of 4 1 of 2 o CN-CRA-08-43 Rev 01 Case 1c, Table 2 GACT1000 GFC1100 GCS1100 AVAILABLE 270 F 9.74E-6 5-1 (One Train Fails) (One Train Fails) (One Train Fails) 2 of 2 4 of 4 2 of 2 FAILURE o CN-CRA-08-43 Rev 01 Case 1b, Table 3 GFIV1000 277.8 F 3.45E-3 (No Failures) (No Failures) (No Failures) 5-1 for FIV only.

1 of 2 None 2 of 4 GCS1110 o Assumption, total frequency <1E-05 4 GACT1000 GFC1100 AVAILABLE >280 F 1.41E-7 and as such can be screened out (Both Trains (One Train Fails) (One Train Fails)

Fail) 1 of 2 1 of 4 1 of 2 o Assumption, total frequency <1E-05 5 GACT1000 GFC1900 GCS1100 AVAILABLE >280 F 6.53E-6 and as such can be screened out (One Train Fails) (One Train Fails + 1) (One Train Fails)

Probability = probability of containment safeguards configuration ACT = Containment Safeguards Actuation Trains Available CFC = Containment Fan Coolers (4 coolers total, 2 per train) Available CS = Containment Spray (2 pump trains) Available FIV = Feedwater Isolation Valve and Feedwater Regulating Valve (failure to isolate feedwater allowing water upstream to inject) 1]

Containment is modeled as a single bulk volume as such the temperature is the bulk average temperature.

The following tables summarize GOTHIC results from CN-CRA-08-43 Rev 01 referenced in Table 10; Cases 1a, 1b, and 1c. The figure below illustrates the containment temperature trends for these GOTHIC cases:

FULL POWER CASE 1 - CONTAINMENT TEMPERATURE Time (Seconds) 2.3.5 THERMAL PRA MODEL A new fault tree was created in the one top NFPA 805 model which includes the internal events model. This fault tree was used to calculate CDF given a thermal event that overstresses the CT. The key logic and parameter inputs are thermal initiating event frequencies, developed in section 2.1.4.2,

[1]

Containment is modeled as a single bulk volume as such the temperature is the bulk average temperature.

34 of 163

PBN-BFJR-17-019 Rev. 1 and the construction truss thermal fragility, figure 11. Attachment E, Construction Truss Thermal Model Development, provides model development details.

2.3.5.1 BOUNDING CASE - THERMAL The thermal bounding analysis only credits containment mitigating functions, all other mitigating functions are assumed to fail. Model details are provided in Attachment E.

The bounding analysis results are based on the following equation:

CDF = Thermal Initiating Event Frequency X CT Thermal Fragility X Case Probability CDF is assumed to equal the calculated CDF; a CT fragility with full modifications was not calculated and therefore conservatively assumed to have no temperature fragility, i.e. fragility = 0 for the entire range of containment temperatures. This results in a higher CDF and is therefore conservative.

Case 1 has the largest CDF. Although the temperature for this case is expected to stay below 270oF for most of the initiating events, a fragility value of 2.5E-05 (Figure 11), for 270oF, was conservatively applied as a bounding value.

Cutsets were generated using the UNIT1-SEISMIC.caf model, solving gate GCT-IE-FRAG-CASES with FTREX at a truncation of 1E-15. The cutsets from the 5 cases were then merged into one cutset file, then compressed and subsumed, to calculate the total CDF. ACUBE improves the accuracy of the minimal cut set calculation by employing a Binary Decision Diagram method. The cutsets and importances are provided in Attachment E.

The total CDF for the Bounding Thermal Case is 4.83E-08/year.

For thermal, LERF value applies assumption from section 2.1.3 which multiplies CDF by a factor of 0.5; therefore LERF = 2.42E-08/year.

The following table provides the bounding CDF results for each containment cooling case.

Bounding Thermal Case CDF (GCT-IE-FRAG-CASES top event)

E-15 Truncation CASE 1 4.6906E-08/yr.

CASE 2 2.6312E-13/yr.

CASE 3 1.2987E-09/yr.

CASE 4 1.5010E-13/yr.

CASE 5 1.1942E-10/yr.

TOTAL 4.8325E-08/yr.

ACUBE results were 4.83E-08/yr, same as FTREX; no reduction achieved by applying the Binary Decision Diagram method.

Uncertainty results based on applying UNCERT 4.0 [Ref 24] to the cutsets generated by quantifying GCT-IE-FRAG-CASES at a truncation of E-15 :

35 of 163

PBN-BFJR-17-019 Rev. 1 BOUNDING THERMAL ANALYSIS CDF UNCERTAINTY Parameter Estimate Confidence Range Point Estimate 4.83E-08 Samples (Monte Carlo) 50000 Mean 4.85E-08 [4.7E-08 , 5.0E-08]

5% 1.51E-09 [1.5E-09 , 1.6E-09]

Median 1.50E-08 [1.5E-08 , 1.5E-08]

95% 1.83E-07 [1.8E-07 , 1.9E-07]

Standard Deviation 1.55E-07 Skewness 22.57251 3.0 TOTAL RISK - BOUNDING CASE Combining the seismic [Section 2.2.4] and thermal [Section 2.3.5.1] bounding ACUBE cases results in the following risk metrics:

Case Hazard Case CDF LERF (note 3) 1 Seismic - CT U1 Mod, U2 As is 9.36E-06 2.42E-06 2 Seismic - CT All Design Basis Mods 7.49E-06 1.69E-06 3 Thermal - CT U1 Mod, U2 As is (note 2) 4.83E-08 2.42E-08 4 Thermal - CT All Design Basis Mods (note 1) 0.0 0.0 Notes:

1. CDF and LERF values for Thermal - CT All Design Basis Mods were not calculated and are assumed to be 0.0.

2. Refer to section E for development of Thermal CDF value

3. Thermal LERF value applies assumption from section 2.1.3. Multiplies CDF by a factor of 0.5.

TOTAL RISK - BOUNDING CASE Combined Hazards CDF CDF LERF LERF Seismic +Thermal - CT U1 Mod, U2 As is 9.41E-06 2.44E-06 1.93E-06 7.55E-07 Seismic +Thermal - CT All Design Basis Mods 7.49E-06 1.69E-06 36 of 163

PBN-BFJR-17-019 Rev. 1 4.0 QUALITATIVE FACTORS There are several conservative and significant considerations not included in the bounding and demonstrably conservative analyses. These factors indicate there is significant risk margin beyond that calculated using the assumptions applied in this evaluation.

4.1 SEISMIC LOADING DIRECTION.

Seismic calculations, references 12c and 12d, note the following:

Upon inspection of the layout of the construction truss, a critical direction for the load case without liner contact is taken to be acceleration in the direction 10° east of North. Applying the seismic loading in this direction results in the greatest load in the T2 bottom chords.

Since the maximum loading direction is related to the random nature of the seismic event, it is likely that the CT structure will not experience seismic loading in the critical direction; i.e. loads vary with seismic load direction. Although detailed structural calculations have not been performed for other loading directions, it is reasonable to assume that the capacity of the CT in other loading directions would be greater than the critical direction of 10°.

4.2 All Design Basis CDF based on Modifications that Exceed Design Requirements Since it is not possible to design a modification that exactly meets design basis requirements, the design compliant Am reflects a CT with modifications that exceed design requirements. This results in a smaller CDF for the all design basis mod case and consequently a higher CDF.

4.3 CT Over Stress will NOT Always Lead to Risk Significant Component Failure Reference 3 assessed the impact that falling CT debris would have on components below and concluded that many of the critical components within containment are robust, e.g. Main Steam lines, PORVs, etc.; and many are protected by robust barriers, the SI system for example. As such it is reasonable to assume these SSCs will survive and operators will have mitigating options available should the CT fail. Survival of these components is, however, considered in the demonstrably conservative analysis.

4.4 CT Over Stress will be less consequential at lower PGAs.

When overstressed, the CT structure will likely remain intact or not fully detach from its supports. This is most likely at the lower intensity seismic initiating events. The structural analyses evaluated the probability of overstress and did not assess the stability of the CT structure and its components, i.e.

the probability that the CT would deconstruct fully or partially.

37 of 163

PBN-BFJR-17-019 Rev. 1 5.0 DEMONSTRABLY CONSERVATIVE ANALYSIS This demonstrably conservative analysis applies more realistic assumptions, assuming it is unlikely that a CT collapse will always lead to core damage; i.e. applying a more realistic assumption that CCDP is less than 1.0. However, the conservative assumption that the CT will collapse if overstressed was retained.

For this assessment the following aspects of a CT failure and its consequences were studied:

How the CT fails when overstressed Trajectory of components from the failed CT Vulnerability of risk significant components to falling CT debris Location and robustness of the barriers that would protect critical components from the falling CT debris.

The results of this assessment [Ref 3] identified SSCs that are likely to survive a CT failure and operator actions that remain viable under seismic or thermal (e.g. LOCA) transients. Although this analysis is more realistic than the bounding analysis, conservative assumptions were applied to assure key uncertainties are addressed or bounded, for example:

The CT structure is always assumed to generate falling debris when overstressed.

CT debris targeting critical SSCs are assumed to consist of unrestrained heavy intact trusses and numerous smaller cross members.

Performance shaping factors, factors affecting operator actions, were increased to address additional stress and concurrent critical actions that would reduce the reliability of operator actions.

The CT consists of trusses with welded ligaments. Each truss is separated and interconnected by bolted to cross members. CT structural calculations, Ref 6 and 12 did not asses the consequences of overstress, the failure modes that would lead to CT instability. This assessment postulates a bounding assumption that bolted connections will fail before welded connections and that the trusses will fall as intact assemblies after separating from bolted cross members. The largest truss weighs ~3 tons. The largest cross members are estimated to weigh ~500 lbs. More details are provided in the qualitative evaluation of the impact of trusses and cross members provided in the Point Beach CT Target Assessment, reference 3.

Many of the potential critical targets below the CT are SSCs that are robust; they have a high likelihood to survive a strike by a truss. Many of these targets are at least partially protected by robust barriers, the SI system for example. Therefore it is reasonable to assume there is some probability that operators will have mitigating options available should the CT failure damage SSCs below.

38 of 163

PBN-BFJR-17-019 Rev. 1 5.1

SUMMARY

of TARGET ASSESSMENT INSIGHTS An evaluation of the postulated failure of an overstressed CT and its consequences is documented in Reference 3. The following summarizes the insights from of the assessment of targets above EL 66.

Penetration of EL 66 floor was determined to be unlikely.

1. MAIN STEAM VENT LINES are small (1 1/2 inch) and can be ruptured by very heavy falling debris such as an intact truss. Although most of the piping is close to the containment wall, away from where most debris would fall, the probability of these lines being damaged by CT debris is high.

The main steam vent line penetrations, P57 and P58, are at El 88 and are not a large early release issue. These pipes are isolated during power operation by normally closed valves outside containment. The vent lines and penetrations are discussed in more detail in section 2.1.3.

2. MAIN STEAM LINE PIPES. The main steam piping wall thickness is ~1 inch. Only an intact truss oriented in a way to minimize contact area (i.e. maximize energy transfer) and targeted directly on the centerline of the pipe may damage the pipe. Therefore penetration/puncture is assumed to be very unlikely. The main steam lines and penetrations are discussed in more detail in section 2.1.3.

3. POLAR CRANE is considered rugged and unlikely to fail in a gross way due to falling CT debris. The polar crane main hook capacity is 100 tons as compared to the largest truss which weighs ~3 tons

[Ref 3]. The polar crane therefore is a barrier to falling CT debris versus a being a target.

4. CONTAINMENT SPRAY PIPING is attached to the CT and is assumed to fail when the CT is overstressed.

5. CONTAINMENT WALL is considered very rugged and will not fail in a gross way. A containment hole size of 2 inches in diameter is the threshold for a large release; a hole size less than or equal to a 2 inch diameter will not result in a large release [WCAP-15791-P, Rev. 1]. Containment wall is discussed in more detail in section 2.1.2.d.

6. CONTAINMENT PENETRATIONS with isolations outside containment were evaluated and are considered reliable outside containment. The main steam penetrations and feedwater penetrations that are sealed inside containment are rugged and located and configured in a way that they are not vulnerable. Containment penetrations are discussed in more detail in section 2.1.2.

7. CONTAINMENT VENT PURGE SUPPLY AND EXHAUST (penetrations V-1 and V-2 are at El 98) - this system is not normally operating during power operation; there is a normally closed valve outside and the inside is blank flanged. These penetrations are discussed in detail in section 2.1.3.

8. CONTAINMENT SAMPLE LINES (penetrations X-1 and X-2 in the C-2 personnel lock at El 69), but these 1-inch lines have fail closed air operated valves outside containment.

9. DECK PLATE LOCATED at the EL 66 ABOVE the SEAL TABLE. The deck plate has minimal resistance to a falling truss oriented in a way that maximizes damage. However if a truss strikes the plate oriented across its length or side then it is unlikely the tubing below will be damaged; the truss 39 of 163

PBN-BFJR-17-019 Rev. 1 cannot penetrate the plate in those orientations due to its length.. There is some structural steel located above the seal table that could provide some protection to the tubing below. Shearing this tubing can result in a small break LOCA. The probability of seals being damaged is evaluated in Attachment G.

10. PRESSURIZER PORVS are at about El 76 on top of the pressurizer and under concrete missile shields designed to keep their valve stems from being ejected upward into the containment liner.

The missile shield is 15-inch thick reinforced concrete that covers the top of the pressurizer cubicle. This barrier provides adequate protection from postulated falling CT debris [Ref 3]. The instrument air system which normally supplies the PORVs with motive force is not a seismic category 1 system and may not be available in the event of a large earthquake. EC284214 (Unit 2) and EC285145 (Unit 1) [Ref 13] installed seismic category 1 nitrogen tanks and piping to supply the PORVs in the event of a loss of instrument air to the PORVs. These modifications were part of the transition to NFPA 805. There is one tank for each PORV with an adequate supply of compressed gas to provide for 24-hour operation of each PORV. The tanks are located on the 46 ft. elevation in containment with associated piping routed on the 46 ft. elevation or in the pressurizer cubicle13.

The associated cables, tubing and piping are protected from falling debris. Regulators, tubing, and control valves are all located in the pressurizer cubicle or below the EL 66. The PORV solenoid valves are inside the pressurizer cubicle with the PORVs. The location of the planned modification to install nitrogen back-up supply to the PORVs enhances protection from postulated failures of the CT.

11. FEEDWATER LINES, REACTOR COOLANT PRESSURE BOUNDARY and SAFETY INJECTION PIPING are below EL 66 and protected from CT truss debris.

13 Tubing from the fixed gas bottles is routed so that it penetrates the pressurizer cubicle wall on the 46' elevation. This ensures that all PORV pneumatic backup tubing outside of the pressurizer cubicle is below EL 66 ft. This reduces the risk of a loss of feed and bleed function due to falling debris.

40 of 163

PBN-BFJR-17-019 Rev. 1 5.2 SEISMIC DEMONSTRABLY CONSERVATIVE The Seismic CT Model is based on the NFPA 805 PRA models for Unit 1 and Unit 2. The NFPA 805 model includes the internal events model and the NFPA 805 compliant fire model. The model includes modification commitments made in the NFPA 805 LAR.

The assumptions developed in section 2.1.2 for the bounding case are applied with the following exceptions:

Penetrations below the 66 elevation are unlikely to be damaged by falling debris because they are protected by the floor and other robust barriers above this elevation. There are only a few penetrations above the 66 elevation, taking this into account reduces their effective exposed area to much less than 10%; refer to blue shaded region in figure 3. A conservative value of 0.10, is assumed to represent this smaller target area.

Modeling details and detailed results are provided in Attachment F:

Section Topic F.1 Seismic Model Overview F.2 How the model is quantified F.3 SSC Fragilities F.4 Event Tree Structure and Fault Tree details F.5 Top Event descriptions F.6 Sequence Descriptions F.7 Review of Top Events used in the Point Beach Seismic IPEEE F.8 Results F.9 Cutsets F.10 Importances F.11 Insights Summary of Results:

SEISMIC DEMONSTRABLY CONSERVATIVE CDF LERF UNIT CDF CDF-MODS CDF LERF LERF MODS LERF 1 1.23E-06 1.02E-06 2.15E-07 5.91E-07 5.39E-07 5.15E-08 2 1.24E-06 1.02E-06 2.17E-07 5.94E-07 5.43E-07 5.19E-08 Note: Values are based on application of ACUBE to cutset results. Refer to Attachment F for details.

The following uncertainty results were generated using UNCERT [Ref 4.0]. Unit 1 results presented, Unit 2 results are similar.

41 of 163

PBN-BFJR-17-019 Rev. 1 UNCERTAINTY CDF - U1 UNCERTAINTY CDF with Mods - U1 Parameter Estimate Confidence Range Parameter Estimate Confidence Range Point Est 1.20E-06 Point Est 9.93E-07 Samples 50000 Samples 50000 Mean 1.19E-06 [1.2E-06 , 1.2E-06] Mean 1.00E-06 [9.8E-07 , 1.0E-06]

5% 2.01E-07 [2.0E-07 , 2.0E-07] 5% 1.62E-07 [1.6E-07 , 1.6E-07]

Median 7.38E-07 [7.3E-07 , 7.4E-07] Median 5.99E-07 [5.9E-07 , 6.0E-07]

95% 3.48E-06 [3.4E-06 , 3.6E-06] 95% 2.94E-06 [2.9E-06 , 3.0E-06]

Standard Deviation 1.75E-06 Standard Deviation 1.94E-06 Skewness 9.49856 Skewness 27.75608 ACUBE TRUE ACUBE TRUE ACUBE Count 10000 ACUBE Count 10000 UNCERTAINTY LERF - U1 UNCERTAINTY LERF with Mods - U1 Parameter Estimate Confidence Range Parameter Estimate Confidence Range Point Est 5.54E-07 Point Est 5.06E-07 Samples 50000 Samples 50000 Mean 5.61E-07 [5.5E-07 , 5.7E-07] Mean 5.13E-07 [5.0E-07 , 5.2E-07]

5% 6.48E-08 [6.4E-08 , 6.6E-08] 5% 5.64E-08 [5.5E-08 , 5.7E-08]

Median 2.83E-07 [2.8E-07 , 2.9E-07] Median 2.54E-07 [2.5E-07 , 2.6E-07]

95% 1.77E-06 [1.7E-06 , 1.8E-06] 95% 1.61E-06 [1.6E-06 , 1.7E-06]

Standard Deviation 1.32E-06 Standard Deviation 1.25E-06 Skewness 20.64468 Skewness 23.88358 ACUBE TRUE ACUBE TRUE ACUBE Count 10000 ACUBE Count 10000 CDF based on 95% is 3.48E 2.94E-06 = 5.40E-07, well under the RG 1.174 guidelines for Region III.

LERF based on 95% is 1.77E 1.61E-06 = 1.60E-07, slightly over the RG 1.174 guidelines for Region III.

5.3 DEMONSTRABLY CONSERVATIVE THERMAL CASE The demonstrably conservative thermal case credits feed and bleed for decay heat removal, no other mitigating functions are credited. One of the key functions not included in the model is AFW, which will likely be available. Also, since there is no loss of offsite power, main feedwater will also likely be available for removal of decay heat.

Other changes made to the model:

Added failure of bleed and feed using two PORVs, OR gate GFB1170, under each of the CASE gates HEP-RCS-CSPH1-12 was changed to a new value with an error factor of 5. A new HEP calculation was developed - refer to Attachment B.

Changed rupture frequency on IA and SA tanks from 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The type code for IA/SA tank rupture was changed from demand to hour.

EVENT TREE CT-THERMAL-INITIATING EVENT Top event FEED AND BLEED COOLING (INCLUDING SI) was added to the GTHERMAL-CASES event tree

[section 2.3.4]. This top event represents the failure of bleed and feed cooling. It means that either 1 of 2 PORVs fail to open or 2 of 2 high head safety injection pumps fail to provide inventory makeup to the RCS.

42 of 163

PBN-BFJR-17-019 Rev. 1 The following table presents demonstrably conservative CDF results for each case, Case 1 dominates:

Demonstrably Conservative Case CDF (Top Event: GCT-CDF-CASES)

Case 1 1.43E-09/yr.

Case 2 4.40E-14/yr.

Case 3 3.95E-11/yr.

Case 4 1.15E-13/yr.

Case 5 2.13E-11/yr.

Total 1.49E-09/yr.

Applying ACUBE [Ref 22] to the top 1000 cutset generated by quantifying GCT-CDF-CASES reduced CDF to 1.40E-09/year.

Uncertainty results based on applying UNCERT 4.0 [Ref 24] and ACUBE [Ref 22] to the cutsets generated by quantifying GCT-CDF-CASES at a truncation of E-15:

DEMONSTRABLY CONSERVATIVE THERMAL ANALYSIS CDF UNCERTAINTY Parameter Estimate Confidence Range Point Estimate 1.40E-09 Samples (Monte Carlo) 50000 Mean 1.49E-09 [1.4E-09 , 1.6E-09]

5% 1.23E-11 [1.2E-11 , 1.3E-11]

Median 2.18E-10 [2.1E-10 , 2.2E-10]

95% 4.94E-09 [4.7E-09 , 5.1E-09]

Standard Deviation 1.49E-08 Skewness 85.39294 The cutsets for these cases were generated using the UNIT1-SEISMIC.caf model, solving gates GCT-CDF-CASES at E-15 truncation and then ACUBE [REF 22] was used to improve the accuracy of the minimal cut set 43 of 163

PBN-BFJR-17-019 Rev. 1 calculation by employing a Binary Decision Diagram method. Cutsets and importances are provided in Attachment E.

CDF equals CDF because the CT is assumed not to be overstressed for the thermal with mods case, therefore the associated CDF is assumed to be zero. The total CDF for the Demonstrably Conservative Thermal Case is 1.48E-09.

For thermal, LERF value applies assumption from section 2.1.3 which multiplies CDF by a factor of 0.5; therefore LERF = 7.40E-10.

6.0 DEMONSTRABLY CONSERVATIVE TOTAL RISK TOTAL DEMONSTRABLY CONSERVATIVE RISK CDF UNIT TOTAL Hazard CDF CDF-MODS CDF Seismic 1.23E-06 1.02E-06 2.15E-07 1 2.17E-07 Thermal 1.48E-09 0 1.48E-09 Seismic 1.24E-06 1.02E-06 2.17E-07 2 2.19E-07 Thermal 1.48E-09 0 1.48E-09 LERF UNIT TOTAL Hazard LERF LERF MODS LERF Seismic 5.91E-07 5.39E-07 5.15E-08 1 5.22E-08 Thermal 7.40E-10 0 7.40E-10 Seismic 5.94E-07 5.43E-07 5.19E-08 2 5.26E-08 Thermal 7.40E-10 0 7.40E-10 Note: Values are based on application of ACUBE [Ref 22] to cutset results. Refer to Attachment F for details.

44 of 163

PBN-BFJR-17-019 Rev. 1 7.0 SHUTDOWN RISK THERMAL TRANSIENTS The thermal transients were assumed to occur only during full power operations. The analysis bounds shutdown risk conditions:

CONTAINMENT BARRIER NOT INTACT: This condition would be bounded by the analysis for full power operations due to the extremely low probability of occurrence of a thermal event when the containment barrier could be breached for maintenance. Further, station operation would be limited to Modes 5, 6 or defueled during the postulated condition which limits RCS temperature to 200°F. The supporting engineering evaluations conclude the CTs or supported equipment remain structurally stable and capable of performing their design basis functions unimpeded.

MIDLOOP OPERATION: A LOCA during midloop operation would be bounded by the full power operation event. No MSLB event can occur at this condition. For the lesser LOCA event, the same need for F&B protection applies. No additional vulnerable targets are presented for the Residual Heat Removal System while operating in the decay heat removal mode. Very little time is spent in mid-loop operation.

SEISMIC EVENTS Seismic risk during a shutdown is minimized by the hazard exposure being roughly 4% to 8% of the full power operation exposure per year; assuming 1 to 2 month outage duration per 18 month fuel cycle.

45 of 163

PBN-BFJR-17-019 Rev. 1 8.0 PRA QUALITY 8.1 BOUNDING ANALYSIS The bounding analysis assumes that CT overstress due to a seismic or thermal event directly leads to core damage; CCDP = 1.0. As such the bounding analysis did not, nor did it need to, credit mitigating systems and operator actions, therefore a full scope PRA was not required. Only seismic and thermal hazard data and fragility data are used to calculate core damage and large early release probabilities.

The applicable ASME RA-Sa-2009 section is Part 5, Requirements for Seismic Events At-Power PRA [Ref.

10]. Compliance to these supporting requirements is documented in Attachment C; these requirements have not been peer reviewed and therefore there are no Facts & Observations (F&Os) from previous Point Beach peer reviews that apply to the bounding analysis.

The following elements were assessed against the ASME and RG 1.200 quality requirements, refer to Attachment C for detailed review:

Seismic Hazard Curve Seismic Fragilities Thermal Hazard Curve Thermal Fragilities Structural Calculations 8.2 DEMONSTRABLY CONSERVATIVE ANALYSIS (DCA)

The seismic and thermal DCA are based on the NFPA 805 PRA models for Unit 1 and Unit 2. The NFPA 805 model includes an internal events model and the NFPA 805 fire model. The model includes modification commitments made in the NFPA 805 LAR.

This PRA model has several open peer review findings. They are listed and dispositioned for this application in Attachment A. These are the same open peer review findings addressed in NRC 2017-0043 (10CFR50.69 LAR) and the forthcoming LAR for ILRT Surveillance extension.

46 of 163

PBN-BFJR-17-019 Rev. 1 9.0 UNCERTAINTIES 9.1 PARAMETER UNCERTAINTY Key parameter uncertainties in this analysis are associated with assumptions regarding failure of SSCs and operator actions impacted by seismic and thermal events as well as their associated hazard frequencies. These include:

Seismic Fragilities Seismic Hazard Frequency Thermal Hazard Frequency Key operator recovery actions Probability of SSCs being damaged by falling debris 9.1.1 HAZARD FREQUENCY Seismic hazard data used in this evaluation are from calculation PBN-BFJR-14-013. Hazard mean, 5%, and 95%

impact on CDF and LERF results for the bounding seismic case are as follows:

Mean Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 6.30E-06 1.58E-06 2.69E-06 7.20e-07 B All Design Basis Mods (Base CDF) 3.61E-06 8.64E-07 These values meet the Region II criterion of <1E-5 CDF and <1E-6 LERF 95% Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 2.35E-05 6.03E-06 9.83E-06 2.71e-06 B All Design Basis Mods (Base CDF) 1.36E-05 3.31e-06 CDF meets the Region II criterion of <1E-5 CDF, LERF value is slightly above Region I 5% Hazard Values MODIFICATIONS CDF CDF LERF LERF A Thermal Mod Unit 1, Unit 2 Unmodified 2.48E-07 4.31E-08 1.33E-07 2.45E-08 B All Design Basis Mods (Base CDF) 1.14E-07 1.86E-08 These values meet the Region III criterion of <1E-6 CDF and <1E-7 LERF 9.1.2 FRAGILITIES The following are the key component fragilities applied in this evaluation:

9.1.2.1 CT Am Values CT seismic fragility sensitivity was performed for Unit 1 demonstrably conservative seismic model by decreasing the median acceleration, Am, from 0.42 to 0.3 for the unmodified CT, and from 0.53 to 0.41 for the modified CT; both reduced by 0.12. CDF increased to 2.20E-07 from 2.10E-07 and LERF decreased to 2.92E-08 from 5.10E-08. The IPEEE CDF and LERF sensitivity values remain within RG 1.174 Region III.

% Change RISK CASE Base Am Sensitivity Am Sensitivity Am vs Base CDF 1.23E-06 1.47E-06 19.5%

CDF = 2.20E-07 CDF w/MODS 1.02E-06 1.25E-06 22.5%

LERF 5.91E-07 6.23E-07 5.4%

LERF = 2.92E-08 LERF w/MODS 5.40E-07 5.94E-07 10.0%

47 of 163

PBN-BFJR-17-019 Rev. 1 9.1.2.2 CT OVERSTRESS DUE TO A THERMAL EVENT A sensitivity was performed to evaluate the impact of changing the probability of failure as a function of temperature for the trusses on the bounding and demonstrably conservative risk calculations. The failure probabilities were increased by an order of magnitude. The bounding case for CDF increased from 4.83E-8 to 4.83E-7. The demonstrably conservative case CDF increased from 1.48E-9 to 1.48E-8. All cases were quantified using ACUBE at a truncation of 1E-15.

Data and curves associated with the thermal fragility curve sensitivity are provided below.

Unit 2 - As-found Configuration Probability of Failure vs. Temperature Probability of Failure vs. Temperature Probability of Probability of Temperature (°F) Failure Original Failure Sensitivity First Contact with Liner 211 1.00E-12 1.00E-11 260 2.00E-06 2.00E-05 Design Basis Temperature 286 0.001 0.01 First Fully Plastic Hinge 298 0.01 0.1 Capacity Limit (Sensitivity) 316 0.99 320 0.14 1.4 340 0.415 4.15 Capacity Limit (Original) 378 0.99 9.9 Unit 2 - As-found Configuration Probability of Failure vs. Temperature Probability of Failure vs. Temperature Probability of Probability of Temperature (°F) Failure Original Failure Sensitivity First Contact with Liner 211 1.00E-12 1.00E-11 Design Basis Temperature 286 0.001 0.01 First Fully Plastic Hinge 298 0.01 0.1 Capacity Limit (Sensitivity) 316 0.99 Capacity Limit (Original) 378 0.99 48 of 163

PBN-BFJR-17-019 Rev. 1 9.1.2.3 IPEEE FRAGILITIES VS UPDATED FRAGILITIES.

This evaluation applied updated or generic fragilities for components that have been modified to improve seismic ruggedness since the IPEEE was completed - refer to section F.3 for complete list of fragilities. In this sensitivity the original IPEEE values are applied wherever updated or generic fragilities were applied to bound fragility uncertainties. CDF increased to 5.02E-07 from 2.10E-07 and LERF increased to 8.62E-08 from 5.10E-08. The IPEEE CDF and LERF sensitivity values remain within RG 1.174 Region III.

Risk Risk Metric Change from Base UNIT 1 BASE,IPEEE ACUBE Metric Change  % Change G-CT-SEISMIC-CDF (BASE) 1.23E-06 CDF +8.05E-07 65%

G-CT-SEISMIC-CDF (IPEEE) 2.04E-06 G-CT-SEISMIC-LERF (BASE) 5.91E-07 LERF +1.85E-07 31%

G-CT-SEISMIC-LERF (IPEEE) 7.75E-07 Risk Metric UNIT 1 IPEEE Risk G-CT-SEISMIC-CDF (IPEEE) 2.04E-06 CDF 5.02E-07 G-CT-SEISMIC-CDF-MODS (IPEEE) 1.54E-06 G-CT-SEISMIC-LERF (IPEEE) 7.75E-07 LERF 8.62E-08 G-CT-SEISMIC-LERF-MODS (IPEEE) 6.89E-07 9.1.3 DAMAGE PROBABILITIES The behavior of the CT when overstressed was not explicitly evaluated, i.e. the extent to which the truss becomes unstable and deconstructs. The structural evaluations assumed that CT will remain stable; however this analysis postulated that the truss would deconstruct and the following key components would be impacted by falling CT debris. The probability of damage was evaluated in Attachment G for the following targets:

Main Steam Line piping Aux Feedwater piping Deck plate over in-core instrumentation Containment penetrations 9.1.3.1 MSL Break Probability Sensitivity - Realistic and Bounding A conservative value of 1.31E-01 was used in the Base Seismic DCA model. The purpose of this sensitivity is to show the change in core damage frequency using a realistic value of 4.13E-02 and a bounding value of 4.13E-01. MSL B break probabilities are used; they are larger than MSL A break probabilities.

For the bounding case CDF increased to 3.49E-07 from 2.10E-07 and LERF increased to 6.79-08 from 5.10E-08. For the realistic case CDF decreased to 1.89E-07 from 2.10E-07 and LERF decreased to 4.68-08 from 5.10E-08. For both cases the IPEEE CDF and LERF sensitivity values remain within RG 1.174 Region III.

The results are summarized in the tables below.

49 of 163

PBN-BFJR-17-019 Rev. 1 BOUNDING ACUBE G-CT-SEISMIC 1.66E-06 CDF 3.49E-07 G-CT-SEISMIC MODS 1.31E-06 G-CT-SEISMIC-LERF 6.99E-07 LERF 6.79E-08 G-CT-SEISMIC-LERF-MODS 6.31E-07 REALISTIC ACUBE G-CT-SEISMIC 1.14E-06 CDF 1.89E-07 G-CT-SEISMIC MODS 9.51E-07 G-CT-SEISMIC-LERF 5.58E-07 LERF 4.68E-08 G-CT-SEISMIC-LERF-MODS 5.11E-07 9.1.3.2 AFW Break Probability Sensitivity - Realistic and Bounding A conservative value of 1.45E-01 was used in the Base Seismic DCA model. The purpose of this sensitivity was to determine the change in core damage frequency if a realistic value of 7.37E-02 was used and a bounding value of 6.00E-01 was used.

For the bounding case CDF increased to 3.38E-07 from 2.10E-07 and LERF increased to 7.01-08 from 5.10E-08. For the realistic case CDF decreased to 1.95E-07 from 2.10E-07 and LERF decreased to 4.80-08 from 5.10E-08. For both cases the IPEEE CDF and LERF sensitivity values remain within RG 1.174 Region III.

The results are summarized in the tables below.

BOUNDING ACUBE G-CT-SEISMIC 1.68E-06 CDF 3.38E-07 G-CT-SEISMIC MODS 1.34E-06 G-CT-SEISMIC- 7.27E-07 LERF 7.01E-08 G-CT-SEISMIC-LERF-MODS 6.57E-07 REALISTIC ACUBE G-CT-SEISMIC 1.16E-06 CDF 1.95E-07 G-CT-SEISMIC-MODS 9.66E-07 G-CT-SEISMIC 5.66E-07 LERF 4.80E-08 G-CT-SEISMIC-LERF-MODS 5.18E-07 9.1.3.3 Seal Table Damage Probability Sensitivity - Realistic and Bounding A conservative value of 3.22E-02 was used in the Base Seismic DCA model. The purpose of this sensitivity was to determine CDF and LERF values when realistic and bounding values are used for seal table damage probabilities.

For the bounding case CDF increased to 4.01E-07 from 2.10E-07 and LERF increased to 7.29-08 from 5.10E-08. For the realistic case CDF decreased to 2.01E-07 from 2.10E-07 and LERF decreased to 4.94-08 from 5.10E-08. For both cases the IPEEE CDF and LERF sensitivity values remain within RG 1.174 Region III.

50 of 163

PBN-BFJR-17-019 Rev. 1 BOUNDING ACUBE G-CT-SEISMIC 1.80E-06 CDF 4.01E-07 G-CT-SEISMIC MODS 1.40E-06 G-CT-SEISMIC-LERF 7.10E-07 LERF 7.29E-08 G-CT-SEISMIC-LERF-MODS 6.37E-07 REALISTIC ACUBE G-CT-SEISMIC 1.19E-06 CDF 2.01E-07 G-CT-SEISMIC MODS 9.89E-07 G-CT-SEISMIC-LERF 5.79E-07 LERF 4.94E-08 G-CT-SEISMIC-LERF-MODS 5.30E-07 9.1.3.4 Containment Penetrations Assumption 2.1.3 assumed a bounding penetration target exposure of 0.5 and a conservative value of 0.1 which was applied to the demonstrably conservative cases. This sensitivity is being performed to see what the effect on LERF would be if the multiplier was increased to 0.5. The G-CT-SEISMIC-LERF cutset was recovered with a recovery rule file which increased the LERF values used for containment penetration fragility by a factor of 5. The LERF increased to 9.90E-0 vs base value of 5.10E-08. The 0.5 Sensitivity value remains within the RG 1.174 Region III.

Containment Penetration LERF LERF Target Exposure ACUBE G-CT-SEISMIC-LERF -0.1 5.91E-07 0.1 5.10E-08 G-CT-SEISMIC-LERF-MODS -0.1 5.40E-07 G-CT-SEISMIC-LERF -0.5 8.32E-07 0.5 9.90E-08 G-CT-SEISMIC-LERF-MODS - 0.5 7.33E-07 9.2 COMPLETENESS UNCERTAINTY This section assesses the completeness uncertainty associated with the demonstrably conservative models, seismic and thermal. The contributors not accounted for in the PRA model were reviewed and assessed quantitatively or qualitatively. Uncertainties are categorized as either being known, but not included in the PRA model, or unknown. Both known and unknown types of uncertainty are important.

The known completeness uncertainties that could have a significant impact on the predictions of the PRA include Initiating events, hazards, modes of operation, or component failure modes not included in the PRA.

9.2.1 POTENTIAL SIMULTANEOUS SEISMIC AND THERMAL EVENTS Simultaneous seismic and thermal events are not modeled; specifically, a seismic initiating event sequence which does not fail the CT but does lead to a thermal transient which then fails the CT.

This sensitivity used fragilities for Medium and Small LOCA from the RASP Handbook Volume 2, Table 4B-1 Generic SSC Seismic Fragilities. These fragilities were used to calculate the probability of a seismically induced medium or small LOCA. The following table summarizes the results.

51 of 163

PBN-BFJR-17-019 Rev. 1 BIN MLOCA MLOCA SLOCA SLOCA Seismic BIN Frequency Fragility Probability Fragility Probability INIT-%G01 3.04E-04 2.00E-09 6.08E-13 1.69E-07 5.14E-11 INIT-%G02 4.82E-05 1.00E-06 4.82E-11 2.50E-04 1.21E-08 INIT-%G03 1.01E-05 1.50E-04 1.52E-09 1.04E-02 1.05E-07 INIT-%G04 3.36E-06 4.10E-03 1.38E-08 4.69E-02 1.58E-07 INIT-%G05 1.54E-06 1.71E-02 2.63E-08 1.08E-01 1.66E-07 INIT-%G06 7.72E-07 3.07E-02 2.37E-08 1.78E-01 1.37E-07 INIT-%G07 4.34E-07 4.12E-02 1.79E-08 2.66E-01 1.15E-07 INIT-%G08 2.56E-07 5.30E-02 1.36E-08 3.79E-01 9.7E-08 INIT-%G09 1.54E-07 6.80E-02 1.05E-08 5.22E-01 8.04E-08 INIT-%G10 3.36E-07 9.10E-02 3.06E-08 7.35E-01 2.47E-07 TOTAL 1.38E-07 TOTAL 1.12E-06 The main steam pipe and feedwater pipe inside containment is Seismic Category I. Therefore the fragility of the main steam pipe and feedwater pipe inside containment is likely similar to the MLOCA fragility. With this assumption then contribution to the total thermal initiating events frequency from main steam line break is ~1.38E-07 and feedwater line break would also be ~1.38E-07. The total contribution to thermal events from seismic events is therefore 1.53E-06. Conservatively assuming the seismically mounted main steam and feedwater pipe has the same fragility as the SLOCA, the total contribution to thermal events from seismic events would be 3.49E-06.

Given the thermal initiating event frequency is 1.88E-03 [Ref section 2.3.2.4] and the low probability of core damage given the initiating event, contribution of seismically induced LOCAs, main steam pipe breaks and feedwater pipe breaks is screened.

9.2.2 CONTRIBUTORS OR EFFECTS THAT ARE KNOWINGLY LEFT OUT OF THE MODEL INITIATING EVENTS: Section 2.1.4.2 provides a basis for exclusion of initiators from the Thermal model.

IPEEE TOP EVENTS: Attachment 7 provides a basis for excluding specific IPEEE seismic model top events from the DCA seismic model.

9.2.3 MODES OF OPERATION THAT ARE NOT ASSESSED Shutdown risk was not evaluated; the basis is provided in section 7.0.

9.2.4 LEVEL OF DETAIL THAT IS LIMITED IN THE PRA MODELS Table in attachment F, section F.6, provides a review of top events considered in the IPEEE seismic PRA. Each event is dispositioned for inclusion or exclusion in the seismic model used in this evaluation.

Section 2.1.4.2 provides a table listing the initiating events used in the base Point Beach PRA. Each event is evaluated for inclusion or exclusion in the thermal model used in this evaluation.

9.2.5 PHENOMENA, FAILURE MECHANISMS, OR OTHER FACTORS NOT EXPLICITLY MODELED 52 of 163

PBN-BFJR-17-019 Rev. 1 9.2.5.1 CONSTRUCTION TRUSS OVERSTRESS There are several uncertainties that indicate a more realistic analysis would conclude the truss would very likely remain stable during a thermal or seismic event or result in minimal debris dislocating off the truss. These uncertainties include:

A. INTEGRITY OF THE TRUSS WHEN OVERSTRESSED. The integrity of the truss when overstressed has not been evaluated phenomenologically, i.e. the level to which an overstressed truss remains intact, collapses, or breaks apart into elemental components. Evaluating these phenomena is not practical given the level of information needed for the truss constituent components and the extensive structural analysis needed to realistically characterize the truss during various seismic and thermal events. To establish a reasonable and bounding perspective on the consequence of a truss overstress event, the truss is assumed to break apart into truss sections and cross members.

Details on the inputs and assumptions used are provided in the Target notebook.

B. SEISMIC LOADING DIRECTION. Seismic calculations, references 12c and 12d, note the following:

Upon inspection of the layout of the CT, a critical direction for the load case without liner contact is taken to be acceleration in the direction 10° east of North. Applying the seismic loading in this direction results in the greatest load in the T2 bottom chords. Since the maximum loading direction is related to the random nature of the seismic event, it is likely that the CT structure will not experience seismic loading in the critical direction; i.e. loads vary with seismic load direction.

Although detailed structural calculations have not been performed for other loading directions, it is reasonable to assume that the capacity of the CT in other loading directions would be greater than the critical direction of 10°.

9.2.5.2 FEED & BLEED SUCCESS with TWO STEAM LINE BREAKS Some uncertainty exists as to whether or not a second steam line break can be mitigated. A sensitivity was performed to assess the overall impact of all SLB2 failures leading to core damage.

This sensitivity was quantified by adding in sequence CT-SEISMIC-51 to the core damage gates which resulted in all SLB2 sequences leading to core damage. Sequence CT-SEISMIC-51 is the only sequence listed in Section F.6 that does not result in core damage. The results are provided below:

UNIT 1 SLB2=CORE DAMAGE ACUBE G-CT-SEISMIC-CDF 1.28E-06 CDF 2.45E-07 G-CT-SEISMIC-CDF-MODS 1.04E-06 G-CT-SEISMIC-LERF 5.86E-07 LERF 5.13E-08 G-CT-SEISMIC-LERF-MODS 5.35E-07 The CDF and LERF values are slightly above their respective base values and still within RG 1.174 Region III.

53 of 163

PBN-BFJR-17-019 Rev. 1 9.2.6 TRUNCATION Truncation levels used in this analysis show convergence towards a stable result. Cases listed are for Unit 1, Unit 2 CDFs are very close to Unit 1 values therefore the same truncation limits apply.

Convergence can be considered sufficient when successive reductions in truncation value of one decade result in decreasing changes in CDF or LERF, and the final change is less than 5% [ASME/ANS RA-Sa-2009, supporting requirement QU-B3].

Convergence is not relevant for bounding analyses since no cutsets were generated.

UNIT 1 CASES ACUBE  % Increase SEISMIC DCA G-CT-SEISMIC-CDF (E-10) 1.1861E-06 G-CT-SEISMIC-CDF (E-11) 1.2205E-06 2.90%

G-CT-SEISMIC-CDF (E-12) 1.2336E-06 1.07%

G-CT-SEISMIC-LERF (E-10) 5.5202E-07 G-CT-SEISMIC-LERF (E-11) 5.8112E-07 5.27%

G-CT-SEISMIC-LERF (E-12) 5.9064E-07 1.64%

THERMAL TABLE 10 GTHERMAL-CASES (E-11) 3.46149E-03 GTHERMAL-CASES (E-12) 3.46150E-03 0.00%

GTHERMAL-CASES (E-13) 3.46150E-03 0.00%

THERMAL BOUNDING GCT-IE-FRAG-CASES (E-13) 4.83183E-08 GCT-IE-FRAG-CASES (E-14) 4.83226E-08 0.01%

THERMAL DCA GCT-CDF-CASES (E-13) 1.47289E-09 GCT-CDF-CASES (E-14) 1.48165E-09 0.59%

GCT-CDF-CASES (E-15) 1.48385E-09 0.15%

54 of 163

PBN-BFJR-17-019 Rev. 1 9.3 MODEL UNCERTAINTY The following steps were used to evaluate Model Uncertainty:

Step 1: Identify Sources of Model Uncertainties and Related Assumptions in the BASE PRA - The base PRA is reviewed to identify and characterize the sources of model uncertainty and related assumptions. Some sources- may-be generic, and some may be plant specific. These sources of model uncertainty and related assumptions are those that result from developing the PRA.

Step 2: Identify Sources of Model Uncertainties and Related Assumptions RELEVANT TO DECISION - The sources of model uncertainty and related assumptions associated with the base PRA are reviewed to identify those that are relevant to the decision under consideration. New sources of model uncertainty and related assumptions that may be introduced by the application also are identified. This identification is based on an understanding of the type of application and the associated acceptance guidelines.

Step 3: Identify Sources of Model Uncertainties and Related Assumptions KEY TO THE DECISION - The sources of model uncertainty and related assumptions that are relevant to the decision are reviewed to identify those that are key to the decision. This review involves performing a quantitative analysis to identify the importance of each relevant source.

The model three review steps are documented in the Disposition column in the following table.

55 of 163

PBN-BFJR-17-019 Rev. 1 SOURCES OF MODEL UNCERTAINTIES and RELATED ASSUMPTIONS in the BASE PRA Assumption/ Uncertainty Discussion Disposition In the evaluation of the frequency of a stuck This is a typical assumption used in data analysis. If no failures are in the plant- Is it Relevant to Decision [Yes/No]:

open safety valve on the pressurizer (which is a specific database, it is assumed that there are 0.5 failures in the next demand. Yes.

contributor to medium LOCA) there have been This assumption has a conservative but minor impact in the resulting mean value.

no cases in which the safety valves have opened This does not require evaluation. If YES, Is it Key to Decision [Yes/No]:

1 during a trip. Therefore, it is conservatively No. Thermal initiating event frequency is 1.88E-3. Probability of a assumed that 0.5 openings occurred in all the stuck open safety valve on the pressurizer is 5.07E-5/reactor year trip events in the historical record. per Section 4.2.2 of PRA Notebook 2.0, Initiating Events Notebook, Rev. 7. This would increase the CDF and LERF by about 3.5% which is not risk significant.

The SBO event tree assumes SI is required for all It is assumed in the SBO event tree that SI is required for all success. While this is Is it Relevant to Decision [Yes/No]:

success sequences to address RCP seal leakage, conservative for very short SBO events, in general SBO events are of sufficient No. There are no SBO events in the cutsets.

2 even if power is restored early. duration that an RCP Seal LOCA would occur, requiring primary makeup. Since SBO is dominated by failure to recover power, this has essentially no discernable impact and does not require evaluation.

For the ventilation system of the PAB electrical This ventilation system is new to the PRA. It was added based on recent room Is it Relevant to Decision [Yes/No]:

equipment rooms, the model assumes that loss heatup calculations that were evaluated in the HVAC PRA Notebook. The air No. There are no PAB electrical equipment room fan events in of air inlet to the air handling unit from the handling units take suction from the turbine building duct and supply air to the the cutsets.

turbine building duct or recirculation line will battery charger rooms. Heat is removed by the air passing through chiller units lead to system failure. that are cooled by service water. Loss of makeup air from the turbine hall will 3 decrease the quantity of air flow due to leaks and also increase the heat load on the chiller units. Normal operation of the system relies on cool air from the turbine hall being mixed with hot air being exhausted from the rooms.

Continuous recirculation without make-up will result in increasing room temperatures and eventual equipment failure.

During the injection phase of RHR system The assumption states that the RHR pumps do not require CCW during the Is it Relevant to Decision [Yes/No]:

operation, it is assumed that component cooling injection phase, when suction is taken from the refueling water storage tank. The No. This assumption realistically models the plant system water to the RHR pumps and heat exchangers is Loss of CCW event tree does not credit RHR since CCW is required for the design.

4 not required for successful system operation. recirculation phase. In the remaining event trees, even if RHR injection is successful, RHR recirculation mode is failed without CCW and this is directly modeled in the system fault tree. This is realistic and does not require evaluation.

During the recirculation phase of RHR system This assumption for the CCW pumps to provide cooling to the RHR pumps when Is it Relevant to Decision [Yes/No]:

operation, it is assumed that component cooling in recirculation mode is conservative. The RHR pump seals would not fail No. This assumption realistically models the plant system design.

to the RHR pumps and heat exchangers is immediately on a loss of CCW. RHR pump seal failure without CCW would occur 5 required for successful system operation. The sometime between the start of RHR recirculation and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This level of RHR heat exchangers are also required to modeling is consistent with the development of all of the accident sequences remove decay heat from the containment sump (PRA mission time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) and does not require evaluation.

water to provide core cooling.

Operator actions to control AFW flow later in an Current HRA practice is to assume that if the operators successfully control flow Is it Relevant to Decision [Yes/No]:

accident sequence are not explicitly modeled in initially they will do so correctly for the remainder of the mission time; therefore, 6 the AFW system fault trees. failure to control feedwater flow late in an accident sequence is not modeled. Yes Perform a quantitative analysis to identify the importance:

Ran a sensitivity where failure of all AFW pumps to run from 2-24 56 of 163

PBN-BFJR-17-019 Rev. 1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was set to 0.1. This is equivalent to failure to control flow from the pump long term since the failure of the AFW system long term has the same effect whether the failure is due to the pump or the failure to control flow. The CDF went from 1.234E-06 to 1.275E-6, About a 4E-8 change which is not significant.

The HEP for operator failure to close This assumption impacts only the LERF model. The timing of this operator action Is it Relevant to Decision [Yes/No]:

containment isolation valves following the was developed based on Large LOCA and applied to all LOCAs. For vessel rupture Yes.

failure of the valves to automatically close is LOCA, there would be insufficient time to perform this action. A sensitivity modeled in the PRA. analysis performed by failing this action resulted in negligible change to LERF. If YES, Is it Key to Decision [Yes/No]:

Yes. Vessel rupture due to seismic event is a rare event and assume to directly lead to core damage. However, the original sensitivity case is for setting the HEP for containment isolation to failure for LOCA events (not vessel rupture). The isolation action is 7 important to the LERF results.

If Yes Perform a quantitative analysis to identify the importance:

The HEP for operator to close containment isolation valve is integral to the CIS (Containment Isolation System) fragility. The importance of the HEPs is provided in Attachment F.10 and sensitivities performed in section 9.4 Case 1.

Failures of expansion joints are not modeled in An estimation of expansion joint failure rate is negligible when compared to other Is it Relevant to Decision [Yes/No]:

the fire protection system fault tree. mechanical failure modes of components in the fire protection system.

Therefore, the expansion joint failures are considered to be captured within the Yes. Perform a quantitative analysis to identify the importance:

8 error factor of the failure rate coefficients for those other components. Inclusion A sensitivity was run using expansion joint failures. Assuming two of expansion joint failures would have a negligible impact on the results. expansion joints per fire pump. Core damage frequency for DCA seismic did not change.

The cycle time for the instrument air dryers was The assumption states that for the instrument air dryers it is conservatively Is it Relevant to Decision [Yes/No]:

assumed to be 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Demand failures assumed that the cycle time for the dryers is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

9 occurring with the cycling include fail-to-close No. Instrument air is assumed failed for seismic and thermal and fail-to-open. Additionally, the system would not be failed immediately if moist air were to pass events after CT overstress through the system. This is a realistic estimate.

The mission time for battery-operated Actual battery life is expected to be greater than one hour, which conservatively Is it Relevant to Decision [Yes/No]:

components is one hour. supports the one hour mission time for the batteries. Within this time frame the Yes.

diesel generators need to be successfully supplying their design basis loads such 10 that the buses can be transferred to operate off of the diesels. If YES, Is it Key to Decision [Yes/No]:

No. Mission Time for the batteries has been increased to 3.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> reducing the conservatism and making the CT model realistic.

RCS pressure is considered to be high at the time For the transient and SGTR event trees, core damage is only reached when Is it Relevant to Decision [Yes/No]:

of core damage for transient and SGTR events. depressurization is successful but long term cooling is not successful and there is Yes.

no primary system injection. In these cases, the primary system would re- If YES, Is it Key to Decision [Yes/No]:

pressurize. No.

11 If NO, provide basis:

CT related LERF scenarios come about by truss failure and impingement on structures/piping penetrations and causing 57 of 163

PBN-BFJR-17-019 Rev. 1 containment isolation failures. Sequences with RCS pressure high at the time of core damage will not affect the CT-induced failures of containment isolation. SGTR failures induced by seismic events are very low probability and were screened out at a HCLPF of 0.3g in the IPEEE.

To determine the impact, added the SGTR events which lead to core damage from CDF directly to LERF, essentially making them bypass sequences. Note: did not subtract SGTR events from LERF, so they were conservatively double counted. Also did not take credit for the MSIVs which would reduce the leakage to below LERF (equivalent 2 inch break size) especially since they are holding leakage from containment pressure following the steam line break,

~100 psid vs design steam pressure of ~1,000 psid. With all this conservatism, the total change in LERF if every SGTR event which leads to core damage also leads to LERF would be 2.34E-8. Not a risk significant change to LERF Stuck open PORV/PSV and Large RCP seal LOCA Conservative. LERF would be reduced because assuming high pressure will Is it Relevant to Decision [Yes/No]:

sequences have depressurization capability. minimize containment pressurization time and maximize containment pressure. No. The CT model does not use high pressure or low pressure 12 However, these sequences have conservatively as an input to LERF, consideration of high pressure or low been assumed to have high RCS pressure in the pressure is irrelevant.

PBNP LERF model.

RCS pressure is considered to be high at the time Conservative. Assuming high pressure will minimize containment pressurization Is it Relevant to Decision [Yes/No]:

of core damage for Transient and SGTR events. time and maximize containment pressure. Yes.

If YES, Is it Key to Decision [Yes/No]:

No.

If NO, provide basis:

CT related LERF scenarios come about by truss failure and impingement on structures/piping penetrations and causing containment isolation failures. Sequences with RCS pressure high at the time of core damage will not affect the CT-induced failures of containment isolation. SGTR failures induced by seismic events are very low probability and were screened out at a HCLPF of 0.3g 13 in the IPEEE.

To determine the impact, added the SGTR events which lead to core damage from CDF directly to LERF, essentially making them bypass sequences. Note: did not subtract SGTR events from LERF, so they were conservatively double counted. Also did not take credit for the MSIVs which would reduce the leakage to below LERF (equivalent 2 inch break size) especially since they are holding leakage from containment pressure following the steam line break,

~100 psid vs design steam pressure of ~1,000 psid. With all this conservatism, the total change in LERF if every SGTR event which leads to core damage also leads to LERF would be 2.34E-8. Not a risk significant change to LERF.

All core damage accident class sequences in Conservative. A PI-SGTR is only of concern if the RCS is at high pressure and a SG Is it Relevant to Decision [Yes/No]:

14 which core damage occurs at high reactor is depressurized to atmospheric pressure. Not all sequences have SG Yes.

58 of 163

PBN-BFJR-17-019 Rev. 1 pressure, and the steam generators are dry at depressurized to atmospheric pressure.

the time of core damage are assumed to have If YES, Is it Key to Decision [Yes/No]:

the potential to lead to pressure-induced SGTR. No. Since none of the CT accident sequences involve successful RCS depressurization without injection or cooling, the assumption does not impact the results.

For simplicity, it is assumed that all Steam This is conservative since LERF would be reduced if scrubbing by AFW was Is it Relevant to Decision [Yes/No]:

Generator Tube Rupture (SGTR) and Interfacing credited or ISLOCAs credited auxiliary building room flooding. No. The CT issue only impacts containment isolation failure leading Systems LOCA (ISLOCA) initiated events are to LERF. Therefore, these assumptions regarding all ISLOCAs and containment bypass scenarios. SGTR lead to bypass have no impact on LERF calculation resulting 15 from the CT issue. The CT model credits main steam isolation for Steam Generator Tube rupture. Interfacing Systems LOCA (ISLOCA) were not modeled since the CT deconstruction does not to lead to an ISLOCA.

Systems without cable tracing are failed unless This assumption introduces uncertainty. While this is a conservative approach, Is it Relevant to Decision [Yes/No]:

further analysis was performed to assure the tracing of cables is an intense process requiring additional effort. This No. The transient is the deconstruction of the CT. Cable tracing systems are not compromised by the transient assumption is reviewed during the quantification process. for equipment needed for bleed, feed and high head SI 16 or fire (credit by exception). recirculation was performed. Fire only applies to NFPA 805 model quantification.

Instrument Air system is assumed failed for the This assumption over-predicts CDF and LERF. Is it Relevant to Decision [Yes/No]:

17 fire PRA model. No. Fire model assumption does not impact the CT model.

HEAF and bus duct fires are assumed to damage This assumption is conservative with respect to CDF and LERF, and contributes Is it Relevant to Decision [Yes/No]:

18 fire wrap and fire rated cables, negating fire uncertainty to the analysis. No. This only applies to NFPA 805 model quantification.

rating for these fire scenarios.

For fires in a single electrical cabinet, it is Although electrical cabinet fires that spread to adjacent cabinets can be manually Is it Relevant to Decision [Yes/No]:

assumed that a fire would damage all cables and suppressed to inhibit the spread of the fire, it is assumed that there is insufficient No. This only applies to NFPA 805 model quantification.

components within the cabinet. No probability time for suppression of a single cabinet fire.

19 of non-suppression is calculated for single cabinet fires as damage is assumed at ignition time.

59 of 163

PBN-BFJR-17-019 Rev. 1 9.4 IPEEE UNCERTAINTY ANALYSIS The following four sensitivity analyses were performed for the IPEEE seismic model. Each is reviewed for applicability to this evaluation.

CASE 1: Random and operator failure rates set to zero.

There were two objectives for this sensitivity analysis:

1. Determine a measure of the plant HCLPF based only on the seismic structural integrity of the plant (random failures and operator actions removed from the model). This does not apply to this evaluation -

HCLPF is not in scope for this analysis.

2. Assess the significance of non-seismic random failures and operator actions in the SPRA. This does apply.

This same sensitivity was performed on the demonstrably conservative seismic evaluation:

Seismic DCA HEP Sensitivity - HEPS ALL SET EQUAL TO ZERO. Truncation limit = 1E-12.

HEPs All Set Equal To Zero ACUBE G-CT-SEISMIC-CDF 1.11E-06 CDF 1.93E-07 G-CT-SEISMIC-CDF-MODS 9.19E-07 G-CT-SEISMIC-LERF 5.30E-07 LERF 4.45E-08 G-CT-SEISMIC-LERF-MODS 4.85E-07 CDF and LERF are slightly lower than the base values because risk is dominated by equipment failures and induced small LOCA due to the seismic event.

Seismic DCA HEP Sensitivity - HEPS ALL SET EQUAL TO 1. Truncation limit = 1E-10.

HEPs All Set Equal To 1.0 ACUBE G-CT-SEISMIC-CDF 4.60E-06 CDF 1.65E-06 G-CT-SEISMIC-CDF-MODS 2.96E-06 G-CT-SEISMIC-LERF 9.95E-07 LERF 1.45E-07 G-CT-SEISMIC-LERF-MODS 8.50E-07 CDF and LERF are significantly higher than their respective base values but within the guidelines for RG 1.174 Region II.

The basic events in the following table are the top 20 ranked F-V importances (After removing flags, sequence markers). It can be seen that starting an AFW pump from the control room is important, as are aligning the battery chargers.

Page 60 of 163

PBN-BFJR-17-019 Rev. 1 Event Probability FV BirnBm Red W RAW Description FAILURE TO MANUALLY START AFW PUMP HEP-AF--STARTPMP-SEIS-LO 1.00E+00 0.75614 3.66E-06 1.2414 1 SEISMIC LOW OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER HEP-125-BAT-CHG-SEIS-LO 1.00E+00 0.72168 2.95E-06 1.186 1 FROM CR SEISMIC LOW OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER HEP-125-COG-SEIS-LO 1.00E+00 0.72168 2.95E-06 1.186 1 SEISMIC LOW SLB 1.31E-01 0.66667 5.97E-06 1.0737 1.248 CT INDUCED SLB AFWLB 1.45E-01 0.62474 4.80E-06 1.0599 1.198 CT BREAKS AFW PIPE CT FRAGILITY UNMODIFIED FRAG-%G03-UNMODIFIED 1.55E-01 0.5032 1.01E-05 2.0129 1.033

%G03 SEISMIC INITIATING EVENT %G03 INIT-%G03 1.01E-05 0.5032 9.39E-01 2.0129 49822.657 PGA RANGE 0.23G TO <0.34G FRAG-LOOP-%G03 4.48E-01 0.50153 9.59E-06 1.9124 1.032 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G03 FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE).

HEP-RCS-CSPH1-12-SEIS-LO 1.00E+00 0.44977 7.47E-07 1.0413 1 AFTER N2 MOD. LOW SEISMIC OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND HEP-HHR-EOP13L34-SEIS-LO 1.00E+00 0.44286 7.37E-07 1.0407 1 PART SEISMIC LOW OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST HEP-HHR-EOP13L60-SEIS-LO 1.00E+00 0.44286 7.37E-07 1.0407 1 PART SEISMIC LOW HEP-AF--CST--LOW-SEIS-LO 1.00E+00 0.4277 6.57E-07 1.0361 1 CST LEVEL MONITORING FAILS SEISMIC LOW HEP-AF--CST-SWMD-SEIS-LO 1.00E+00 0.42763 6.57E-07 1.0361 1 Pe FOR SW SUPPLY TO MDAFW SEISMIC LOW AFW DIESEL DRIVEN PUP FAILS TO RUN AFTER THE FIRST FP--DDP-FT--P805 5.07E-02 0.34676 3.24E-06 1.0129 1.159 HOUR IRB-INDUCED-SGTR 2.70E-02 0.33237 5.23E-06 1.0123 1.265 INDUCED STEAM GENERATOR TUBE RUPTURE OPERATOR FAILS TO ALIGN G-04 TO 1A-06 UNIT 1 HEP-416-G04-1A06-SEIS-LO 1.00E+00 0.33022 3.51E-07 1.019 1 SEISMIC LOW DG--DG--FR---G03 6.28E-02 0.3211 2.34E-06 1.0109 1.114 DIESEL GENERATOR G-03 FAILS TO RUN XHOS-NO-B08-P38 1.00E+00 0.24945 1.30E-07 1.0069 1 HOUSE EVENT FOR NO B08 SUPPLY TO P38 PUMPS DG--DG--FT---G03 4.10E-02 0.24425 2.16E-06 1.0066 1.108 DIESEL GENERATOR G-03 FAILS TO RUN IN HOURS 2-24 FP--DDP-TM-P805 2.41E-02 0.22013 3.03E-06 1.0057 1.155 AFW DIESEL-DRIVEN PUMP TEST AND MAINTENANCE CASE 2: USI A-46 Outlier Resolution Program Fixes The USI A-46 Outlier program identified improvements that would make seismically sensitivity components more rugged. Improvements were made to the plant as shown in Attachment F, section F.3. Since the A-46 program issues were already dispositioned or implemented a new sensitivity is not applicable.

CASE 3: Use of the EPRI Seismic Hazard Estimate Curves The hazard curves used in this analysis are based on the following references:

Generic Issue 199 (GI-199) Implications of Updated Probabilistic Seismic Hazard Estimates in Eastern United States on Existing Plants Safety/Risk Assessment, August 2010.

Lettis Consultants International (LCI) Project Report Point Beach Seismic Hazard and Screening Report, Calculation of Seismic Hazards for CEUS Sites, Project No. 1041, Nicholas Graehl.

These references provide the industry standard reference for plant specific hazard curves. No other hazard curves of the same pedigree are available and as such this sensitivity does not apply.

CASE 4: Choice of the combined uncertainty measure c used in the analysis.

The IPEEE describes the issue as follows:

The issue being debated is whether PBNP ground motion is more characteristic of a West Coast or East Coast site. The concern that was expressed was that using a value of c that was too small might underestimate the Page 61 of 163

PBN-BFJR-17-019 Rev. 1 seismic CDF by an order of magnitude or more. In fact, the results showed that the HCLPF and median capacities dropped slightly (0.16 to O.l5g, and 0.45 to 0.43g) and the CDF increased by 8 percent.

The demonstrably conservative seismic model was quantified using various c values listed in the table below.

c ACUBE 0.35 1.25E-06 Base Case 0.40 1.23E-06 0.45 1.22E-06 0.50 1.21E-06 The results show that the CDF is relatively insensitive to variation in c.

Page 62 of 163

PBN-BFJR-17-019 Rev. 1

10.0 REFERENCES

1. CN-CRA-08-43 Rev 01,and Rev 01-A, Point Beach EPU: Units 1 (WEP) and 2 (WIS) SLB Containment Response

2. EPRI FRANX version 4.3

3. Point Beach Construction Truss Target Assessment, PBN-BFJR-17-020 Rev 1.

4. NRC 2014-0024 March 31, 2014, ML14090A275, NextEra Energy Point Beach. LLC Seismic Hazard and Screening Report (CEUS Sites) Response NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident

5. RSM-112013-037 Point Beach Hazard and Screening Report from EPRI

6. S&A calculation 11Q0060-C-028, Seismic Fragility Analysis of Containment Dome Trusses

7. CN-CRA-07-55, Rev. 0, Point Beach GOTHIC Containment Model for LOCA and MSLB Analysis

8. Reference (DG-M03, Bechtel Piping Class Summary)

9. Seismic Probabilistic Risk Assessment Implementation Guide, EPRI TR 3002000709

10. ASME RA-Sa-2009, Addenda to ASME/ANS RA-S-2008Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications

11. POD 02131629-02; U1 & U2 SEISMIC

12. Structural Calculations

a. 11Q0060-C-022, Thermal Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR

b. 11Q0060-C-023, Thermal Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR

c. 11Q0060-C-024, Seismic Evaluation of Unit 1 Containment Dome Truss in Support of Risk Informed LAR

d. 11Q0060-C-025, Seismic Evaluation of Unit 2 Containment Dome Truss in Support of Risk Informed LAR

e. 11Q0060-C-030, Probability of Failure vs. Temperature for Unit 1 Containment Dome Truss in Support of Risk Informed LAR

f. 11Q0060-C-031, Probability of Failure vs. Temperature for Unit 2 Containment Dome Truss in Support of Risk Informed LAR

13. Modifications EC284214 (Unit 2) and EC285145 (Unit 1)

14. Point Beach EPU: Units 1 (MP) and 2 (WIS) SLB Inside Containment Response. CN-CRA-08-43 Rev 01

15. Point Beach Nuclear Plant Engineering Evaluation 2017-0008, Technical Summary of Methodology and Criteria to Determine the Strength Capacity of the Containment Dome Trusses and Attached/Adjacent Components in Support of License Amendment Request 278

16. Point Beach IPEEE, Wisconsin Electric to USNRC, letter VPNPD-95-056 dated 6/30/95

17. POD 01962836-01; AR: 01962836, Unit 1 Dome Truss and Containment Gap is Less than Expected (Unit 2 Extent of Condition)

18. POD 01986553-01; AR: 01986553 Unit 2 Dome Truss to Containment Liner Gap As-Found Measurements

19. AR # 02193313, LEVEL 1 ASSESSMENT - Background Document for Point Beach All Hazards Table Evaluation.

20. PBN-BFJR-14-013, Point Beach Seismic CDF Estimate

21. CAFTA 6.0b User Manual

22. ACUBE 2.0 User Manual

23. EPRI 3002000079, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments, Revision 3, Dated April 2013.

24. UNCERT 4.0 User Manual

25. RASP (Risk Assessment of Operational Events Handbook), Volume 2 - External Events Internal Fires -

Internal Flooding - Seismic - Other External Events Frequencies of Seismically-Induced LOOP Events.

ML080300179.

26. Point Beach Construction Truss Human Reliability Analysis, Document No.: PBN-BF-JR-18-022.

Page 63 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT A OPEN FINDINGS These findings apply to the demonstrably conservative seismic and thermal PRA models - refer to section 5.0.

Finding Supporting Capability Description Disposition for this Applications

1. Requirement(s) Category No impact on this application The loss of a single 4.16 kV AC bus does not result in a unit trip; therefore, this is not an initiating event.

Loss of HVAC was evaluated in PRA 5.25 notebook.

The evaluation for some critical areas was revised, IE-A1 PRA lacked systematic approach and documentation for treatment Not Met and for some areas fault tree models were IE-A1- IE-A5 of special initiating events. Examples given included loss of a 4kV developed to evaluate the impact of the loss of 01 IE-B2 bus, loss of HVAC. Discussion in the PRA documentation needs HVAC. These calculations provide a quantitative IE-D2 more explanation for why not all special initiators were included.

basis that these HVAC systems do not contribute and need not be modeled.

This finding does not affect this application since loss of a 4160VAC vital bus would not create a thermal transient that would challenge the construction truss thermally or seismically No impact on this application.

Some of the electrical load limitations that existed AS-B6 at the time this finding was written are no longer in SY-A5 Not Met place. The remaining electrical load limitations AS-B6- Electrical limitations, e.g., load management failures, may need to SY-A21 were reviewed during the preparation of the 01 be considered in PRA model.

SY-B6 Surveillance Frequency Control Program LAR where SY-B15 it was determined that no limitations were needed in the PRA model. Therefore, there is no impact on this application..

IMPACTS APPLICATION.

Battery depletion time changed to be more realistic. Other changes not implemented have a conservative impact on this application.

The current DC battery model allows for only limited recovery of offsite power, i.e., the recovery of offsite power does not account for the extra time afforded by battery depletion. This method could result in conservative CDF and LERF values Not Met Inadequate treatment of time-based dependencies, e.g., recovery and potentially underestimate the delta-risk AS-B7-AS-B7 of offsite power, HVAC treatment, and battery depletion associated with batteries. It should not have a 01 treatment. similar impact on the delta-risk calculated for other SSCs.

Recovery of offsite power is not included in this application. Realistic modeling of DC power depletion has been revised such that battery depletion is currently calculated to take 3.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> instead of the previous 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 3.1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> battery life has been used in the construction truss models.

SY- No impact on this application SY-A21 Not Met Excessive electrical loading concerns A21-01 See response to AS-B6-01.

Page 64 of 163

PBN-BFJR-17-019 Rev. 1 Finding Supporting Capability Description Disposition for this Applications

1. Requirement(s) Category NOT A SIGNIFICANT IMPACT ON THE APPLICATION BASED ON SENSITIVITY EVALUATION.

The treatment of pre-imitators was reviewed during the preparation of the Surveillance Frequency Control Program LAR where it was determined that the significant pre-initiators were evaluated properly and no further model changes HR-D1- Not Met Screening pre-initiators values were used in the model. Use of HR-D1 were required.

01 screening values for all pre-initiators only meets CC I.

A sensitivity was performed which reset all pre-initiators in the demonstrably conservative seismic CDF cutsets to 0.99. The CDF increased from 1.23E-6 to 1.37E-6, a negligible change in CDF. Based on the sensitivity, this finding does not have a significant impact on the application. There was no change to the demonstrably conservative thermal CDF cutsets.

LE-C9 No impact on this application LE-C10 Not Met LE-C9- No justification provided for equipment survivability or human This finding does not affect the use of the PRA LE-C11 01 actions credited under adverse environments. model for calculating large early release frequency.

LE-C12 Finding has no impact on this application.

LE-D3 No impact on this application - Flooding only Internal flood model inconsistently propagates initiating event Not Met Flag files were reviewed and determined to be IFQU- IFQU-A1 data into the flag files used for quantification. Flag files need to be complete. Documentation updates are needed to A1-01 IFEV-B2 reviewed for completeness and documentation updated to reflect close this finding. The documentation updates do this.

not affect the results.

No impact on this application - Flooding only The treatment of operator actions in the internal Not Met Model does not adequately develop human failure events specific flood model was reviewed.

IFQU-IFQU-A6 to internal flood scenarios. HFEs from internal events are A6-01 Documentation updates are needed to close this "adjusted" with inadequate basis for those adjustments.

finding. The documentation updates do not affect the results.

CS-C3- CS-C3 Not Met Add the assumed cable routing for the turbine stop valves and No impact on this application 01 steam dump valves in the Turbine Building and not documented in The cable routing for the condenser steam dump the Fire PRA Notebook Circuit Selection and Cable Analysis. valves was performed and documented as an example. The same process would apply for the Document the cable routing in the Fire PRA Notebook Circuit turbine stop valves.

Selection and Cable Analysis of the turbine stop valves and steam Documentation updates are needed to close this dump valves in the turbine building.

finding. The documentation updates do not affect the results. No impact on this application.

FSS-B1- FSS-B1 Not Met Control room abandonment is considered only in case of loss of No impact on this application 01 habitability or loss of control due to a fire in the Main Control The current methodology is conservative.

Room. Main Control Room abandonment due to loss of control (for a fire in another room) is however a plausible cause. While not Documentation updates are needed to close this crediting control room abandonment due to loss of control may be finding. The documentation updates do not affect conservative, a justification should be provided. the results. No impact on this application.

FSS-E3- FSS-E3 Not Met Uncertainty of the parameters used for modeling the significant No impact on this application 01 fire scenarios was evaluated qualitatively, consistent with the Documentation updates are needed to close this requirements of SR FSS-E3 Capability Category I. However, no finding. The documentation updates should not statistical representation of uncertainty intervals was given, as affect the results. No impact on this application.

required by Capability Category II. SR FSS-H5 is also assessed at Capability Category I because SR FSS-E3 is assessed at Capability See also IGNA1001 and UNCA101 Category I.

FSS- FSS-G2 Not Met In the Multi-Compartment Fire Analysis (P2091-2900-04, Revision No impact on this application G2-01 1, May 2013), Subtask 4 discusses screening multi-compartment Documentation updates are needed to close this fire scenarios based on hot gas layer dilution in the exposed fire finding. The documentation updates should not compartment. A finding is created to address potential cases affect the results. No impact on this application.

where a Fire PRA target located in the connected compartment near a failed fire barrier or fire barrier element could be damaged by hot gases before hot gas layer dilution. These multi-compartment interactions could have been improperly screened from further consideration Page 65 of 163

PBN-BFJR-17-019 Rev. 1 Finding Supporting Capability Description Disposition for this Applications

1. Requirement(s) Category FSS- FSS-H1 Not Met Several documents submitted to the peer reviewers were draft No impact on this application H1-03 versions. Examples are: "Detailed Fire Modeling in Selected Point Documentation updates are needed to close this Beach Nuclear Plant Fire Zones" (1RCG27064.000.001), finding. The documentation updates should not "Compartment Analysis Notebook" (P2091-2900-01, Draft Rev. 2, affect the results. No impact on this application.

May 2013), "Main Control Room Analysis" (P2091-2700-01, Revision 1, May 2013). Finding FSS-H1-03 is created to ensure that such draft documents are reviewed, signed off, and their outputs are verified to be correctly implemented for quantification. Also, the 2011 peer review created a finding (FSS-B2-01) related to the modeling of human failure events in case of control room abandonment. While this finding is deemed resolved in the 2013 focused peer review based on explanations from EPM, the documentation of the resolution in Report P2091-2910-01 (Post-Fire Human Reliability Analysis) was not completed at the time of the peer review. Accordingly, Finding FSS-H1-03 calls for proper documentation of the resolution of 2011 Finding FSS-B2-01.

Finally, Finding FSS-H1-03 calls for documenting, in the relevant Fire PRA document, the basis for the fire resistance of wraps credited in the Fire PRA. This could be done, for example, in Report P2091-2900-01 (Compartment Analysis Notebook).

PRM PRM-B2 Not Met A review of the findings and resolutions from the Internal Events No impact on this application B201 Peer Review indicated several findings against Accident Sequence, As of the time of this submittal, the only remaining Success Criteria or Human Reliability Analysis. Findings ASB101, open internal events peer review findings ASB201, ASB601, SYA2101, SYA2201, HRG701, and QUB3 identified in this fire PRA finding are AS-B6-01 and 01 could potentially impact the fire PRA evaluation considerably. SY-A21-01.

Other findings, such as SYB301 and DAC1401, are associated with common cause or common mode system failures that could As noted in AS-B6-01 above, no limitations are be important for fire risk. Some or all of these findings could have needed on the construction truss model for these an impact on the results of the FPRA. two remaining open internal event peer review findings.

Evaluate (qualitatively or quantitatively) these findings to determine the possible impact on the FPRA.

PRM PRM-B9 Not Met P2091250001 documents the PBNP Plant Response Model No impact on this application B901 development. PBNP developed a standalone fault tree to evaluate Documentation updates are needed to close this the fire nonsuppression probability for sequences where the finding. The documentation updates should not electricdriven fire pump was failed by a fire. This was based on an affect the results. No impact on this application.

internal events model for the fire protection system where it was used as a backup system for cooling the auxiliary feed water pumps. The new model used a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> mission time and was used to calculate a point estimate for the nonsuppression probability that was to be added to the appropriate fire scenarios for quantification. The internal events model for the fire protection system where it was used as a backup system for cooling the auxiliary feed water pumps used a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time. The structure of the overall model is such that the nonsuppression probability and failure of the fire protection system may show up in the same scenarios. However, it is not possible to identify the dependency between the nonsuppression probability and the random failure of the fire protection system. Failure to suppress the specific fire within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> will result in the failure of the fire protection system within the first hour of its 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time but this will not be caught because the dependency is not modeled Revise model to include a factor to address the dependency between the new model used to evaluate the fire nonsuppression probability for sequences where the electric driven fire pump was failed by a fire and the model for the fire protection system where it was used as a backup system for cooling the auxiliary feed water pumps. This needs to be carefully documented.

IGN IGN-A10 Not Met Propagating of the uncertainty intervals to the Fire PRA results has No impact on this application A1001 not been done under supporting requirement UNCA2. The Documentation updates are needed to close this uncertainty has not been evaluated. finding. The documentation updates should not affect the results. No impact on this application.

Propagate the uncertainty intervals to the Fire PRA model.

See also FSS-E3-01 and UNCA101.

Page 66 of 163

PBN-BFJR-17-019 Rev. 1 Finding Supporting Capability Description Disposition for this Applications

1. Requirement(s) Category HRA HRA-B2 Not Met A review of the HRA calculator events using the Caused Based No impact on this application B201 Decision Tree methodology (CBDTM) shows that credit for The fire PRA HEPs were reviewed to determine graphically distinct is taken for all HRA events. As discussed in EPRI potential impact. Only about 10% of the HEPs that TR 101259 and in the calculator documentation, credit for credited graphically distinct procedure steps would graphically distinct is only applicable in a flow chart if the shape, be increased by more than a factor of 2. Of these color, etc. make the item standout as more important than other HEPs, only two are risk-significant HEPs with risk steps or in a procedure if the item is separated from other steps by achievement worth values greater than 2. Based a caution statement. If all events are graphically distinct, then in on this review, the impact on the model from this effect none are graphically distinct. finding is judged minimal.

Credit graphically distinct factors only for those events that stand Applicable to Fire HEPs which are not used for the out from the other procedural or flow chart actions. Credit for Construction Truss. No impact on current graphically distinct actions reduces pce tree by a factor of 3. In application.

some cases, pce is the dominant contributor to the cognitive decision. Therefore, the HRA would be increased by a factor of 3.

HRA HRA-C1 Not Met A median response time is chosen as 5 minutes for all fire No impact on this application C101 response actions. While five minutes is generally acceptable to The documentation updates should not affect the respond to the fire alarms and send a fire brigade out to the area, results. No impact on this application.

it may take significantly more time to go through the verifications and system requirements for that fire area before reaching the operator manual action needed to respond to the event. The timing for these fire actions should be verified for feasibility, particularly for beyond Appendix R accidents with hardware failures in addition to the fire damage.

See F&O HRAA101 for performing an HRA walkdown FQ-A1- FQ-A1 Not Met A review of the FRANX database shows that some basic events No impact on this application 01 that have been mapped to scenarios, components, or cables are The only remaining issue is reconciliation of not found in the CAFTA model. In particular: discrepancies found between the FRANX mapping table and the CAFTA model and its documentation.

1) 111 basic events mapped to cables are not in the CAFTA model. The information in the mapping table should be For example: FI-P23--CAB--SO and ESF-PT--NO-00469. reviewed to eliminate the extraneous information

2) 21 basic events mapped to components are not in the CAFTA and eliminate the discrepancies.

model. For example: 416-BKRC01A5215 and R--AOV-CC-00371

3) 2 basic events mapped to scenarios are not found in the CAFTA Documentation updates are needed to close this model: FI-1CV110BCABSO and FI-1CV111-CAB-SO. finding. The documentation updates should not A finding is created to ensure that basic events that are mapped to affect the results. No impact on this application.

scenarios, components, or cables, are included in the CAFTA model, as appropriate. It could be that the basic events identified above are leftover from a previous model revision that needs to be cleaned up and that they have no impact on the results. Thus, this finding does not necessarily point to an incorrect model and rather points to a transparency issue.

FQ-A4- FQ-A4 Not Met Fire PRA quantification is understood to be performed using the No impact on this application 02 Fire PRA plant response model that meets Technical Element PRM Documentation updates are needed to close this (plant response model) of the ASME/ANS Standard (see Note 2 of finding. The documentation updates should not SR FQ-A4). In that context, some multiple spurious operations affect the results. No impact on this application.

(MSOs) appear to not have been adequately dispositioned and/or modeled in the Fire PRA. Examples are: loss of reactivity control, excessive RCS injection, and RCS overcooling. Expert Panel discussion listed in Document P2092-110A-001 Rev. 0 (dated August 2010) included recommendations to revise the PRA model to address the potential impact due to fire. However, a later document (P2091-2500-02 Rev. 0, dated May 2011) appears to not address all MSOs nor provided justification for not being included in the PRA model as the earlier document has recommended. A finding is created to ensure that the generic list of MSOs from the industry owner groups be reviewed to verify that all MSOs relevant to Point Beach are considered and their disposition properly documented.

FQ-B1- FQ-B1 Not Met Supporting Requirement FQ-B1 calls for CDF quantification in No impact on this application 01 accordance with HLR-QU-B. Supporting Requirements QU-B6, QU- Documentation updates are needed to close this B7, and QU-B8 address the treatment of mutually exclusive events finding. The documentation updates should not in the Fire PRA. A review of these mutually exclusive events affect the results. No impact on this application.

appears to indicate that some important combinations may be missing or inconsistently applied. See for example Gate MEX-DC. A finding is created to ensure that mutually exclusive event combinations are systematically reviewed for appropriateness.

Page 67 of 163

PBN-BFJR-17-019 Rev. 1 Finding Supporting Capability Description Disposition for this Applications

1. Requirement(s) Category FQ-E1- FQ-E1 Not Met Supporting Requirement FQ-E1 calls for a review of the CDF and No impact on this application 01 LERF quantification results in accordance with HLR-LE-F. Documentation updates are needed to close this Supporting Requirements LE-F1 associated with that HLR requires, finding. The documentation updates should not for Capability Category II, a quantitative evaluation of the relative affect the results. No impact on this application.

contribution to LERF from plant damage states and significant LERF contributors from Table 2-2.8-9 in the ASME/ANS standard (note: the table number given here corrects an apparent typo given in the SR text). While the Quantification Notebook provides LERF contribution by compartment, scenarios, and equipment failure modes, the LERF contributors from Table 2-2.8-9 do not appear to be evaluated in the notebook.

FQ-F1- FQ-F1 Not Met Supporting Requirement FQ-F1 calls for documentation of the CDF No impact on this application 05 and LERF analyses in accordance with HLR-QU-F. Supporting Documentation updates are needed to close this Requirement QU-F4 associated with that HLR requires the finding. The documentation updates should not characterization of sources of uncertainties and related affect the results. No impact on this application.

assumptions. However, several assumptions listed in the Quantification Notebook do not provide such characterization. For example:

1) In Section 2.4.3, instrument air is assumed failed in the Fire PRA. It should be clarified that instrument air failure is not credited as a success in the Fire PRA.

2) In Section 2.4.4, the effect of not crediting the charging pump low pressure trip modification is qualitatively evaluated, but no characterization of the potential adverse impacts that this modification may have is given.

3) In Section 2.4.6, the failure of the MSIVs to close is eliminated from further consideration, but the justification given for this assumption is not substantiated with sufficient details.

4) In Section 2.5.3.6.1, an assumption is made that the probability of a hot short lasting greater than 10 minutes is 0.1. But the basis for this assumption is not clearly stated. If none is available, a sensitivity study to characterize the impact of this assumption is needed.

UNC UNC-A1 Not Met Contrary to the requirements of QUE3, PBNP has not calculated a No impact on this application A101 mean CDF and uncertainty. Also, because they have currently not Documentation updates are needed to close this completed final quantification of CDF and LERF, they are not really finding. The documentation updates should not able to review contributors for reasonableness (e.g., to assure affect the results. No impact on this application.

excessive conservatisms have not skewed the results, level of plant specificity is appropriate for significant contributors, etc.) as See also FSS-E3-01 and IGNA1001.

required by LEF2. The current results are definitely driven by conservatisms in the model and thus preclude performing a representative review of the contributors.

PBNP needs to complete the quantification of their model to the point where they have a fire CDF that is acceptable (e.g., of the order of 5E05/year). As part of the final quantification, PBNP needs to calculate the mean CDF and the associated uncertainty interval. PBNP should then review both the CDF and LERF contributors for reasonableness.

Page 68 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT B HUMAN RELIABILITY ANALYSIS (HRA)

NOTE: The text below provides Sections 2.0 through 5.0, the evaluation portion (without table of contents section 1.0), of the Point Beach Construction Truss Human Reliability Analysis, Document No.: PBN-BF-JR-18-022

[Reference 26]. Attachment 1 (section 6.0), which contains the HEP evaluations, is not included but is available in the complete document.

2.0 Purpose

The purpose of this report is to provide the human reliability analysis in support of LAR 278 [Ref. 1], the construction truss LAR submittal. This report was prepared in accordance with NEE Fleet procedure EN-AA-105-1000-10001 [Ref. 2] and identifies the Point Beach human reliability analysis used to support the LAR 278 submittal and associated RAIs. The human error probability (HEP) calculations are organized and are adequately documented to support an efficient independent review that meets regulatory and industry expectations.

3.0 Evaluation 3.1 Determination of HEPs to be evaluated The UNIT1-SEISMIC.caf fault tree was run using the 1PB-FIRE-R4.rr database and recovery rule file SEISMIC-HEP-RECOVERY.TXT which reset all the HEPs to 0.99 except HEP-RCS-CSPH1-12-SEIS-HI and HEP-RCS-CSPH1-12-SEIS-LO which had previously been calculated. HEP-AF--MDP-FLOW was set to 0.0 since a modification has been installed which supplies a 24-hour pneumatic supply to the valves such that manual action to manually control the discharge valves is no longer required. All other HEPs were set to 0.99. The model was run at a truncation of E-12 with no flag file and the recovery rule file in the table below.. Because only these HEPs appear in the cutsets, only these HEPs need to be evaluated further. Gate G-CT-SEISMIC-CDF was quantified. Note the LERF logic was reviewed and does not add any additional HEPs. The CT PRA did not add any additional operator actions. The files used are shown in Table 1.

Table 1 - Point Beach Construction Truss Files Date Time Size (KB) Name Description 2/26/2018 6:41 AM 7,608 SEISMIC-HEP-RECOVERY.TXT Flag file to set HEPs to 0.99 2/26/2018 6:39 PM 1,022 UNIT1-SEISMIC.caf Fault tree file

• *

• 15,804 1PB-Fire-R4.rr Database file 3/15/2018 4:08 PM 68,722 G-CT-SEISMIC-CDF-HEP-.99.cut Cutset file

• *

• 7,844 PB_501_HRAC_V4.21 - BF Adj for 56m and seismic SEG.HRA HRA Calculator file

• The dates and times of Microsoft Access files (such as the .rr and .hra files) change whenever opened.

Table 2 is a list of the HEPs which were in the cutsets.

Page 69 of 163

PBN-BFJR-17-019 Rev. 1 Table 2 - Point Beach Construction Truss Unscreened HEP List Event Prob Fus Ves BirnBm Red W Ach W Description HEP-120--U12-INV 9.90E-01 0.00001 3.27E-10 1 1 OPERATOR FAILS TO MANUALLY ALIGN FROM NORMAL TO ALTERNATE INVERTER HEP-125-BAT-B81 9.90E-01 0.47182 1.66E-07 1.0055 1 OPS FAILS TO ALIGN ALTERNATE PWR TO D109 from B81 HEP-125-BAT-CHG 9.90E-01 0.63763 2.48E-06 1.0903 1.001 OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER FROM CONTROL ROOM HEP-125-BAT-CHGA 9.90E-01 0.62819 2.36E-06 1.0853 1.001 OPS FAILS TO ALIGN PWR/RELOAD ALT TO BATT CHARGER FROM CR HEP-125-COG 9.90E-01 0.87628 8.41E-06 1.3901 1.003 OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER (COMMON COG)

HEP-125-COG-REC 9.90E-01 0.96225 1.15E-05 1.6241 1.003 OPS FAILS TO RECOVERY BATTERY CHARGER AFTER BATTERIES DEPLETE HEP-125--D301-D1 9.90E-01 0.45924 7.72E-07 1.0264 1 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-01 (UNIT 1)

HEP-125--D301-D2 9.90E-01 0.35206 1.06E-05 1.0004 1 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-02 (UNIT 1)

HEP-125--D302-D3 9.90E-01 0.32454 4.84E-08 1.0016 1 OPERATOR FAILS TO ALIGN BUS D-302 TO BUS D-03 HEP-125--D302-D4 9.90E-01 0.31168 4.55E-08 1.0015 1 OPERATOR FAILS TO ALIGN BUS D-302 TO BUS D-04 HEP-125-U1---BAT 9.90E-01 0.08561 2.57E-06 1 1 OPERATOR FAILURE TO ALIGN ALTERNATE BATTERY HEP-138-U12-G-05 9.90E-01 0.67983 2.81E-06 1.1035 1.001 OPS FAIL TO START AND ALIGN GAS TURBINE HEP-416-ECA00--5 9.90E-01 0.00089 2.67E-08 1 1 OPERATOR FAILS TO START DG MANUALLY HEP-416-G02-1A05 9.90E-01 0.02661 7.98E-07 1.0005 1 OPERATOR FAILS TO ALIGN G-02 TO 1A-05 UNIT 1 HEP-416-G03-2A06 9.90E-01 0.14012 4.20E-06 1 1 OPERATOR FAILS TO ALIGN G-03 TO 2A-06 UNIT 2 HEP-416-G04-1A06 9.90E-01 0.10344 3.10E-06 1 1 OPERATOR FAILS TO ALIGN G-04 TO 1A-06 UNIT 1 HEP-480--1B03-04 9.90E-01 0.00619 1.86E-07 1 1 OPERATOR FAILS TO TRANSFER POWER FROM 1B-03 TO 1B-04 HEP-480-1-ECA00F 9.90E-01 0.08445 2.53E-06 1 1 OPERATOR FAILS TO BACKFEED 480 VAC SAFEGUARDS BUSES UNIT 1 HEP-480--2B03-04 9.90E-01 0.01836 5.51E-07 1 1 OPERATOR FAILS TO TRANSFER POWER FROM 2B-03 TO 2B-04 HEP-480-2-ECA00F 9.90E-01 0.05981 1.79E-06 1 1 OPERATOR FAILS TO BACKFEED 480 VAC SAFEGUARDS BUSES UNIT 2 HEP-480-B08-WPS 9.90E-01 0.3128 9.38E-06 1 1 OPERATOR FAILS TO ALIGN ALTERNATE POWER TO B08 FROM WPS HEP-480-OI-15A-5 9.90E-01 0.08406 1.12E-07 1.0038 1 OP FAIL TO ESTABLISH ALTERNTE POWER TO CHARGING PUMP HEP-AF--CST-FW 9.90E-01 0.54536 1.62E-06 1.0571 1.001 Pe FOR FW SUPPLY TO AFW HEP-AF--CST--LOW 9.90E-01 0.72019 4.45E-06 1.1745 1.001 Pc COMPONENT TO CST BACKUP DUE TO LOW LEVEL HEP-AF--CST-SWMD 9.90E-01 0.19883 1.61E-07 1.0054 1 Pe FOR SW SUPPLY TO MDAFW HEP-AF--MDP-FLOW 1.35E-01 0.03075 2.27E-07 1.001 1.007 FAILURE TO CONTROL AUX. FEED FLOW FROM THE TWO MD PUMPS AFTER LOSS OF IA HEP-AF--MINI-GAG 9.90E-01 0.19447 1.61E-07 1.0054 1 FAILURE TO GAG MINI RECIRC VALVE OPEN >1HR INTO EVENT HEP-AF--MS201920 9.90E-01 0.00018 5.33E-09 1 1 MANUAL OPERATION OF 1(2)MS-2019(20)

HEP-AF--STARTPMP 9.90E-01 0.83582 7.13E-06 1.3121 1.002 FAILURE TO MANUALLY START AFW PUMP HEP-AF--TY-1-190 9.90E-01 0.1573 4.72E-06 1 1 1P53 SUCTION MANUAL VALVE 1-190 RESTORATION ERROR HEP-AF--TY-1194A 9.90E-01 0.19738 5.92E-06 1 1 FAILURE TO RESTORE MANUAL VALVE 1-194A FROM 1P53 TO "A" SG HEP-AF--TY-1194B 9.90E-01 0.09539 2.86E-06 1 1 FAIL TO RESTORE MANUAL VALVE 1-194B FROM 1P53 TO "B" SG HEP-AF--TY-1195A 9.90E-01 0.19738 5.92E-06 1 1 FAILURE TO RESTORE MANUAL VALVE 1-195A FROM 1P53 TO "A" SG HEP-AF--TY-1195B 9.90E-01 0.09539 2.86E-06 1 1 FAIL TO RESTORE MANUAL VALVE 1-195B FROM 1P53 TO "B" SG HEP-AF--TY-1P29 9.90E-01 0.28973 8.69E-06 1 1 OPERATOR FAILS TO RESTORE VALVES IN MINI-FLOW RECIRCULATION PATH FOLLOWING T&M HEP-AF--TY-A-005 9.90E-01 0.00951 2.85E-07 1 1 A CST MAN VLV TO ALL AFW PUMPS MISALGN AFTER TEST AND MAINT HEP-AF--TY-A-018 9.90E-01 0.19047 5.71E-06 1 1 MAN. VLV FROM 1P29 TO "A" STM GENER MISALGN AFTER TEST AND MAINT HEP-AF--TY-A-019 9.90E-01 0.12446 3.73E-06 1 1 MAN. VLV FROM 1P29 TO "B" STM GENER MISALGN AFTER TEST AND MAINT HEP-AF--TY-A-120 9.90E-01 0.00023 6.88E-09 1 1 SWS FEED MAN.VLV TO MDP P38B MISALGN AFTER TEST AND MAINT HEP-AF--TY-A-126 9.90E-01 0.28973 8.69E-06 1 1 MAN VLV FROM MAIN STM VLVS TO TDP P-29 MISALGN AFTER TEST AND MAINT HEP-COG-CSPH1 9.90E-01 0.00041 1.24E-08 1 1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK HEP-ESF-SGLOLO 9.90E-01 0.35282 7.20E-07 1.0246 1 MIS-CALIBRATION LOW LOW STEAM GENERATOR LEVEL Page 70 of 163

PBN-BFJR-17-019 Rev. 1 Table 2 - Point Beach Construction Truss Unscreened HEP List Event Prob Fus Ves BirnBm Red W Ach W Description HEP-FP--FUEL-OIL 9.90E-01 0.37301 7.05E-07 1.0241 1 FAILURE TO PROVIDE THE NECESSARY FUEL OIL TO THE DG FIRE PUMP TO ALL 24 HR OPERA HEP-FP--TY-1P29 9.90E-01 0.00195 5.85E-08 1 1 OPREATOR FAILS TO RESTORE VALVE FOLLOWING TEST AND MAINTENANCE HEP-HHR-EOP13L34 9.90E-01 0.45765 1.46E-06 1.0513 1 OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND PART HEP-HHR-EOP13L60 9.90E-01 0.45765 1.46E-06 1.0513 1 OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST PART HEP-IA--FO245 9.90E-01 0.00503 1.51E-07 1 1 OPERATOR FAILS TO OPEN IA-VLV-245 HEP-MS--TY-1-235 9.90E-01 0.19045 5.71E-06 1 1 OPERATOR FAILS TO RESTORE VALVE FOLLOWING TEST AND MAINTENANCE HEP-MS--TY-1-237 9.90E-01 0.12446 3.73E-06 1 1 OPERATOR FAILS TO RESTORE VALVE FOLLOWING TEST AND MAINTENANCE HEP-RCS-CSPH1-12-SEIS-HI 1.00E-01 0.06487 1.93E-05 1 1 FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 MOD. HIGH SEISMIC HEP-RCS-CSPH1-12-SEIS-LO 2.94E-02 0.04816 5.26E-07 1.0005 1.017 FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 MOD. LOW SEISMIC HEP-SW--EOP-0-9A 9.90E-01 0.00054 1.62E-08 1 1 OPER. FAILS TO ISOLATE NON-ESSEN. SW LOADS HEP-SW--EOP-4-9A 9.90E-01 0.00211 6.32E-08 1 1 OPERATOR STARTS SW PUMP LOCALLY FROM BUS 0B-08 HEP-SW--TY-00496 9.90E-01 0.09365 2.81E-06 1 1 MANUAL VALVE 0-SW-496 SUPPLY TO 1P53 MDAFWP RESTORATION ERROR HEP-SW--TY-00497 9.90E-01 0.26459 7.94E-06 1 1 MANUAL VALVE 0-SW-497 SUPPLY TO 2P53 MDAFWP RESTORATION ERROR HEP-SW--TY-1-135 9.90E-01 0.02262 6.78E-07 1 1 SWS FEED MAN.VLV TO TDP P29 MISALGN AFTER TEST AND MAINT HEP-SW--TY-A-111 9.90E-01 0.00155 4.66E-08 1 1 BLOCK 47 SW HAND VLV TO TDP 2P-29 0-SW-111 MISALGN AFTER TEST AND MAINT HEP-SW--TY-A-140 9.90E-01 0.02359 7.08E-07 1 1 BLOCK 8 SW HAND VLV TO TDP 2P-29 0-SW-140 MISALGN AFTER TEST AND MAINT Page 71 of 163

PBN-BFJR-17-019 Rev. 1 3.2 Screening of HEPs Restoration errors take place before the seismic event, therefore, no adjustment is required to the restoration errors. In addition, one operator action, HEP-AF--MINI-GAG, to gag open the min-recirc valve is no longer required since a pneumatic 24-hour supply is available to the min-recirc valves. Mis-calibration of low-low steam generator is also removed since it occurs prior to the seismic event. Removal of these results in the following list.

HEP-AF--MDP-FLOW, failure to control AFW flow from two MD pumps after loss of IA has been deleted as well since a modification has been installed to provide a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> pneumatic source for the control valves. These two HEPs have been set to FALSE since they no longer apply Two HEPs are already set to 1.0, so no change is required.

These are HEP-IA--FO245 and HEP-120--U12-INV.

Table 3 provides a list of the remaining HEPs following the screening.

Page 72 of 163

PBN-BFJR-17-019 Rev. 1 Table 3 - Point Beach Construction Truss Screened HEP List Event Fus Ves BirnBm Red W RAW Description HEP-125-COG-REC 0.96225 1.15E-05 1.6241 1.003 OPS FAILS TO RECOVERY BATTERY CHARGER AFTER BATTERIES DEPLETE HEP-125-COG 0.87628 8.41E-06 1.3901 1.003 OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER (COMMON COG)

HEP-AF--STARTPMP 0.83582 7.13E-06 1.3121 1.002 FAILURE TO MANUALLY START AFW PUMP HEP-AF--CST--LOW 0.72019 4.45E-06 1.1745 1.001 Pc COMPONENT TO CST BACKUP DUE TO LOW LEVEL HEP-138-U12-G-05 0.67983 2.81E-06 1.1035 1.001 OPS FAIL TO START AND ALIGN GAS TURBINE HEP-125-BAT-CHG 0.63763 2.48E-06 1.0903 1.001 OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER FROM CONTROL ROOM HEP-125-BAT-CHGA 0.62819 2.36E-06 1.0853 1.001 OPS FAILS TO ALIGN PWR/RELOAD ALT TO BATT CHARGER FROM CR HEP-AF--CST-FW 0.54536 1.62E-06 1.0571 1.001 Pe FOR FW SUPPLY TO AFW HEP-125-BAT-B81 0.47182 1.66E-07 1.0055 1 OPS FAILS TO ALIGN ALTERNATE PWR TO D109 from B81 HEP-125--D301-D1 0.45924 7.72E-07 1.0264 1 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-01 (UNIT 1)

HEP-HHR-EOP13L34 0.45765 1.46E-06 1.0513 1 OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND PART HEP-HHR-EOP13L60 0.45765 1.46E-06 1.0513 1 OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST PART HEP-FP--FUEL-OIL 0.37301 7.05E-07 1.0241 1 FAILURE TO PROVIDE THE NECESSARY FUEL OIL TO THE DG FIRE PUMP TO ALL 24 HR OPERA HEP-125--D301-D2 0.35206 1.06E-05 1.0004 1 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-02 (UNIT 1)

HEP-125--D302-D3 0.32454 4.84E-08 1.0016 1 OPERATOR FAILS TO ALIGN BUS D-302 TO BUS D-03 HEP-480-B08-WPS 0.3128 9.38E-06 1 1 OPERATOR FAILS TO ALIGN ALTERNATE POWER TO B08 FROM WPS HEP-125--D302-D4 0.31168 4.55E-08 1.0015 1 OPERATOR FAILS TO ALIGN BUS D-302 TO BUS D-04 HEP-AF--CST-SWMD 0.19883 1.61E-07 1.0054 1 Pe FOR SW SUPPLY TO MDAFW HEP-416-G03-2A06 0.14012 4.20E-06 1 1 OPERATOR FAILS TO ALIGN G-03 TO 2A-06 UNIT 2 HEP-416-G04-1A06 0.10344 3.10E-06 1 1 OPERATOR FAILS TO ALIGN G-04 TO 1A-06 UNIT 1 HEP-125-U1---BAT 0.08561 2.57E-06 1 1 OPERATOR FAILURE TO ALIGN ALTERNATE BATTERY HEP-480-1-ECA00F 0.08445 2.53E-06 1 1 OPERATOR FAILS TO BACKFEED 480 VAC SAFEGUARDS BUSES UNIT 1 HEP-480-OI-15A-5 0.08406 1.12E-07 1.0038 1 OP FAIL TO ESTABLISH ALTERNTE POWER TO CHARGING PUMP HEP-RCS-CSPH1-12-SEIS-HI 0.06487 1.93E-05 1 1 FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 MOD. HIGH SEISMIC HEP-480-2-ECA00F 0.05981 1.79E-06 1 1 OPERATOR FAILS TO BACKFEED 480 VAC SAFEGUARDS BUSES UNIT 2 HEP-RCS-CSPH1-12-SEIS-LO 0.04816 5.26E-07 1.0005 1.017 FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 MOD. LOW SEISMIC HEP-416-G02-1A05 0.02661 7.98E-07 1.0005 1 OPERATOR FAILS TO ALIGN G-02 TO 1A-05 UNIT 1 HEP-480--2B03-04 0.01836 5.51E-07 1 1 OPERATOR FAILS TO TRANSFER POWER FROM 2B-03 TO 2B-04 HEP-480--1B03-04 0.00619 1.86E-07 1 1 OPERATOR FAILS TO TRANSFER POWER FROM 1B-03 TO 1B-04 HEP-IA--FO245 0.00503 1.51E-07 1 1 OPERATOR FAILS TO OPEN IA-VLV-245 HEP-SW--EOP-4-9A 0.00211 6.32E-08 1 1 OPERATOR STARTS SW PUMP LOCALLY FROM BUS 0B-08 HEP-416-ECA00--5 0.00089 2.67E-08 1 1 OPERATOR FAILS TO START DG MANUALLY HEP-SW--EOP-0-9A 0.00054 1.62E-08 1 1 OPER. FAILS TO ISOLATE NON-ESSEN. SW LOADS HEP-COG-CSPH1 0.00041 1.24E-08 1 1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK HEP-AF--MS201920 0.00018 5.33E-09 1 1 MANUAL OPERATION OF 1(2)MS-2019(20)

HEP-120--U12-INV 0.00001 3.27E-10 1 1 OPERATOR FAILS TO MANUALLY ALIGN FROM NORMAL TO ALTERNATE INVERTER Page 73 of 163

PBN-BFJR-17-019 Rev. 1 3.3 Screened HEPs Set to TRUE Several of the HEPs listed in Table 3 are not risk significant. These HEPs were conservatively set to TRUE. Table 4 provides a list of the HEPs which were conservatively set to TRUE.

Table 4 HEPs Set to TRUE HEP-125-COG-REC EQU .T HEP-138-U12-G-05 EQU .T HEP-AF--CST-FW EQU .T HEP-125-BAT-B81 EQU .T HEP-125--D301-D1 EQU .T HEP-125--D301-D2 EQU .T HEP-125--D302-D3 EQU .T HEP-480-B08-WPS EQU .T HEP-125--D302-D4 EQU .T HEP-125-U1---BAT EQU .T HEP-480-1-ECA00F EQU .T HEP-480-OI-15A-5 EQU .T HEP-480-2-ECA00F EQU .T HEP-416-G02-1A05 EQU .T HEP-480--2B03-04 EQU .T HEP-480--1B03-04 EQU .T HEP-SW--EOP-4-9A EQU .T HEP-416-ECA00--5 EQU .T HEP-SW--EOP-0-9A EQU .T HEP-COG-CSPH1 EQU .T HEP-AF--MS201920 EQU .T 3.4 Construction Truss HEPs The internal events HEPs which had values reset for low seismic are used for seismic events from 0.05G to

<0.56G. Following the procedures after the earthquake did not result in resource diversion or change additions to perform additional steps. The SEISMIC-LO cognitive HEPs were calculated by resetting internal events HEPs Workload in CBDTM to High. The SEISMIC-LO execution HEPs were calculated by resetting the Performance Shaping Factor stress in the internal events HEP to HIGH. In some cases, these were adjusted higher based on the analyst discretion. SEISMIC-HI HEPs were used for earthquakes from 0.56G to >1G. SEISMIC-HI were reset to 0.1 based on the EPRI Report 3002008093, Section 6.5.2 which recommends a minimum value of 0.1 be used for the human error probability for in-control room actions and 1.0 for high damage states. Note that HEP-FPFUEL-OIL was left at the internal events value and used the internal events name since the action takes place more than 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> after the seismic event, after the post-event walkdown is complete.

Page 74 of 163

PBN-BFJR-17-019 Rev. 1 Table 5 HEPs Recalculated for CT PRA HEP IE SEISMIC-LO SEISMIC-HI CR 7

HEP-AF--CST-SWMD 5.20E-03 2.60E-02 1.0E-01 YES 2

HEP-RCS-CSPH1-12 2.54E-02 2.19E-02 1.0E-01 YES HEP-RPCSPS1-01 3.68E-02 3.68E-02 1.0E-01 YES HEP-416-G01-2A05 3.00E-03 3.06E-03 1.0E-01 YES HEP-416-G03-2A06 3.00E-03 3.06E-03 1.0E-01 YES HEP-416-G04-1A06 3.00E-03 3.06E-03 1.0E-01 YES 5 1 HEP-HHR-EOP13L60 1.30E-03 2.50E-03 1.0E-01 NO 3

HEP-AF--STARTPMP 8.40E-04 2.07E-03 1.0E-01 YES 6

HEP-125-BAT-CHG 2.60E-04 6.50E-04 1.0E-01 YES 6

HEP-125-BAT-CHGA 2.60E-04 6.50E-04 1.0E-01 YES 4 1 HEP-HHR-EOP13L34 3.20E-05 3.59E-04 1.0E-01 NO HEP-AF--CST--LOW 1.40E-04 1.42E-04 1.0E-01 YES HEP-128-U12-G-05 2.43E-02 2.43E-02 1.0E-01 YES HEP-125-COG 7.80E-05 7.93E-05 1.0E-01 YES Notes 1. Action required more than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after seismic event and in a seismic building.

2. Feed and Bleed based on nitrogen to the PORVs.

3. Calculated value was 8.38E-4. Conservatively reset to 2.07E-3 in CT PRA.

4. Calculated value was 3.16E-5. Conservatively reset to 3.59E-4 in CT PRA.

5. Calculated value was 1.31E-3. Conservatively reset to 2.50E-3 in CT PRA.

6. Calculated value was 2.60E-4. Conservatively reset to 6.50E-4 in CT PRA.

7. Calculated value was 5.20E-3. Conservatively reset to 2.60E-2 in CT PRA.

4.0

Conclusion:

An assessment of Point Beach Construction Truss HEPs has been performed. The assessment focused on determining which internal events HEPs needed to be recalculated and providing revised values as appropriate.

There are a total of 14 internal event HEPs that were recalculated for the CT PRA. The detailed recalculation of the internal events HEPs for the CT PRA is contained in Attachment 1.

5.0

References:

(1) License Amendment Request 278, Risk-Informed Approach to Resolve Construction Truss Design Code Nonconformances.

(2) NEE Fleet Procedure EN-AA-105-1000-10001, Rev. 1 (draft), Review of PRA Finding Resolution.

(3) EPRI Report 3002008093, An Approach to Human Reliability Analysis for External Events with a Focus on Seismic, Final Report, December 2016.

(4) GDOC 18-024, PBN MAAP Runs for CT HRA Page 75 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT C ASME/RG 1.200 PRA QUALITY SUPPORTING REQUIREMENTS Applicable to the Seismic Analysis REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

HIGH LEVEL SUPPORTING REQUIREMENTS STATEMENT OF COMPLIANCE HLR-EXT-A All potential external hazards (i.e., all natural and man-made hazards) that may affect Only seismic and thermal hazards apply to this evaluation.

the site shall be identified.

HLR-EXT-B Preliminary screening, if used, shall be performed using a defined set of screening Screening criteria is define in section 1.0 criteria.

HLR-EXT-C A bounding or demonstrably conservative analysis, if used for screening, shall be Both bounding and demonstrably conservative analysis were perform performed using defined quantitative screening criteria. using quantitative screening criteria as described in section 1.0 HLR-EXT-D The basis for the screening out of an external hazard shall be confirmed through a Walkdowns were only used to confirm modifications credited in this walkdown of the plant and its surroundings. evaluation were located and protected in a way that avoid damage from debris generated by a failed CT.

HLR-EXT-E Documentation of the screening out of an external hazard shall be consistent with the This evaluation meets the applicable documentation requirements.

applicable supporting requirements.

REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

SUPPORTING REQUIREMENTS FOR HLR-EXT-A STATEMENT OF COMPLIANCE EXT-A1 In the list of external hazards, INCLUDE as a minimum those that are enumerated in the Does not apply. This evaluation focuses on a seismic evaluation of the PRA Procedures Guide, NUREG/CR-2300 [6-1] and NUREG-1407 [6-3] and examined in past studies Point Beach Unit 1 and Unit 2 Construction Trusses.

such as the NUREG-1150 analyses [6-4]. Nonmandatory Appendix 6-A contains the list adapted from NUREG/CR-2300, and this list provides one acceptable way to meet this requirement.

EXT-A2 SUPPLEMENT the list considered in (EXT-A1) with any site-specific and plant-unique This evaluation is a site-specific and plant unique seismic evaluation of external hazards. the Point Beach Unit 1 and Unit 2 Construction Trusses.

REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

SUPPORTING REQUIREMENTS FOR HLR-EXT-B STATEMENT OF COMPLIANCE EXT-B1 Initial Preliminary Screening: For screening out an external hazard, any one of the following five screening None of these screening criteria apply.

criteria provides as an acceptable basis:

Criterion 1: The event is of equal or lesser damage potential than the events for which the plant has been designed. This requires an evaluation of plant design bases in order to estimate the resistance of plant structures and systems to a particular external hazard.

Criterion 2: The event has a significantly lower mean frequency of occurrence than another event, taking into account the uncertainties in the estimates of both frequencies, and the event could not result in worse consequences than the consequences from the other event.

Criterion 3: The event cannot occur close enough to the plant to affect it. This criterion must be applied taking into account the range of magnitudes of the event for the recurrence frequencies of interest.

Criterion 4: The event is included in the definition of another event.

Criterion 5: The event is slow in developing, and it can be demonstrated that there is sufficient time to eliminate the source of the threat or to provide an adequate response.

EXT-B2 Second Preliminary Screening: For screening out an external hazard other than seismic events, the following This screening criterion does not apply.

screening criterion provides an acceptable basis. The criterion is that the design basis for the event meets the criteria in the U.S. Nuclear Regulatory Commission 1975 Standard Review Plan [6-2].

EXT-B3 BASE the application of the screening criteria for a given external hazard on a review of information on the Relevant license basis requirements were reviewed plants design hazard and licensing basis relevant to that event. and incorporated/considered into the structural calculations were relevant .

EXT-B4 REVIEW any significant changes since the U.S. Nuclear Regulatory Commission operating license was issued. In GMRS was based on latest site-specific hazard as particular, review all of the following: documented in ML14090A275 (which was (a) military and industrial facilities within 8 km of the site obtained from the work performed by Lettis (b) on-site storage or other activities involving hazardous materials Consultants) and accepted by the NRC in (c) nearby transportation ML15211A593.

(d) any other developments that could affect the original design conditions Page 76 of 163

PBN-BFJR-17-019 Rev. 1 REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

SUPPORTING REQUIREMENTS FOR HLR-EXT-C STATEMENT OF COMPLIANCE EXT-C1 For screening out an external hazard, any one of the following three screening Criterion B was applied to the demonstrably conservative analysis which has a criteria provides an acceptable basis for bounding analysis or demonstrably conservative mean frequency of < 10-5/yr and a mean CCDP of <10-1.

analysis. Criterion C also applies to the demonstrably conservative analysis which has a Criterion A: The current design-basis-hazard event cannot cause a core damage accident. core damage frequency of 3.93E-07 for seismic +4.45E-08 for thermal which Criterion B: The current design-basis-hazard event has a mean frequency <10-5/yr, and the equals 4.39E-07 total CDF.

mean value of the conditional core damage probability (CCDP) is assessed to be <10-1.

Criterion C: The core damage frequency, calculated using a bounding or demonstrably conservative analysis, has a mean frequency <10-6/yr.

EXT-C2 BASE the estimation of the mean frequency and the other parameters of the GMRS was based on latest site-specific hazard as documented in ML14090A275 design-basis hazard or the bound on them using hazard modeling and recent data (e.g., (which was obtained from the work performed by Lettis Consultants) and annual maximum wind speeds at the site, aircraft activity in the vicinity, or precipitation accepted by the NRC in ML15211A593.

data).

EXT-C3 In estimating the mean conditional core damage probability (CCDP), USE a A bounding analysis and demonstrably conservative analysis were used. Since bounding analysis or a demonstrably conservative analysis that employs a systems model mitigating systems and operator actions are not credited, neither a full-scope of the plant that meets the systems-analysis requirements in Part 2 insofar as they apply nor partial PRA model is needed to perform this assessment. Only seismic and

[6-6]. thermal hazard and fragility data are used to calculate core damage probability. Section 2.0 fully describes the scope of the bounding analysis.

The demonstrably conservative analysis used simplified event trees that show the sequences considered and success and failure probabilities of critical systems and components. These event trees were developed assuming a seismic or thermal event caused CT failure. Non-seismic SSCs like air compressors and instrument air lines are considered failed and not included. Seismic SSCs outside containment are assumed not to fail since they are designed for the DBE and will not fail due to thermal transients inside containment. Section 5.0 fully describes the scope of the demonstrably conservative analysis.

EXT-C4 IDENTIFY those SSCs required to maintain the plant in operation or that are The event trees developed in section 5 identify SSCs required to prevent core required to respond to an initiating event to prevent core damage, that are vulnerable to damage in the event the CT fails.

the hazard, and determine their failure modes.

EXT-C5 ESTIMATE the CCDP taking into account the initiating events caused by the hazard, The event trees in section 5 were used to calculate CCDP for seismic and and the systems or functions rendered unavailable. Modifying the internal-events PRA relevant thermal hazards. Conservative values were used for the failure model as appropriate, using conservative assessments of the impact of the hazard probabilities for the SSCs credited.

(fragility analysis), is an acceptable approach.

EXT-C6 BASE the estimation of the mean core damage frequency developed here on The CDF developed is based on modeling that is demonstrably conservative as models and data that are either realistic or demonstrably conservative. This includes not described in section 5.0.

only the hazard analysis but also any fragility analysis that is applicable EXT-C7 If none of the screening criteria in this entire Part 6 can be met for a given external The screening criteria for the seismic hazard is met. However the CDF and hazard, then PERFORM additional analysis. (See Parts 7, 8, and 9.) LERF were also calculated to show compliance to RG 1.174.

REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

SUPPORTING REQUIREMENTS FOR HLR-EXT-D STATEMENT OF COMPLIANCE EXT-D1 CONFIRM the basis for the screening out of an external hazard through a walkdown of Although the seismic hazard met the screening criteria the evaluation also the plant and its surroundings showed compliance to RG 1.174 guideline Confirmatory walkdowns were performed to assure that Modifications EC284214 (Unit 2) and EC285145 (Unit 1) [Ref 13] that install seismic category 1 nitrogen tanks and piping to supply the PORVs in the event of a loss of instrument air to the PORVs are adequately protected from debris that result from a failed CT.

EXT-D2 If the screening out of any specific external hazard depends on the specific plant Not applicable - hazard not screened out.

layout, then CONFIRM that layout with a walkdown. For most external hazards, this typically means a walkdown that evaluates the site layout outside the plant buildings as well as inside.

REQUIREMENTS FOR OTHER EXTERNAL HAZARDS: REQUIREMENTS FOR SCREENING AND CONSERVATIVE ANALYSIS (EXT)

SUPPORTING REQUIREMENTS FOR HLR-EXT-E STATEMENT OF COMPLIANCE EXT-E1 DOCUMENT the external hazard screening and conservative analyses in a manner that facilitates PRA applications, upgrades, This evaluation complies with this and peer review. requirement.

EXT-E2 DOCUMENT the process used in the external hazard screening and conservative analyses. For example, this documentation This document fully describes the typically includes a description of: risk analysis and fully references all (a) the approach used for the screening (preliminary screening or demonstrably conservative analysis) and the screening criteria used the structural inputs utilized.

for each external hazard that is screened out, (b) any engineering or other analysis performed to support the screening out of an external hazard or in the conservative assessment of an external hazard.

Page 77 of 163

PBN-BFJR-17-019 Rev. 1 HIGH LEVEL SUPPORTING REQUIREMENTS - HAZARDS HIGH LEVEL SUPPORTING REQUIREMENTS STATEMENT OF COMPLIANCE HLR-SHA-A The frequency of earthquakes at the site shall be based on a site-specific probabilistic seismic hazard analysis (existing or GMRS based on site-specific hazard as new) that reflects the composite distribution of the informed technical community. The level of analysis shall be documented in ML14090A275 (which was determined based on theintended application and on site-specific complexity. obtained from the work performed by Lettis HLR-SHA-B Consultants) and accepted by the NRC in To provide inputs to the probabilistic seismic hazard analysis, a comprehensive up-to-date database, including geological, ML15211A593.

seismological, and geophysical data; local site topography; and surficial geologic and geotechnical site properties, shall be compiled. A catalog of historical, instrumental, and paleoseismicity information shall also be compiled. The Lettis Consultants developed report, HLR-SHA-C submitted as part of correspondence NRC 2014-To account for the frequency of occurrence of earthquakes in the site region, the probabilistic seismic hazard analysis 0024, dated 03/31/2014, NextEra Energy Point shall examine all credible sources of potentially damaging earthquakes. Both the aleatory and epistemic uncertainties Beach, LLC Seismic Hazard and Screening Report shall be addressed in characterizing the seismic sources. (CEUS Sites), Response to NRC Request for HLR-SHA-D Information Pursuant to 10 CFR 50.54(f)

The probabilistic seismic hazard analysis shall examine credible mechanisms influencing estimates of vibratory ground Regarding Recommendation 2.1 of the Near-motion that can occur at a site given the occurrence of an earthquake of a certain magnitude at a certain location. Both Term Task Force Review of Insights from the the aleatory and epistemic uncertainties shall be addressed in characterizing the ground motion propagation. Fukushima Dai-ichi Accident, (ML14090A275)

HLR-SHA-E should be consulted for further detail. For The probabilistic seismic hazard analysis shall account for the effects of local site response. information beyond the scope of the report, HLR-SHA-F Lettis Consultants should be consulted.

Uncertainties in each step of the hazard analysis shall be propagated and displayed in the final quantification of hazard estimates for the site. The results shall include fractile hazard curves, median and mean hazard curves, and uniform hazard response spectra. For certain applications, the probabilistic seismic hazard analysis shall include seismic source deaggregation and magnitude-distance deaggregation.

HLR-SHA-G For further use in the seismic PRA, the spectral shape shall be based on a site-specific evaluation taking into account the contributions of deaggregated magnitude-distance results of the probabilistic seismic hazard analysis. Broad-band, smooth spectral shapes, such as those presented in NUREG/CR-0098 (for lower-seismicity sites such as most of those east of the U.S. Rocky Mountains) are also acceptable if they are shown to be appropriate for the site. The use of uniform hazard response spectra is also acceptable unless evidence comes to light that would challenge these uniform hazard spectral shapes.

HLR-SHA-H When use is made of an existing study for probabilistic seismic hazard analysis purposes, it shall be confirmed that the basic data and interpretations are still valid in light of current information, the study meets the requirements outlined in A through G above, and the study is suitable for the intended application.

HLR-SHA-I A screening analysis shall be performed to assess whether in addition to the vibratory ground motion, other seismic hazards, such as fault displacement, landslide, soil liquefaction, or soil settlement, need to be included in the seismic PRA for the specific application. If so, the seismic PRA shall address the effect of these hazards through assessment of the frequency of hazard occurrence or the magnitude of hazard consequences, or both.

HLR-SHA-J Documentation of the probabilistic seismic hazard analysis shall be consistent with the applicable supporting requirements.

SEISMIC SUPPORTING REQUIREMENTS -HAZARDS HIGH LEVEL SUPPORTING REQUIREMENTS STATEMENT OF COMPLIANCE SHA-A1 The PRA methods used in this evaluation a In performing the probabilistic seismic hazard analysis (PSHA), BASE it on, and MAKE it consist of, the collection and bounding analysis and demonstrably evaluation of available information and data, consideration of the uncertainties in each element of the PSHA, and a conservative analysis. The bounding analysis defined process and documentation to make the PSHA traceable. used the fragility data from the structural calculations and applied a CCDP of 1.0 to the The guidance and process given in NUREG/CR-6372 address the above requirement and MAY be used as an acceptable resulting failure frequency. The demonstrably methodology. In general, Levels 1 and 2 of these references correspond to Capability Category I, Levels 2 and 3 to conservative analysis used the same fragility Capability Category II, and Levels 3 and 4 to Capability Category III. The distinction between the consideration of data but applied failure probability to SSCs that uncertainties (for Capability Category I) and the evaluation of them (Capability Categories II and III) is important. The were relevant to the sequences resulting from a latter means a numerical evaluation. failed CT.

SHA-A2 The fragility is determined in reference to the As the parameter to characterize both hazard and fragilities, USE the spectral accelerations, or the average spectral PGA as documented in calculation 11Q0060-C-acceleration over a selected band of frequencies, or peak ground acceleration. 028.

While the use of peak ground acceleration as a parameter to characterize both hazard and fragility has been a common practice in the past and is acceptable, the use of spectral accelerations is preferable.

SHA-A3 In the selection of frequencies to determine spectral accelerations or average spectral acceleration, CAPTURE the The seismic demand is based on the frequency of frequencies of those structures, systems, or components, or a combination thereof that are significant in the PRA results the structure as shown in calculations 11Q0060-and insights. C-024, -025, -032, & -033.

Page 78 of 163

PBN-BFJR-17-019 Rev. 1 SHA-A4 In developing the probabilistic seismic hazard analysis results, whether they are characterized by spectral accelerations, The PRA evaluation used demonstrably peak ground accelerations, or both, EXTEND them to large-enough values (consistent with the physical data and conservative and bounding methods which did interpretations) so that the truncation does not produce unstable final numerical results, such as core damage not require the use of PRA quantification tools frequency, and the delineation and ranking of seismic-initiated sequences are not affected. that set truncation limits.

It is necessary to make sure that the hazard estimation is carried out to large-enough values (consistent with the physical data and interpretations) so that when convolved with the plant or component level fragility, the resulting failure frequencies are robust estimates and do not change if the acceleration range is extended. A sensitivity study can be conducted to define the upper-bound value. NUREG-1407 provides the additional guidance. Peer review needs to be attentive to this aspect.

SHA-A5 SPECIFY a lower-bound magnitude (or probabilistically defined characterization of magnitudes based on a damage Calculation 11Q0060-C-037 evaluate the parameter) for use in the hazard analysis, such that earthquakes of magnitude less than this value are not expected to Containment Dome Truss structures (including cause significant damage to the engineered structures or equipment. justification for attached and adjacent SSCs) for a bounding seismic acceleration, below which the The value of the lower-bound magnitude used in analyzing the site-specific hazard is based on engineering considerations truss structures, attached components, and

[5-26]14. Based on the evaluation of earthquake experience data, earthquakes with magnitudes less than 5.0 are not adjacent structures will maintain stresses within expected to cause damage to safety-related structures, or systems, or components, or a combination thereof. A lower- an elastic limit (i.e. not resulting in significant bound magnitude value of 5.0 was used for both the Lawrence Livermore National Laboratory and Electric Power damage to the truss structures).

Research Institute studies. The latest research in this area recommends using a probabilistically defined characterization of what magnitudes are expected to cause damage based on the Cumulative Absolute Velocity (CAV) parameter. Note that this lower bound applies only to the magnitude range considered in the final hazard quantification, not to the characterization and determination of seismicity parameters for the sources. The choice of magnitude scale should be consistent with the one used in the ground motion attenuation models and should be documented.

SHA-B1 The Lettis Consultants developed report, In performing the probabilistic seismic hazard analysis (PSHA), BASE it on available or developed geological, submitted as part of correspondence NRC 2014-seismological, geophysical, and geotechnical databases that reflect the current state of the knowledge and that are used 0024, dated 03/31/2014, NextEra Energy Point by experts/analysts to develop interpretations and inputs to the PSHA. Beach, LLC Seismic Hazard and Screening Report (CEUS Sites), Response to NRC Request for It is important that a comprehensive database be shared and used by all experts in developing the interpretations. The Information Pursuant to 10 CFR 50.54(f) availability of the database also facilitates the review process. RG 1.165 gives acceptable guidance on the scope and Regarding Recommendation 2.1 of the Near-types of data required for use in the seismic source characterization, ground motion modeling, and local site response Term Task Force Review of Insights from the evaluations to meet this requirement. Fukushima Dai-ichi Accident, (ML14090A275)

SHA-B2 should be consulted for further detail. For ENSURE that the database and information used are adequate to characterize all credible seismic sources that may information beyond the scope of the report, contribute to the frequency of occurrence of vibratory ground motion at the site, considering regional attenuation of Lettis Consultants should be consulted.

ground motions and local site effects. If the existing probabilistic seismic hazard analysis (PSHA) studies are to be used in the seismic PRA, ENSURE that any new data or interpretations that could affect the PSHA are adequately incorporated in the existing databases and analysis.

RG 1.165 defines four levels of investigations, with the degree of their detail based on distance from the site, the nature of the Quaternary tectonic regime, the geological complexity of the site and region, the existence of potential seismic sources, the nature of sources, the potential for surface deformation, etc. This guidance can be used to determine scope and size of region for investigations. The guidance in NUREG-0800, Section 2-5.2, may be used to meet this requirement.

SHA-B3 As a part of the database used, INCLUDE a catalog of historically reported, geologically identified, and instrumentally recorded earthquakes. USE reference NUREG-0800, Section 2-5.2, requirements or equivalent.

In general, the catalog typically includes events of size modified Mercalli intensity (MMI) or equivalent greater than or equal to IV and magnitude greater than or equal to 3.0 that have occurred within a radius of 320 km of a site, reference NUREG-0800, Section 2-5.2. For the earthquakes listed, the catalog typically contains information such as event date and time, epicentral location, earthquake magnitudes (measured and calculated), magnitude uncertainty, uncertainty in the event location, epicentral intensity, intensity uncertainty, hypocentral depth, references, and data sources.

SHA-C1 In the probabilistic seismic hazard analysis, EXAMINE all potential sources of earthquakes that affect the probabilistic hazard at the site. BASE the identification and characterization of seismic sources on regional and site geological and geophysical data, historical and instrumental seismicity data, the regional stress field, and geological evidence of prehistoric earthquakes.

SHA-C2 ENSURE that any expert elicitation process used to characterize the seismic sources is compatible with the level of analysis discussed in Requirement HA-A, and FOLLOW a structured approach.

SHA-C3 The seismic sources are characterized by source location and geometry, maximum earthquake magnitude, and 14 Final Report of the Diablo Canyon Long Term Seismic Program, Pacific Gas and Electric Company; available from the U.S. Nuclear Regulatory Commission, Dockets 50-275 and 50-323 (1988)

Page 79 of 163

PBN-BFJR-17-019 Rev. 1 earthquake recurrence. INCLUDE the aleatory and epistemic uncertain ties explicitly in these characterizations.

SHA-C4 If an existing probabilistic seismic hazard analysis study is used, SHOW that any seismic sources that were previously unknown or uncharacterized are not significant, or INCLUDE them in a revision of the hazard estimates.

SHA-D1 ACCOUNT in the probabilistic seismic hazard analysis for (a) credible mechanisms governing estimates of vibratory ground motion that can occur at a site (b) regional and site-specific geological, geophysical, and geotechnical data and historical and instrumental seismicity data (including strong motion data)

(c) current attenuation models in the ground motion estimates SHA-D2 ENSURE that any expert elicitation process used to characterize the ground motion is compatible with the level of analysis discussed in Requirement SHA-A, and FOLLOW a structured approach.

SHA-D3 ADDRESS both the aleatory and epistemic uncertainties in the ground motion characterization in accordance with the level of analysis identified for Requirement SHA-A.

SHA-D4 If an existing probabilistic seismic hazard analysis study is used, SHOW that any ground motion models or new information that were previously unused or unknown are not significant, or INCLUDE them in a revision of the hazard estimates.

SHA-E1 ACCOUNT in the probabilistic seismic hazard analysis for the effects of site topography, surficial geologic deposits, and site geotechnical properties on ground motions at the site.

SHA-E2 ADDRESS both the aleatory and epistemic uncertainties in the local site response analysis.

SHA-F1 In the final quantification of the seismic hazard, INCLUDE and DISPLAY the propagation of both aleatory and epistemic uncertainties.

SHA-F2 In the probabilistic seismic hazard analysis, INCLUDE appropriate sensitivity studies and intermediate results to identify factors that are important to the site hazard and that make the analysis traceable.

SHA-F3 DEVELOP the following results as a part of the quantification process, compatible with needs for the level of analysis determined in (HLR-SHA-A):

(a) fractile and mean hazard curves for each ground motion parameter considered in the probabilistic seismic hazard analysis (b) fractile and mean uniform hazard response spectrum SHA-G1 BASE the response spectral shape used in the seismic PRA on site-specific evaluations performed for the probabilistic seismic hazard analysis. REFLECT or BOUND the site-specific considerations.

SHA-H Use of existing studies allowed.

When using the Lawrence Livermore National Laboratory/U.S. Nuclear Regulatory Commission [5-24] or Electric Power Research Institute [5-25] hazard studies, or another study done to a comparable technical level, the intent of this requirement is not to repeat the entire hazard exercise or calculations, unless new information and interpretations that affect the site have been established and affect the usefulness of the seismic PRA for the intended application. Depending upon the application, sensitivity studies, modest extensions of the existing analysis, or approximate estimates of the differences between using an existing hazard study and applying the newer one may be sufficient. Additionally, an educated assessment may be sufficient to demonstrate that the impact on the application of information or data that is less extensive than a new hazard study is not significant.

HIGH LEVEL REQUIREMENTS - FRAGILITY Screening of high-seismic-capacity HIGH LEVEL SUPPORTING REQUIREMENTS components was not required.

HLR-SFR-A The seismic-fragility evaluation shall be performed to estimate plant-specific, realistic seismic fragilities of structures, or The seismic demand is based on a realistic systems, or components, or combination thereof whose failure may contribute to core damage or large early release, or both. seismic response captured through a soil-structure interaction analysis as documented in calculation 11Q0060-C-027.

HLR-SFR-B The seismic fragilities of the CTs are based If screening of high-seismic-capacity components is performed, the basis for the screening shall be fully described. on the critical failure mode based on the highest loaded component as documented in calculations 11Q0060-C-024 & -025.

Page 80 of 163

PBN-BFJR-17-019 Rev. 1 HLR-SFR-C The analysis of the CTs account for The seismic-fragility evaluation shall be based on realistic seismic response that the SSCs experience at their failure levels. information obtained from walkdowns as documented in calculations 11Q0060-C-024 & -025.

HLR-SFR-D The seismic fragilities are calculated based The seismic-fragility evaluation shall be performed for critical failure modes of structures, systems, or components, or a on generic parameters that are considered combination thereof such as structural failure modes and functional failure modes identified through the review of plant to be bounding as documented in design documents, supplemented as needed by earthquake experience data, fragility test data, generic qualification test data, calculation 11Q0060-C-028.

and a walkdown.

HLR-SFR-E The seismic fragility is documented in The seismic-fragility evaluation shall incorporate the findings of a detailed walkdown of the plant focusing on the anchorage, calculation 11Q0060-C-028.

lateral seismic support, and potential systems interactions.

HLR-SFR-F The realistic seismic fragility of the CTs is The calculation of seismic-fragility parameters such as median capacity and variabilities shall be based on plant-specific data calculated as documented in calculations supplemented as needed by earthquake experience data, fragility test data, and generic qualification test data. Use of such 11Q0060-C-024, -025, -028, -032, & -033.

generic data shall be justified.

HLR-SFR-G Screening of high-seismic-capacity Documentation of the seismic-fragility evaluation shall be consistent with the applicable supporting requirements. components was not required.

SEISMIC SUPPORTING REQUIREMENTS - FRAGILITY STATEMENT OF COMPLIANCE SFR-A1 CALCULATE seismic fragilities for SSCs identified by the systems analysis (see Requirement SPR-D1). Seismic fragilities are documented in calculation 11Q0060-C-028 and are calculated for the CTs and NOTE: (1) Seismic fragilities are needed for SSCs identified by the systems analysis that are modeled in the event trees the liner/wall. The seismic fragilities for attached and fault trees. Failure of one or more of these may contribute to core damage or large early release, or both. components are shown to be bounded.

Requirements for developing this list of SSCs are given under the Systems Analysis section (see Requirement SPR-D1).

See also the Requirement HLR-SFR-B on screening.

SFR-A2 Site specific data was used to determine the GMRS CALCULATE the seismic fragilities based on plant-specific data, and ENSURE that they are realistic (median with as documented in ML14090A275 (which was uncertainties). obtained from the work performed by Lettis Consultants) and accepted by the NRC in NOTE: (2) The objective of a seismic PRA is to obtain a realistic seismic risk profile for the plant using plant-specific ML15211A593. The in-structure response spectra and site-specific data. It has been demonstrated in several seismic PRAs that the risk estimates and insights on was based on site-specific soil data as documented in seismic vulnerabilities are very plant specific, even varying between supposedly identical units at a multiunit plant. calculation 11Q0060-C-027.

To minimize the effort on nonsignificant items and to focus the resources on the more critical aspects of the seismic PRA, certain high-seismic-capacity components are screened out using generic data (e.g., fragility test data, generic seismic qualification test data, and earthquake experience data).

SFR-B1 SCREEN OUT high-seismic-capacity components only if the components' failures can be considered as fully Screening out of high-seismic-capacity components independent of the remaining components. was not required.

NOTES: (1) When screening of high-seismic-capacity components is performed, the basis for screening and supporting documents is to be fully described. Guidance given in EPRI NP-6041-SL, Rev. 1 [5-3] and NUREG/CR-4334 [5-4] may be used to screen out high-seismic-capacity components after satisfying the caveats. Note that the screening guidance in these documents has been developed generally for U.S.-vendored equipment and based on U.S. seismic design practice. Care should be used in applying the screening criteria for other situations. The use of generic fragility information is acceptable for screening if the SSCs can be shown to fall within the envelope of the generic fragility caveats.

The screening level chosen should be based on the seismic hazard at the site and on the plant seismic design basis and should be high enough that the contribution to core damage frequency and large early release frequency from the screened-out components is not significant. (See Requirement SHA-G1.) For a discussion of possible approaches to the selection of the screening level, the reader is referred to reference [5-10]

SFR-C1 ESTIMATE the seismic responses that the components experience at their failure levels on a realistic basis using site- The Lettis Consultants developed report, submitted specific earthquake response spectra in three orthogonal directions, anchored to a ground motion parameter such as part of correspondence NRC 2014-0024, dated as peak ground acceleration or average spectral acceleration over a given frequency band. 03/31/2014, NextEra Energy Point Beach, LLC Seismic Hazard and Screening Report (CEUS Sites), Response NOTES: (1) NUREG-1407 [5-7] recommends the use of 10,000-yr return period UHS median spectral shapes provided to NRC Request for Information Pursuant to 10 CFR in reference [5-32] along with variability estimates that reflect the site-specific shapes as discussed in Note (1) of 50.54(f) Regarding Recommendation 2.1 of the Near-Table 5-2.1-8. Any UHS should be used cautiously to ensure that the spectral shape reflects the contributions from Term Task Force Review of Insights from the dominating events as discussed under Requirement SHA-G1. See Note (1) of Table 5-2.1-8 Fukushima Dai-ichi Accident, (ML14090A275) should be consulted for further detail. For information beyond the scope of the report, Lettis Consultants should be consulted.

Page 81 of 163

PBN-BFJR-17-019 Rev. 1 SFR-C2 The seismic response is calculated using five (5) real PERFORM probabilistic seismic response analysis taking into account the uncertainties in the input ground motion motion time histories in each orthogonal direction and site soil properties, and structural parameters, and ESTIMATE joint probability distributions of the responses of that are modified to match the GMRS (calculation different components in the building. 11Q0060-C-026). The in-structure seismic response accounts for the variability in soil properties by NOTES: (2) For a description of the probabilistic seismic response analysis, the reader is referred to references [5-38] enveloping the lower estimate, best estimate, and and [5-31]. upper estimate of the soil properties, and broadened to account for structural uncertainties (calculation 11Q0060-C-027).

SFR-C3 Addressed in Requirement SFR-C2 N/A NOTES: (3) The scaling procedures given in reference [5-3] may be used. Scaling of responses from existing analysis is not permitted for Capability Category III.

SFR-C4 Addressed in Requirement SFR-C2 N/A SFR-C5 Addressed in Requirement SFR-C2 N/A NOTES:(4) Reference [5-10] gives an acceptable method.

SFR-C6 Addressed in Requirement SFR-C2 N/A NOTES: (5) Further details about the basis of this requirement can be found in reference [5-15].

SFR-D1 The seismic fragilities of the CTs are based on the IDENTIFY realistic failure modes of structures ( e.g., sliding, overturning, yielding, and excessive drift), equipment critical failure mode based on the highest loaded (e.g., anchorage failure, impact with adjacent equipment or structures, bracing failure, and functional failure), and component as documented in calculations 11Q0060-soil (e.g., liquefaction, slope instability, and excessive differential settlement) that interfere with the operability of C-024 & -025.

equipment during or after the earthquake, through a review of the plant design documents and the walkdown.

NOTES: (1) Note that sometimes failure modes such as drift and yielding may be more relevant for the functionality of attached equipment than gross structural failures (e.g., partial collapse or complete collapse)

SFR-D2 The seismic fragilities of the CTs are based on the EVALUATE all relevant failure modes identified in Requirement SFR-D1, and EVALUATE fragilities for critical failure critical failure mode based on the highest loaded modes. component as documented in calculations 11Q0060-C-024 & -025.

NOTES: (2) Published references and past seismic PRAs could be used as guidance. Examples include references [5-3],

[5-10], and [5-26 SFR-E1 The analysis of the CTs account for information CONDUCT a detailed walkdown of the plant, focusing on equipment anchorage, lateral seismic support, spatial obtained from walkdowns as documented in interactions, and potential systems interactions (both structural and functional interactions). calculations 11Q0060-C-024 & -025.

NOTES: (1) The seismic walkdown is an important activity in the seismic PRA. The purposes of such a walkdown are to find as-designed, as-built, and as-operated seismic weaknesses in the plant and to ensure that the seismic fragilities are realistic and plant specific. It should be done in sufficient detail and documented in a sufficiently complete fashion so that the subsequent screening or fragility evaluation is traceable. For guidance on walkdowns, the analyst is referred to references [5-3] and [5-4]. (See Requirement SPR-B9.)

SFR-E2 Various walkdowns were performed in support of DOCUMENT the walkdown procedures, walkdown team composition and its members' qualifications, walkdown the structural evaluation and documented in the observations, and conclusions. calculations.

SFR-E3 Screening of high-seismic-capacity components was If components are screened out during or following the walkdown, DOCUMENT the basis, including any anchorage not required.

calculations that justify such a screening.

SFR-E4 During the walkdown, EVALUATE the potential for seismically induced fire and flooding by focusing on the issues Not applicable. This evaluation focuses on the CT described in NUREG-1407 [5-7]. only.

NOTES: (2) Seismically induced fires and floods are to be addressed as described in NUREG-1407 [5-7]. The effects of seismically induced fires and impact of inadvertent actuation of fire protection systems on safety systems should be assessed. The effects of seismically induced external flooding and internal flooding on plant safety should be included. The scope of the evaluation of seismically induced flood, in addition to that of the external sources of water (e.g., tanks and upstream dams), should include the evaluation of some internal flooding that is consistent with the discussion Page 82 of 163

PBN-BFJR-17-019 Rev. 1 SFR-E5 Reference 3 evaluated the interaction of CT debris on During the walkdown, EVALUATE potential sources of interaction (e.g., II/I issues, impact between cabinets, masonry components below. This applied only to the walls, flammable and combustion sources, flooding, and spray) and consequences of such interactions on equipment demonstrably conservative analysis. The bounding contained in the systems model. analysis assumed that CT failure results in core damage, CCDP = 1.0.

NOTES: (3) A "II/I issue" refers to situations where a nonseismically qualified object could fall on and damage a seismically qualified item of safety equipment, and also situations where a low seismic capacity object falls on and damages an SSC item with higher seismic capacity. In such cases, the fragility of the higher capacity SSC may be controlled by the low capacity object.

SFR-F1 During the walkdown, EVALUATE potential sources of interaction (e.g., II/I issues, impact between cabinets, masonry walls, flammable and combustion sources, flooding, and spray) and consequences of such interactions on equipment contained in the systems model.

NOTES: (3) A "II/I issue" refers to situations where a nonseismically qualified object could fall on and damage a seismically qualified item of safety equipment, and also situations where a low seismic capacity object falls on and damages an SSC item with higher seismic capacity. In such cases, the fragility of the higher capacity SSC may be controlled by the low capacity object.

SFR-F2 The IPEEE was reviewed to assure that the SSCs For all SSCs that appear in the significant accident sequences, ENSURE that they have site-specific fragility credited in the demonstrably conservative evaluation parameters that are derived based on plant-specific information, such as anchoring and installation of the have fragilities that do not preclude crediting them in component or structure and plant-specific material test data. the analysis.

NOTES: (2) The objective of the fragility analysis is to derive fragility parameters that are as realistic as possible.

They should reflect the as-built conditions of the equipment and should use plant-specific information. Use of conservative fragilities would distort the contribution of the seismic events to core damage frequency and large early release frequency. Note that the use of conservative fragilities may underestimate the frequencies of some accident sequences involving "success" terms. Therefore, generic fragilities, if used, should not be overly conservative and should be appropriate for the seismic risk profile of the plant. For further discussion, refer to 5-1.6. Peer reviews need to be attentive to this aspect.

SFR-F3 CALCULATE seismic fragilities for relays identified to be essential and that are included in the systems-analysis Not applicable.

model.

NOTES: (3) Guidance on evaluation of relay chatter effects is given in references [5-3], [5-7], and [5-14] (see Requirement SPR-B4). Essential relays are defined in reference [5-14].

SFR-F4 The liner fragility is calculated as documented in CALCULATE seismic fragilities for SSCs that are identified in the systems model as playing a role in the large early calculation 11Q0060-C-028 and is shown to be release frequency part of the seismic PRA. (See Requirements SPR-A1 and SPR-A3.) bounded by the CT fragilities.

NOTES: (4) Generally, the concern is the seismically induced early failure of containment functions. NUREG-1407 [5-7]

describes these functions as containment integrity, containment isolation, prevention of bypass functions, and some specific systems depending on the containment design (e.g., igniters, suppression pools, or ice baskets).

SFR-G1 The realistic seismic fragility of the CTs is calculated DOCUMENT the seismic-fragility analysis in a manner that facilitates PRA applications, upgrades, and peer review. as documented in calculations 11Q0060-C-024, -025,

-028, -032, & -033.

SFR-G2 DOCUMENT the process used in the seismic-fragility analysis. For example, this typically includes a description of (a) the methodologies used to quantify the seismic fragilities of SSCs, together with key assumptions (b) the SSC fragility values that includes the method of seismic qualification, the dominant failure mode(s), the 11Q0060-RPT-002, 11Q0060-C-028, and Engineering source of information, and the location of the component Evaluation 2017-0008 document the process used in (c) the fragility parameter values (i.e., median acceleration capacity, BETA(R) and BETA(U) and the technical the seismic-fragility analysis, the methodologies, the bases for them for each analyzed SSC, and failure modes, and the fragility parameters.

(d) the different elements of seismic-fragility analysis, such as (1) the seismic response analysis (2) the screening steps (3) the walkdown (4) the review of design documents (5) the identification of critical failure modes for each SSC, and (6) the calculation of fragility parameter values for each SSC modeled NOTE: (1) The documentation requirements given in NUREG-1407 [5-7] and followed in the Diablo Canyon Long Term Seismic Program [5-26] and Bohn and Lambright [5-17] studies may be used as guidance.

Page 83 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT D EPRI FRANX 4.3 HAZARD EDITOR OUTPUT Used in Section 2.2.1 of this evaluation Page 84 of 163

PBN-BFJR-17-019 Rev. 1 Page 85 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT E CONSTRUCTION TRUSS THERMAL MODEL DEVELOPMENT Page 86 of 163

PBN-BFJR-17-019 Rev. 1 THERMAL CONSTRUCTION TRUSS MODEL The CT Thermal model is based on the internal event model logic of the NFPA 805 model. New logic was added to the model to represent SSCs and actions required to characterize the sequences representing thermal transient impacts on the CT. The following fault trees were merged with the NFPA 805 model:

FAULT TREE DESCRIPTION FILE LOCATION GCI-100 UNIT 1.caf FAILURE OF CONTAINMENT X:\PBN\Team\PRA\RG 1.200\Notebooks-OBSOLETE\5.12 Cont Isol ISOLATION Prepared by SEG Review by JM GCI-100 UNIT 2.caf GFC1100-NEW.caf ONE CONT. FAN COOLER FAILS TO X:\PBN\Team\PRA\RG 1.200\Notebooks-OBSOLETE\5.11 Fan PROVIDE COOLING Coolers Prepared by SEG Review by JM GFC1900-NEW.caf 3 OF 4 CONT. FAN COOLERS FAIL TO X:\PBN\Team\PRA\RG 1.200\Notebooks-OBSOLETE\5.11 Fan PROVIDE COOLING Coolers Prepared by SEG Review by JM GCS1100.caf CONT.SPRAY FROM 1/ 2 TRAINS FAILS X:\PBN\Team\PRA\RG 1.200\Notebooks-OBSOLETE\5.10 Cont TO DELIVER FLOW Spray Prepared by SEG Review by JM GCS1110.caf NO FLOW FROM 2/2 TRAINS OF X:\PBN\Team\PRA\RG 1.200\Notebooks-OBSOLETE\5.10 Cont CONT. SPRAY Spray Prepared by SEG Review by JM A new gate was created in the NFPA 805 models which represent the failure of 1 of 2 feedwater isolation valves.

The gate is shown below.

FEEDWATER ISOLATION VALVE (FIV) AND FEED REG VALVE FAILS TO CLOSE GFIV1000 FEEDWATER ISOLATION FEEDWATER ISOLATION VALVE CS-3124 FAILS TO VALVE CS-3125 FAILS TO CLOSE CLOSE CS--AOV-OO-03124 CS--AOV-OO-03125 2 1.73E-03 2 1.73E-03 The basic events are new events since the feedwater isolation valves (FIVs) are not currently in the NFPA 805 model:

• CS-AOV-OO-03124, FEEDWATER ISOLATION VALVE CS-3124 FAILS TO CLOSE; probability = 1.7305E-03

• CS-AOV-OO-03125, FEEDWATER ISOLATION VALVE CS-3125 FAILS TO CLOSE; probability = 1.7305E-03 A new gate was created in the NFPA 805 model to represent failure of one out of two trains of containment safeguards actuation. The new gate is shown below. The two inputs to the new gate were already in the NFPA 805 models.

GLWA260 represents no SI signal from Train A and GLWB260 represents no SI signal from Train B. The SI signal was assumed to be generated from a low pressurizer pressure signal. This function is credited in the small-break and large-break LOCA analyses to initiate emergency core cooling, and containment isolation. This function is also credited in the steam generator tube rupture analysis to initiate emergency core cooling. Finally, this function provides a backup SI actuation in the mitigation of a steam line break, although not assumed in the accident analysis.

Page 87 of 163

PBN-BFJR-17-019 Rev. 1 CONTAINM ENT SAFEGUARDS ACTUATION TRAINS AVAILABLE GACT1000 NO SI SIGNAL TO TIM E NO SI SIGNAL TO TIM E DELAY RELAYS DELAY RELAYS GLWA260 GLWB260 Page 1196 Page 1242 UNDERVOLTAGE RELAYS NO SIGNAL FROM SI TRAIN A SAFETY SPURIOUSLY OPERATE SLAVE RELAYS SI-11X OR INJECTION SIGNAL FROM SI-14X LOW PZR PRESSURE GL1A280 GL1A200 GLSA100 UV RELAY 271X4/B03 UV RELAY 272X4/B03 FAILURE OF SIGNAL FROM FAILURE OF SIGNAL F TRAIN A SAFETY NO POWER FROM 125V SPURIOUSLY OPERATES SPURIOUSLY OPERATES RELAY 1-SI11X ROM RELAY 1-SI14X INJECTION SIGNAL FAILS DC DISTRIBUTION PANEL D-11 ESF-REL-SA-1X4B3 ESF-REL-SA-2X4B3 GL1A210 GL1A212 GLSA110 GLDA100 4 5.00E-07 4 5.00E-07 Page 1199 Page 1200 Page 1201 Page 1211 Page 88 of 163

PBN-BFJR-17-019 Rev. 1 The gates were provided as inputs to the various cases (GCASE2, GCASE3, GCASE4 and GCASE5) which were inputs to top gate GTHERMAL-CASES. The logic is shown below.

THERM AL CASES GTHERM AL-CASES CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 2 (ONE TRAIN OF ACT, CFC AND CASE 3 (FEEDWATER ISOLATION CASE 4 (ONE TRAIN OF ACT AND CFC CASE 5 (ONE TRAIN OF ACT AND CS CS FAILS) VALVE FAILS TO CLOSE) FAIL, BOTH TRAINS CS FAILS, ONE TRAIN + 1 GCASE2 GCASE3 GCASE4 GCASE5 CONTAINM ENT SAFEGUARDS CONT.SPRAY FROM 1/ 2 TRAINS FAILS FEEDWATER ISOLATION VALVE (FIV) CONSTRUCTION TRUSS THERM AL CONTAINM ENT SAFEGUARDS NO FLOW FROM 1/2 TRAINS OF CONT. CONTAINM ENT SAFEGUARDS CONT.SPRAY FROM 1/ 2 TRAINS FAILS ACTUATION TRAINS AVAILABLE TO DELIVER FLOW AND FEED REG VALVE FAILS TO CASE 3 (FEEDWATER ISOLATION ACTUATION TRAINS AVAILABLE SPRAY ACTUATION TRAINS AVAILABLE TO DELIVER FLOW CLOSE VALVE FAILS TO CLOSE)

GACT1000 GCS1100 GFIV1000 FLAG-CASE3-THERM AL GACT1000 GCS1110 GACT1000 GCS1100 9.99E-01 ONE CONT. FAN COOLER FAILS TO CONSTRUCTION TRUSS THERM AL ONE CONT. FAN COOLER FAILS TO CONSTRUCTION TRUSS THERM AL 3 OF 4 CONT. FAN COOLERS FAIL TO CONSTRUCTION TRUSS THERM AL PROVIDE COOLING CASE 2 (ONE TRAIN OF ACT, CFC AND PROVIDE COOLING CASE 4 (ONE TRAIN OF ACT AND CFC PROVIDE COOLING CASE 5 CS FAILS) FAIL, BOTH TRAINS CS GFC1100 FLAG-CASE2-THERM AL GFC1100 FLAG-CASE4-THERM AL GFC1900 FLAG-CASE5-THERM AL 9.99E-01 9.99E-01 9.99E-01 The top gate was solved using FTREX using a truncation probability of 1.00E-10 no flag file; no mutually exclusive file and no recovery rule file.

Page 89 of 163

PBN-BFJR-17-019 Rev. 1 Table 10 from section 2.3.4 is based on the quantification of the thermal model - the table from section 2.3.4 is copied below. Note that Case 1 is equal to 1 minus cases 2, 3, 4, and 5. Cutset file is GTHERMAL-CASES. Cut.

Table 10: Containment Cooling System Configuration Probabilities and Temperatures Containment Configuration Case ACT CFC CS FIV Temperature Basis Temp[1] (F) Probability o Assumption based on results from 2 of 2 4 of 4 2 of 2 <270 F 1 AVAILABLE 0.997 Case 2. All trains available should (No Failures) (No Failures) (No Failures) estimated result in temperatures less than 270F.

1 of 2 2 of 4 1 of 2 o CN-CRA-08-43 Rev 01 Case 1c, Table 2 GACT1000 GFC1100 GCS1100 AVAILABLE 270 F 7.12E-6 5-1 (One Train Fails) (One Train Fails) (One Train Fails) 2 of 2 4 of 4 2 of 2 FAILURE o CN-CRA-08-43 Rev 01 Case 1b, Table 3 GFIV1000 277.8 F 3.45E-3 (No Failures) (No Failures) (No Failures) 5-1 for FIV only.

1 of 2 None 2 of 4 GCS1110 o Assumption, total frequency <1E-05 4 GACT1000 GFC1100 AVAILABLE >280 F 5.11E-7 and as such can be screened out (Both Trains (One Train Fails) (One Train Fails)

Fail) 1 of 2 1 of 4 1 of 2 o Assumption, total frequency <1E-05 5 GACT1000 GFC1900 GCS1100 AVAILABLE >280 F 6.91E-6 and as such can be screened out (One Train Fails) (One Train Fails + 1) (One Train Fails)

Probability = probability of containment safeguards configuration ACT = Containment Safeguards Actuation Trains Available CFC = Containment Fan Coolers (4 coolers total, 2 per train) Available CS = Containment Spray (2 pump trains) Available FIV = Feedwater Isolation Valve and Feedwater Regulating Valve (failure to isolate feedwater allowing water upstream to inject) 1]

Containment is modeled as a single bulk volume as such the temperature is the bulk average temperature.

Cutsets were generated using the UNIT1-SEISMIC.caf model, solving gate GTHERMAL-CASES with FTREX at a truncation of 1E-14. Cutset file is GTHERMAL-CASES-E-12.cut.

Total FTREX probability for cases 2, 3, 4 and 5 = 3.47E-3; ACUBE = 3.46E-3.

[1]

Containment is modeled as a single bulk volume as such the temperature is the bulk average temperature.

Page 90 of 163

PBN-BFJR-17-019 Rev. 1 Bounding Analysis - Thermal A new fault tree was created in the NFPA 805 models named GCT-IE-FRAG-CASES. This fault tree was used to calculate the probability that the CT would fail given a thermal initiating event and the fragility of the construction truss at the temperature provided in Table 10 for each case. Section 2.3.2 describes the basis for and how the initiating event frequencies were developed. The difference between this case and the case above is that this case uses the initiating event frequency where the case above assumed the initiating event frequency was 1. This case also factors in the thermal fragility of the construction truss.

The fault tree used is shown below:

Page 91 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 1 (NO FAILURES)

GCT-IE-FRAG-CASE1 INITIATING EVENTS FOR FRAGILITY OF CONSTRUCTION TRUSS CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL AT 270 DEGREES F CASE 1 GINIT-CT-THERM FRAG-270F FLAG-CASE1-THERM AL 2 2.50E-05 9.99E-01 INITIATING EVENT LARGE LOCA (>6) INITIATING EVENT SM ALL LOCA (3/8 TO 2)

INIT-A INIT-S2 9 1.33E-06/Y 3 5.77E-04/Y FEEDLINE BREAK INSIDE STEAM LINE BREAK INSIDE CONTAINM ENT CONTAINM ENT INIT-FBIC INIT-SBIC 5 2.50E-05/Y 5 1.40E-04/Y INITIATING EVENT M EDIUM LOCA (>2 TO 6)

INIT-S1 3 5.61E-04/Y Page 92 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 2 (ONE TRAIN OF ACT, CFC AND CS FAILS)

GCT-IE-FRAG-CASE2 INITIATING EVENTS FOR CONT.SPRAY FROM 1/ 2 TRAINS FAILS CONSTRUCTION TRUSS THERM AL TO DELIVER FLOW GINIT-CT-THERM GCS1100 CONTAINM ENT SAFEGUARDS CONSTRUCTION TRUSS THERM AL ACTUATION TRAINS AVAILABLE CASE 2 (ONE TRAIN OF ACT, CFC AND CS FAILS)

GACT1000 FLAG-CASE2-THERM AL 2 9.99E-01 ONE CONT. FAN COOLER FAILS TO FRAGILITY OF CONSTRUCTION TRUSS PROVIDE COOLING AT 270 DEGREES F GFC1100 FRAG-270F 2 2.50E-05 CONSTRUCTION TRUSS THERM AL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE)

GCT-IE-FRAG-CASE3 INITIATING EVENTS FOR CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE)

GINIT-CT-THERM FLAG-CASE3-THERM AL 2 9.99E-01 FEEDWATER ISOLATION VALVE (FIV) FRAGILITY OF CONSTRUCTION TRUSS AND FEED REG VALVE FAILS TO AT 277 DEGREES F CLOSE GFIV1000 FRAG-277F 2.00E-04 Page 93 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 4 (ONE TRAIN OF ACT AND CFC FAIL, BOTH TRAINS CS GCT-IE-FRAG-CASE4 INITIATING EVENTS FOR NO FLOW FROM 1/2 TRAINS OF CONT.

CONSTRUCTION TRUSS THERM AL SPRAY GINIT-CT-THERM GCS1110 CONTAINM ENT SAFEGUARDS CONSTRUCTION TRUSS THERM AL ACTUATION TRAINS AVAILABLE CASE 4 (ONE TRAIN OF ACT AND CFC FAIL, BOTH TRAINS CS GACT1000 FLAG-CASE4-THERM AL 2 9.99E-01 ONE CONT. FAN COOLER FAILS TO FRAGILITY OF CONSTRUCTION TRUSS PROVIDE COOLING AT 298 DEGREES F GFC1100 FRAG-298F 2 1.00E-02 CONSTRUCTION TRUSS THERM AL CASE 5 (ONE TRAIN OF ACT AND CS FAILS, ONE TRAIN + 1 GCT-IE-FRAG-CASE5 INITIATING EVENTS FOR CONT.SPRAY FROM 1/ 2 TRAINS FAILS CONSTRUCTION TRUSS THERM AL TO DELIVER FLOW GINIT-CT-THERM GCS1100 CONTAINM ENT SAFEGUARDS CONSTRUCTION TRUSS THERM AL ACTUATION TRAINS AVAILABLE CASE 5 GACT1000 FLAG-CASE5-THERM AL 2 9.99E-01 3 OF 4 CONT. FAN COOLERS FAIL TO FRAGILITY OF CONSTRUCTION TRUSS PROVIDE COOLING AT 298 DEGREES F GFC1900 FRAG-298F 2 1.00E-02 Page 94 of 163

PBN-BFJR-17-019 Rev. 1 With the following basic events were added to characterize the thermal fragility curve, Figure 11, section 2.3.1:

• FRAG-270F, Fragility of Construction Truss at 270 Degrees F, Probability = 2.5E-05

• FRAG-277F, Fragility of Construction Truss at 277 Degrees F, Probability = 2.0E-04

• FRAG-298F, Fragility of Construction Truss at 298 Degrees F, Probability = 1.0E-02 BOUNDING CASE - THERMAL RESULTS Cutsets were generated using the UNIT1-SEISMIC.caf model, which includes the thermal top event, solving gate GCT-IE-FRAG-CASES with FTREX at a truncation of 1E-15. Run at 1E-14 was less than 0.1% different. Cutset file is GCT-IE-FRAG-CASES-E-15.cut.

The following table provides the bounding CDF results for each containment cooling case.

Bounding Thermal Case CDF (GCT-IE-FRAG-CASES top event)

E-15 Truncation CASE 1 4.6906E-08/yr.

CASE 2 2.6312E-13/yr.

CASE 3 1.2987E-09/yr.

CASE 4 1.5010E-13/yr.

CASE 5 1.1942E-10/yr.

TOTAL 4.8325E-08/yr.

Page 95 of 163

PBN-BFJR-17-019 Rev. 1 ACUBE results were 4.83E-08/yr, same as FTREX; no reduction achieved by applying the Binary Decision Diagram method indicating the cutsets contained very few non-minimal cutsets.

Uncertainty results based on applying UNCERT 4.0 [Ref 24] to the cutsets generated by quantifying GCT-IE-FRAG-CASES at a truncation of E-15 :

BOUNDING THERMAL ANALYSIS CDF UNCERTAINTY Parameter Estimate Confidence Range Point Estimate 4.83E-08 Samples (Monte Carlo) 50000 Mean 4.85E-08 [4.7E-08 , 5.0E-08]

5% 1.51E-09 [1.5E-09 , 1.6E-09]

Median 1.50E-08 [1.5E-08 , 1.5E-08]

95% 1.83E-07 [1.8E-07 , 1.9E-07]

Standard Deviation 1.55E-07 Skewness 22.57251 Page 96 of 163

PBN-BFJR-17-019 Rev. 1 DEMONSTRABLY CONSERVATIVE -THERMAL Next a case quantified CDF by creating a new top gate GCT-CDF-CASES by including failure of bleed and feed using two PORVs. The case above did not credit any mitigation. HEP-RCS-CSPH1-12, FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE), was changed to a new value 2.19E-02 vs. 5.0E-02, with an error factor of 5 per the latest HEP calculation (Attachment B). The rupture frequency on the IA and SA tanks was changed from 1 demand to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> since tank rupture probability is a per hour failure rate not a per demand failure rate and the mission time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The fault tree created is shown below:

THERM AL CASES CORE DAM AGE FREQUENCY GCT-CDF-CASES CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 1 (NO FAILURES) CASE 4 (ONE TRAIN OF ACT AND CFC FAIL, BOTH TRAINS CS GCT-CDF-CASE1 GCT-CDF-CASE4 CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 2 (ONE TRAIN OF ACT, CFC AND CASE 5 (ONE TRAIN OF ACT AND CS CS FAILS) FAILS, ONE TRAIN + 1 GCT-CDF-CASE2 GCT-CDF-CASE5 CONSTRUCTION TRUSS THERM AL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE)

GCT-CDF-CASE3 Page 97 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 1 (NO FAILURES)

GCT-CDF-CASE1 INITIATING EVENTS FOR CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 1 GINIT-CT-THERM FLAG-CASE1-THERM AL 2 9.99E-01 FRAGILITY OF CONSTRUCTION TRUSS FAILURE OF FEED AND BLEED AT 270 DEGREES F COOLING (INCLUDING SI)

FRAG-270F GFB1100 4 2.50E-05 CONSTRUCTION TRUSS THERM AL CASE 2 (ONE TRAIN OF ACT, CFC AND CS FAILS)

GCT-CDF-CASE2 INITIATING EVENTS FOR CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 2 (ONE TRAIN OF ACT, CFC AND CS FAILS)

GINIT-CT-THERM FLAG-CASE2-THERM AL 3 9.99E-01 CONTAINM ENT SAFEGUARDS FRAGILITY OF CONSTRUCTION TRUSS ACTUATION TRAINS AVAILABLE AT 270 DEGREES F GACT1000 FRAG-270F 4 2.50E-05 ONE CONT. FAN COOLER FAILS TO FAILURE OF FEED AND BLEED PROVIDE COOLING COOLING (INCLUDING SI)

GFC1100 GFB1100 CONT.SPRAY FROM 1/ 2 TRAINS FAILS TO DELIVER FLOW GCS1100 Page 98 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE)

GCT-CDF-CASE3 INITIATING EVENTS FOR FRAGILITY OF CONSTRUCTION TRUSS CONSTRUCTION TRUSS THERM AL AT 277 DEGREES F GINIT-CT-THERM FRAG-277F 2 2.00E-04 FEEDWATER ISOLATION VALVE (FIV) FAILURE OF FEED AND BLEED FAILS TO CLOSE COOLING (INCLUDING SI)

GFIV1000 GFB1100 CONSTRUCTION TRUSS THERM AL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE)

FLAG-CASE3-THERM AL 3 9.99E-01 Page 99 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 4 (ONE TRAIN OF ACT AND CFC FAIL, BOTH TRAINS CS GCT-CDF-CASE4 INITIATING EVENTS FOR CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 4 (ONE TRAIN OF ACT AND CFC FAIL, BOTH TRAINS CS GINIT-CT-THERM FLAG-CASE4-THERM AL 3 9.99E-01 CONTAINM ENT SAFEGUARDS FRAGILITY OF CONSTRUCTION TRUSS ACTUATION TRAINS AVAILABLE AT 298 DEGREES F GACT1000 FRAG-298F 4 1.00E-02 ONE CONT. FAN COOLER FAILS TO FAILURE OF FEED AND BLEED PROVIDE COOLING COOLING (INCLUDING SI)

GFC1100 GFB1100 NO FLOW FROM 1/ 2 TRAINS OF CONT.

SPRAY GCS1110 Page 100 of 163

PBN-BFJR-17-019 Rev. 1 CONSTRUCTION TRUSS THERM AL CASE 5 (ONE TRAIN OF ACT AND CS FAILS, ONE TRAIN + 1 GCT-CDF-CASE5 INITIATING EVENTS FOR CONSTRUCTION TRUSS THERM AL CONSTRUCTION TRUSS THERM AL CASE 5 GINIT-CT-THERM FLAG-CASE5-THERM AL 3 9.99E-01 CONTAINM ENT SAFEGUARDS FRAGILITY OF CONSTRUCTION TRUSS ACTUATION TRAINS AVAILABLE AT 298 DEGREES F GACT1000 FRAG-298F 4 1.00E-02 3 OF 4 CONT. FAN COOLERS FAIL TO FAILURE OF FEED AND BLEED PROVIDE COOLING COOLING (INCLUDING SI)

GFC1900 GFB1100 CONT.SPRAY FROM 1/ 2 TRAINS FAILS TO DELIVER FLOW GCS1100 Page 101 of 163

PBN-BFJR-17-019 Rev. 1 DEMONSTRABLY CONSERVATIVE CASE - RESULTS The demonstrably conservative thermal case only credits feed and bleed for decay heat removal. Some of the key functions not included in the model were AFW, which will likely be available. Also, since there is no loss of offsite power, main feedwater will likely be available for removal of decay heat.

Other changes made to the model:

Added failure of bleed and feed using two PORVs, OR gate GFB1170, under each of the CASE gates.

HEP-RCS-CSPH1-12 was reset to (change to new value) with an error factor of 5 per the latest HEP calculation.

Changed rupture frequency on IA and SA tanks from 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time.

The type code for IA/SA tank rupture was changed from demand to hour to match data.

FAILURE OF FEED AND BLEED COOLING (INCLUDING SI)

GFB1100 FAILURE OF FEED AND BLEED FAILURE OF FEED AND BLEED COOLING WITH SINGLE PORV AND COOLING WITH BOTH PORVS AND NO CVCS (INCLUDING SI) CVCS (INCLUDING SI)

GFB1160 GFB1170 PORVS FAILS TO PROVIDE RCS OPERATOR ACTION FOR NON-SBO EITHER PRIM ARY PORV FAILS TO OPERATOR ACTION FOR NON-SBO PRESSURE RELIEF INITIATORS OPEN INITIATORS GFB1110 GFB1102 GFB1122 GFB1102 LHS DIAGNOSIS FAILS - OPERATOR OR HHI FAILS FOR ALL INITIATORS EXCEPT LHS DIAGNOSIS FAILS - OPERATOR OR HHI FAILS FOR ALL INITIATORS EXCEPT INSTRUM ENTATION FAILURE M LOCA INSTRUM ENTATION FAILURE M LOCA GFB1126 GECC100 GFB1126 GECC100 OPERATOR ACTION FOR SBO EVENTS FAILURE OF FEED FROM CVCS OPERATOR ACTION FOR SBO EVENTS GFB1101 GFB1200 GFB1101 Top event BLEED&FEED - FEED AND BLEED COOLING (INCLUDING SI) was added. This top event represents the failure of bleed and feed cooling. It means that either 1 of 2 PORVs fail to open or 2 of 2 high head safety injection pumps fail to provide inventory makeup to the RCS. The fault tree below illustrates the logic.

Page 102 of 163

PBN-BFJR-17-019 Rev. 1 FAILURE OF FEED AND BLEED COOLING WITH SINGLE PORV AND CVCS (INCLUDING SI)

GFB1160 PORVS FAILS TO PROVIDE LHS DIAGNOSIS FAILS - OPERATOR ACTION FOR OPERATOR ACTION FOR HHI FAILS FOR ALL FAILURE OF FEED FROM RCS PRESSURE RELIEF OPERATOR OR SBO EVENTS NON-SBO INITIATORS INITIATORS EXCEPT CVCS INSTRUM ENTATION M LOCA FAILURE GFB1110 GFB1126 GFB1101 GFB1102 GECC100 GFB1200 PORVS FAILS TO PROVIDE COM M ON CAUSE PRESSURE RELIEF FAILURE OF BLOCK VALVES TO OPEN GFB1120 GFB1124 PORV RC-431C OR PORV PORV RC-430 OR PORV BLOCK VALVE RC-515 BLOCK VALVE RC-516 FAIL TO OPERATE FAIL TO OPERATE GFB1130 GFB1210 FAILURE OF PORV BLOCK PORV RC-431C FAILS TO FAILURE OF PORV BLOCK PORV RC-430 FAILS TO VALVE RC- 515 OPEN VALVE RC- 516 OPEN GFB1140 GFB1143 GFB1220 GFB1223 Page 103 of 163

PBN-BFJR-17-019 Rev. 1 Cutsets were generated using the UNIT1-SEISMIC.caf model, solving gates GCT-CDF-CASES at E-15 truncation.

Demonstrably Conservative Case (GCT-CDF-CASES)

Case 1 1.43E-09 Case 2 4.40E-14 Case 3 3.95E-11 Case 4 1.15E-13 Case 5 2.13E-11 Total 1.49E-09 Total from ACUBE = 1.40E-09

[1000 cutsets]

Uncertainty for Total:

DEMONSTRABLY CONSERVATIVE THERMAL ANALYSIS CDF Parameter Estimate Confidence Range Point Estimate 1.40E-09 Samples (Monte Carlo) 50000 Mean 1.49E-09 [1.4E-09 , 1.6E-09]

5% 1.23E-11 [1.2E-11 , 1.3E-11]

Median 2.18E-10 [2.1E-10 , 2.2E-10]

95% 4.94E-09 [4.7E-09 , 5.1E-09]

Standard Deviation 1.49E-08 Skewness 85.39294 Page 104 of 163

PBN-BFJR-17-019 Rev. 1 CUTSET REPORT TOP 25 THERMAL DEMONSTRABLY CONSERVATIVE CASE GCT-CDF-CASES = 1.49150E-09 ( Probability )

1. Cutset Prob. BE Prob Inputs Description 1 3.61E-10 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 2 3.51E-10 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 3 2.51E-10 4.01E-04 INIT-#FIRE-S2 FIRE INDUCED SMALL LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 4 1.88E-10 3.01E-04 INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 5 1.56E-11 2.50E-05 INIT-FBIC FEEDLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 6 1.45E-11 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06310 PRESSURE REGULATOR IA-6310 FAILS TO OPEN 7 1.45E-11 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06311 PRESSURE REGULATOR IA-6311 FAILS TO OPEN 8 1.41E-11 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06310 PRESSURE REGULATOR IA-6310 FAILS TO OPEN 9 1.41E-11 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06311 PRESSURE REGULATOR IA-6311 FAILS TO OPEN 10 1.18E-11 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-00430 PZR PORV RC-430 FAILS TO OPEN 11 1.18E-11 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-0431C PZR PORV RC-431C FAILS TO OPEN 12 1.15E-11 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6)

Page 105 of 163

PBN-BFJR-17-019 Rev. 1 CUTSET REPORT TOP 25 THERMAL DEMONSTRABLY CONSERVATIVE CASE 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-00430 PZR PORV RC-430 FAILS TO OPEN 13 1.15E-11 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6) 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-0431C PZR PORV RC-431C FAILS TO OPEN 14 1.01E-11 4.01E-04 INIT-#FIRE-S2 FIRE INDUCED SMALL LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06310 PRESSURE REGULATOR IA-6310 FAILS TO OPEN 15 1.01E-11 4.01E-04 INIT-#FIRE-S2 FIRE INDUCED SMALL LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06311 PRESSURE REGULATOR IA-6311 FAILS TO OPEN 16 8.22E-12 4.01E-04 INIT-#FIRE-S2 FIRE INDUCED SMALL LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-00430 PZR PORV RC-430 FAILS TO OPEN 17 8.22E-12 4.01E-04 INIT-#FIRE-S2 FIRE INDUCED SMALL LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-0431C PZR PORV RC-431C FAILS TO OPEN 18 7.58E-12 3.01E-04 INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06310 PRESSURE REGULATOR IA-6310 FAILS TO OPEN 19 7.58E-12 3.01E-04 INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 1.01E-03 IA--AOV-CC-06311 PRESSURE REGULATOR IA-6311 FAILS TO OPEN 20 7.38E-12 1.18E-05 INIT-#FIRE-S1 FIRE INDUCED MEDIUM LOCA 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 21 6.17E-12 3.01E-04 INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-00430 PZR PORV RC-430 FAILS TO OPEN 22 6.17E-12 3.01E-04 INIT-SBIC STEAMLINE BREAK INSIDE CONTAINMENT 2.50E-05 FRAG-270F FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F 9.99E-01 FLAG-CASE1-THERMAL CONSTRUCTION TRUSS THERMAL CASE 1 8.21E-04 RC--POR-CC-0431C PZR PORV RC-431C FAILS TO OPEN 23 4.99E-12 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 2.00E-04 FRAG-277F FRAGILITY OF CONSTRUCTION TRUSS AT 277 DEGREES F 9.99E-01 FLAG-CASE3-THERMAL CONSTRUCTION TRUSS THERMAL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE) 1.73E-03 CS--AOV-OO-03124 FEEDWATER ISOLATION VALVE CS-3124 FAILS TO CLOSE 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 24 4.99E-12 5.77E-04 INIT-S2 INITIATING EVENT SMALL LOCA (3/8 TO 2) 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK Page 106 of 163

PBN-BFJR-17-019 Rev. 1 CUTSET REPORT TOP 25 THERMAL DEMONSTRABLY CONSERVATIVE CASE 2.00E-04 FRAG-277F FRAGILITY OF CONSTRUCTION TRUSS AT 277 DEGREES F 9.99E-01 FLAG-CASE3-THERMAL CONSTRUCTION TRUSS THERMAL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE) 1.73E-03 CS--AOV-OO-03125 FEEDWATER ISOLATION VALVE CS-3125 FAILS TO CLOSE 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 25 4.86E-12 5.61E-04 INIT-S1 INITIATING EVENT MEDIUM LOCA (>2 TO 6) 2.50E-02 HEP-COG-CSPH1 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK 2.00E-04 FRAG-277F FRAGILITY OF CONSTRUCTION TRUSS AT 277 DEGREES F 9.99E-01 FLAG-CASE3-THERMAL CONSTRUCTION TRUSS THERMAL CASE 3 (FEEDWATER ISOLATION VALVE FAILS TO CLOSE) 1.73E-03 CS--AOV-OO-03124 FEEDWATER ISOLATION VALVE CS-3124 FAILS TO CLOSE 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE IMPORTANCES - sorted by FV [FV >0.005] DEMONSTRABLY CONSERVATIVE CASE Event Probability Fus Ves BirnBm Red W Ach W Description FRAG-270F 2.50E-05 0.95918 5.69E-05 24.4994 38179.279 FRAGILITY OF CONSTRUCTION TRUSS AT 270 DEGREES F FLAG-CASE1-THERMAL 9.99E-01 0.95915 1.43E-09 24.4816 1.001 CONSTRUCTION TRUSS THERMAL CASE 1 NO-FIRE-FLAG 1.00E+00 0.81114 1.21E-09 5.295 1 NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE HEP-COG-CSPH1 2.50E-02 0.81063 4.83E-08 5.2806 32.576 OPERATORS FAIL TO DIAGNOSE LOSS OF SECONDARY HEAT SINK INIT-S2 5.77E-04 0.30727 7.94E-07 1.4436 533.22 INITIATING EVENT SMALL LOCA (3/8 TO 2)

INIT-S1 5.61E-04 0.29874 7.94E-07 1.426 533.223 INITIATING EVENT MEDIUM LOCA (>2 TO 6)

INIT-#FIRE-S2 4.01E-04 0.2135 7.94E-07 1.2715 533.213 FIRE INDUCED SMALL LOCA INIT-SBIC 3.01E-04 0.16024 7.94E-07 1.1908 533.194 STEAMLINE BREAK INSIDE CONTAINMENT IA--AOV-CC-06310 1.01E-03 0.03263 4.83E-08 1.0337 33.34 PRESSURE REGULATOR IA-6310 FAILS TO OPEN IA--AOV-CC-06311 1.01E-03 0.03263 4.83E-08 1.0337 33.34 PRESSURE REGULATOR IA-6311 FAILS TO OPEN RC--POR-CC-00430 8.21E-04 0.02658 4.83E-08 1.0273 33.347 PZR PORV RC-430 FAILS TO OPEN RC--POR-CC-0431C 8.21E-04 0.02658 4.83E-08 1.0273 33.347 PZR PORV RC-431C FAILS TO OPEN CONSTRUCTION TRUSS THERMAL CASE 3 (FEEDWATER ISOLATION FLAG-CASE3-THERMAL 9.99E-01 0.02647 3.95E-11 1.0272 1 VALVE FAILS TO CLOSE)

FRAG-277F 2.00E-04 0.02647 1.97E-07 1.0272 133.317 FRAGILITY OF CONSTRUCTION TRUSS AT 277 DEGREES F FRAG-298F 1.00E-02 0.01435 2.14E-09 1.0146 2.42 FRAGILITY OF CONSTRUCTION TRUSS AT 298 DEGREES F FLAG-CASE5-THERMAL 9.99E-01 0.01427 2.13E-11 1.0145 1 CONSTRUCTION TRUSS THERMAL CASE 5 HEP-CSR-EOP13-24 1.00E+00 0.01422 2.12E-11 1.0144 1 OP FAILS TO ALIGN CONT. SPRAY FOR RECIRC HEP-VCC-ECA02-06 1.00E-01 0.01416 2.11E-10 1.0144 1.127 OPERATOR FAILS TO RESTART CONTAINMENT FAN COOLERS NO SAFETY INJECTION NOSI 1.00E+00 0.01416 2.11E-11 1.0144 1 **SWITCH**

INIT-FBIC 2.50E-05 0.01329 7.93E-07 1.0135 532.562 FEEDLINE BREAK INSIDE CONTAINMENT CS--AOV-OO-03124 1.73E-03 0.01323 1.14E-08 1.0134 8.635 FEEDWATER ISOLATION VALVE CS-3124 FAILS TO CLOSE CS--AOV-OO-03125 1.73E-03 0.01323 1.14E-08 1.0134 8.635 FEEDWATER ISOLATION VALVE CS-3125 FAILS TO CLOSE SI--T---RP-00013 2.88E-04 0.00933 4.83E-08 1.0094 33.379 RWST TANK T-13 EXCESSIVE LEAKAGE OR RUPTURE IA-T-RP-T242 2.88E-04 0.00931 4.82E-08 1.0094 33.333 PZR ACCUMULATOR RUPTURES - T-243 IA-T-RP-T243 2.88E-04 0.00931 4.82E-08 1.0094 33.333 PZR ACCUMULATOR RUPTURES - T-243 INIT-#FIRE-S1 1.18E-05 0.00626 7.91E-07 1.0063 531.463 FIRE INDUCED MEDIUM LOCA RC--POR-TM-00430 1.93E-04 0.00624 4.82E-08 1.0063 33.307 PORV RC-430 IN TEST/ MAINT RC--POR-TM-0431C 1.93E-04 0.00624 4.82E-08 1.0063 33.307 PORV RC-431C IN TEST/ MAINT 125-BS--LP---D01 2.40E-06 0.0032 1.99E-06 1.0032 1333.771 125 VDC BUS D-01 FAILS 125-BS--LP---D02 2.40E-06 0.0032 1.99E-06 1.0032 1333.771 125 VDC BUS D-02 FAILS 125-BS--LP---D11 2.40E-06 0.0032 1.99E-06 1.0032 1333.771 125 VDC DIST PANEL D-11 FAILS 125-BS--LP---D21 2.40E-06 0.00315 1.96E-06 1.0032 1314.107 125V DC DISTRIBUTION PANEL D21 FAILURE SI--MDP-FS-0015A 5.79E-03 0.00245 6.30E-10 1.0025 1.42 A TRAIN SI PUMP FAIL TO START SI--MDP-FS-0015B 5.79E-03 0.00227 5.85E-10 1.0023 1.39 B TRAIN SI PUMP FAIL TO START SI--MDP-TM-0015A 5.11E-03 0.00216 6.30E-10 1.0022 1.42 A SI PUMP TEST AND MAINTENANCE SI--MDP-TM-0015B 5.11E-03 0.002 5.84E-10 1.002 1.39 A SI PUMP TEST AND MAINTENANCE RC--POR-CM-PORV 5.58E-05 0.0018 4.82E-08 1.0018 33.3 PZR PORVS RC-431C AND RC-430 FAILS TO OPEN DUE TO CCF IA--CKV-CC-01301 5.00E-05 0.00162 4.82E-08 1.0016 33.3 CHECK VALVE IA-1301 FAILS TO OPEN IA--CKV-CC-01302 5.00E-05 0.00162 4.82E-08 1.0016 33.3 CHECK VALVE IA-1302 FAILS TO OPEN IA--MV--OC-01203 4.18E-05 0.00135 4.82E-08 1.0014 33.301 MANUAL VALVE IA-1203 SPURIOUS CLOSE IA--MV--OC-01204 4.18E-05 0.00135 4.82E-08 1.0014 33.301 MANUAL VALVE IA-1204 SPURIOUS CLOSE 125-BAT-DEP-FLAG 1.00E+00 0.00104 1.55E-12 1.001 1 125 VDC BATTERY DEPLETES AFTER 1 HOUR INIT-A 1.33E-06 0.0007 7.81E-07 1.0007 524.909 INITIATING EVENT LARGE LOCA (>6)

SI--MDP-CM-S15AB 2.00E-05 0.00065 4.81E-08 1.0006 33.279 P15A AND B FAIL TO START CCF 2/2 RC--MOV-CC-00515 9.30E-04 0.00061 9.77E-10 1.0006 1.655 PORV BLOCK VALVE RC-515 FAILS TO OPEN Page 107 of 163

PBN-BFJR-17-019 Rev. 1 IMPORTANCES - sorted by FV [FV >0.005] DEMONSTRABLY CONSERVATIVE CASE XHOS-RC-515-SHUT 2.03E-02 0.00061 4.51E-11 1.0006 1.03 SET TO 1.0 WHEN RC-515 POSITIONED SHUT ELSE 0.0 XHOS-RC-516-SHUT 2.01E-02 0.00061 4.51E-11 1.0006 1.03 SET TO 1.0 WHEN RC-516 POSITIONED SHUT ELSE 0.0 RC--MOV-CC-00516 9.30E-04 0.0006 9.68E-10 1.0006 1.648 PORV BLOCK VALVE RC-516 FAILS TO OPEN SI--CKV-OO-0891B 1.00E-03 0.00038 5.61E-10 1.0004 1.376 B SI PUMP MINI FLOWCHECK VALVE STUCK OPEN PRE-INITIATOR SI--MDP-CM-R15AB 1.16E-05 0.00037 4.81E-08 1.0004 33.279 P15A AND B FAIL TO RUN IN THE FIRST HOUR CCF 2/2 XHOS-2B49-D02 1.00E+00 0.00036 5.44E-13 1.0004 1 BUS 2B-49 SUPPLYING D-02 SI--CKV-OO-0891A 1.00E-03 0.00035 5.24E-10 1.0004 1.351 A SI PUMP MINI FLOWCHECK VALVE STUCK OPEN PRE-INITIATOR XHOS-1B39-D01 1.00E+00 0.00035 5.28E-13 1.0004 1 BUS 1B-39 SUPPLYING D-01 BATTERY CHARGER D-108 UNAVAILABLE DUE TO TEST AND 125-CHG-TM--D108 2.68E-02 0.00032 1.79E-11 1.0003 1.012 MAINTENANCE XHOS-1B49-D04 1.00E+00 0.00032 4.79E-13 1.0003 1 480 VAC MCC 1B-49 SUPPLYING D-04 125-BKR-CO-D1129 7.61E-06 0.00029 5.59E-08 1.0003 38.501 BKR D11-29 NORM D-11 TO D-17 FAILS OPEN 125-BKR-CO-D1329 7.61E-06 0.00029 5.59E-08 1.0003 38.501 BKR D13-29 D-13 TO D-21 FAILS OPEN 125-BKR-CO-D1712 7.61E-06 0.00029 5.59E-08 1.0003 38.501 BKR D17-12 SAFE RACKS 1C156&1C157 FAILS OPEN 125-BKR-CO-D2104 7.61E-06 0.00029 5.59E-08 1.0003 38.501 BKR D21-04 PROTECT RACK 1C166+167 FAILS OPEN 125-CHG-LP--0D07 1.65E-04 0.00028 2.49E-09 1.0003 2.668 BATTERY CHARGER D-07 FAILS 125-CHG-LP--0D08 1.65E-04 0.00028 2.49E-09 1.0003 2.668 BATTERY CHARGER D-08 FAILS 125-BKR-CO--0108 7.61E-06 0.00024 4.79E-08 1.0002 33.14 125 VDC BRK D72-01-08 BETWEEN D-01 AND D-11 TRANSFERS OPEN 125-BKR-CO--0203 7.61E-06 0.00024 4.79E-08 1.0002 33.14 125 VDC BRK D72-02-03 BETWEEN D-02 AND D-27 TRANSFERS OPEN 125-BKR-CO--1113 7.61E-06 0.00024 4.79E-08 1.0002 33.14 125 VDC BKR D72-11-13 BETWEEN D-11 AND D-16 TRANSFERS OPEN 125-BKR-CO--2713 7.61E-06 0.00024 4.79E-08 1.0002 33.14 125 VDC BRK D72-27-13 BETWEEN D-27 AND D-21 TRANSFERS OPEN 125-BKR-CO-D1608 7.61E-06 0.00024 4.79E-08 1.0002 33.14 BKR D16-08 NORM D-16 TO 1C04 SAFEGUARDS BUS A FAILS OPEN 125-BKR-CO-D2108 7.61E-06 0.00024 4.79E-08 1.0002 33.14 BKR D21-08 NORM D-21 TO 1C04 SAFEGUARDS BUS B FAILS OPEN BATTERY CHARGER D-09 UNAVAILABLE DUE TO TEST AND 125-CHG-TM--1D09 1.82E-02 0.00023 1.85E-11 1.0002 1.012 MAINTENANCE SW--VLV-TM---104 4.09E-02 0.00021 7.79E-12 1.0002 1.005 SW DISCHARGE VALVE SW-104 IN TEST AND MAINTENANCE SW--VLV-TM---146 4.09E-02 0.00021 7.79E-12 1.0002 1.005 SW DISCHARGE VALVE SW-146 IN TEST AND MAINTENANCE XHOS-VLV104-OPEN 1.00E+00 0.00021 3.19E-13 1.0002 1 HOUSE EVENT SETTING SW-104 OPEN XHOS-VLV146-OPEN 1.00E+00 0.00021 3.19E-13 1.0002 1 HOUSE EVENT SETTING SW-146 OPEN HEP-125--D301-D1 3.00E-02 0.00019 9.29E-12 1.0002 1.006 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-01 (UNIT 1)

HEP-125--D301-D2 3.00E-02 0.00019 9.68E-12 1.0002 1.006 OPERATOR FAILS TO ALIGN BUS D-301 TO BUS D-02 (UNIT 1)

BATTERY CHARGER D-109 UNAVAILABLE DUE TO TEST AND 125-CHG-TM--D109 1.82E-02 0.00018 1.48E-11 1.0002 1.01 MAINTENANCE SI--MDP-CM-T15AB 4.19E-06 0.00013 4.69E-08 1.0001 32.427 P15A AND B FAIL TO RUN AFTER THE FIRST HOUR, CCF 2/2 125-BS--LP---D13 2.40E-06 0.00012 7.20E-08 1.0001 49.251 125 VDC DIST PANEL D-13 FAILS 125-FU--SO0108F1 3.11E-06 0.00011 5.23E-08 1.0001 36.037 125 VDC FUSE (+) D72-01-08 BETWEEN D-01 AND D-11 125-FU--SO0108F2 3.11E-06 0.00011 5.23E-08 1.0001 36.037 125 VDC FUSE (-) D72-01-08 BETWEEN D-01 AND D-11 125-FU--SO0208F1 3.11E-06 0.00011 5.23E-08 1.0001 36.037 125 VDC FUSE (+) D72-02-08 BETWEEN D-02 AND D-13 125-FU--SO0208F2 3.11E-06 0.00011 5.23E-08 1.0001 36.037 125 VDC FUSE (-) D72-02-08 BETWEEN D-02 AND D-13 HEP-125--D302-D4 9.60E-03 0.00009 1.47E-11 1.0001 1.01 OPERATOR FAILS TO ALIGN BUS D-302 TO BUS D-04 SI--VLV-OC-0897A 2.99E-06 0.00009 4.66E-08 1.0001 32.229 SI PUMP MINI FLOW COMMON AOV A SI--VLV-OC-0897B 2.99E-06 0.00009 4.66E-08 1.0001 32.229 SI PUMP MINI FLOW COMMON AOV B 125-BS--LP---D17 2.40E-06 0.00008 5.08E-08 1.0001 35.055 125V DC DISTRIBUTION PANEL D17 FAILURE CONSTRUCTION TRUSS THERMAL CASE 4 (ONE TRAIN OF ACT AND CFC FLAG-CASE4-THERMAL 9.99E-01 0.00008 1.16E-13 1.0001 1 FAIL, BOTH TRAINS CS 125-BS--LP---D16 2.40E-06 0.00007 4.66E-08 1.0001 32.229 125V DC DISTRIBUTION PANEL D16 FAILURE 125-BS--LP---D27 2.40E-06 0.00007 4.66E-08 1.0001 32.229 125 VDC DIST PANEL D-27 FAILS SI--MDP-FS-0014B 5.77E-03 0.00007 1.76E-11 1.0001 1.012 CONT. SPRAY PUMP P-14B FAILS TO START SI--MDP-FT-0015A 1.33E-04 0.00005 5.47E-10 1 1.367 A TRAIN SI PUMP FAILS TO RUN 2-24 HOURS SI--MDP-FT-0015B 1.33E-04 0.00005 5.47E-10 1 1.367 B TRAIN SI PUMP FAILS TO RUN 2-24 HOURS CONSTRUCTION TRUSS THERMAL CASE 2 (ONE TRAIN OF ACT, CFC AND FLAG-CASE2-THERMAL 9.99E-01 0.00003 4.42E-14 1 1 CS FAILS)

IA--CKV-OO-01206 1.00E-03 0.00003 4.60E-11 1 1.031 IA CHECK VALVE FAILS TO CLOSE IA--CKV-OO-01209 1.00E-03 0.00003 4.59E-11 1 1.031 CHECK VALVE IA-1209 FAILS TO CLOSE IA--CKV-OO-01605 1.00E-03 0.00003 4.60E-11 1 1.031 IA CHECK VALVE FAILS TO CLOSE IA--CKV-OO-01606 1.00E-03 0.00003 4.60E-11 1 1.031 CHECK VALVE IA-1606 FAILS TO OPEN SI--MDP-FS-0014A 5.77E-03 0.00003 8.82E-12 1 1.006 CONT. SPRAY PUMP P-14A FAILS TO START 125-BKR-OO-D0403 2.55E-03 0.00002 1.34E-11 1 1.009 125 VDC BKR D72-04-03 BETWEEN D-04 AND D-302 FAILS TO CLOSE 125-BKR-OO-D3023 2.55E-03 0.00002 1.34E-11 1 1.009 125 VDC BKR D72-3023 BETWEEN D-04 AND D-302 FAILS TO CLOSE 125-CHG-CM-D0709 6.43E-07 0.00002 4.60E-08 1 31.81 COMMON MODE FAILURE BATTERY CHARGERS D07 AND D09 125-CHG-CM-D0789 3.26E-07 0.00002 9.19E-08 1 62.62 COMMON MODE FAILURE BATTERY CHARGERS D07/ D08/ D09 125-CHG-CM-D0809 6.43E-07 0.00002 4.60E-08 1 31.81 COMMON MODE FAILURE BATTERY CHARGERS D08 AND D09 125-FU--SO-156F3 5.18E-07 0.00002 4.60E-08 1 31.847 FUSE F3 IN CABINET 1C156 FAILS 125-FU--SO-156F4 5.18E-07 0.00002 4.60E-08 1 31.847 FUSE F4 IN CABINET 1C156 FAILS Page 108 of 163

PBN-BFJR-17-019 Rev. 1 IMPORTANCES - sorted by FV [FV >0.005] DEMONSTRABLY CONSERVATIVE CASE 125-FU--SO-166F3 5.18E-07 0.00002 4.60E-08 1 31.847 FUSE F3 IN CABINET 1C166 FAILS 125-FU--SO-166F4 5.18E-07 0.00002 4.60E-08 1 31.847 FUSE F4 IN CABINET 1C166 FAILS ESF-OPR-RE-SITSW 1.00E-03 0.00002 3.26E-11 1 1.022 FAILURE TO RESTORE TEST SWITCHES AFTER T/M ESF-REL-SA-1X4B3 5.00E-07 0.00002 4.60E-08 1 31.847 UV RELAY 271X4/B03 SPURIOUSLY OPERATES ESF-REL-SA-1X4B4 5.00E-07 0.00002 4.60E-08 1 31.847 UV RELAY 271X4/B04 SPURIOUSLY OPERATES ESF-REL-SA-2X4B3 5.00E-07 0.00002 4.60E-08 1 31.847 UV RELAY 272X4/B03 SPURIOUSLY OPERATES ESF-REL-SA-2X4B4 5.00E-07 0.00002 4.60E-08 1 31.847 UV RELAY 272X4/B04 SPURIOUSLY OPERATES FLAG---CS-INJ 1.00E+00 0.00002 3.63E-14 1 1 CONT. SPRAY FOR INJECTION SI--CKV-CC-0889A 5.00E-05 0.00002 5.01E-10 1 1.336 A SI PUMP DISCHARGE CHK VLV SI--CKV-CC-0889B 5.00E-05 0.00002 5.01E-10 1 1.336 B SI PUMP DISCHARGE CHK VLV SI--CKV-CC-0891A 5.00E-05 0.00002 5.01E-10 1 1.336 A SI PUMP MINI FLOW CHECK VALVE SI--CKV-CC-0891B 5.00E-05 0.00002 5.01E-10 1 1.336 B SI PUMP MINI FLOW CHECK VALVE 125-BKR-CO--0101 7.61E-06 0.00001 2.22E-09 1 2.485 125 VDC BKR D72-01-01 BETWEEN D-05 AND D-01 TRANSFERS OPEN 125-BKR-CO--0107 7.61E-06 0.00001 2.22E-09 1 2.485 125 VDC BKR D72-01-07 BETWEEN D-07 AND D-01 TRANSFERS OPEN 125-BKR-CO--0201 7.61E-06 0.00001 2.22E-09 1 2.485 125 VDC BKR D72-02-01 BETWEEN D-06 AND D-02 TRANSFERS OPEN 125-BKR-CO--0207 7.61E-06 0.00001 2.22E-09 1 2.485 125 VDC BKR D72-02-07 BETWEEN D-08 AND D-02 TRANSFERS OPEN 125-BKR-OO-D0104 2.55E-03 0.00001 7.60E-12 1 1.005 125 VDC BKR D72-01-04 BETWEEN D-01 AND D-301 FAILS TO CLOSE 125-BKR-OO-D0204 2.55E-03 0.00001 7.60E-12 1 1.005 125 VDC BRK D72-02-04 BETWEEN D-301 AND D-02 FAILS TO CLOSE 125-BKR-OO-D3011 2.55E-03 0.00001 7.60E-12 1 1.005 125 VDC BKR D72-3011 BETWEEN D-01 AND D-301 FAILS TO CLOSE 125-BKR-OO-D3013 2.55E-03 0.00001 7.60E-12 1 1.005 125 VDC BKR D72-3013 BETWEEN D-02 AND D-301 FAILS TO CLOSE 416-BS--TM--2A06 1.21E-03 0.00001 1.21E-11 1 1.008 4160 VAC BUS 2A-06 UNAVAILABLE DUE TO TEST OR MAINTENANCE 480-BKR-CO-52391 7.61E-06 0.00001 2.22E-09 1 2.485 BKR 1B52-391 1B39 TO D07 FAILS OPEN 480-BKR-CO-52491 7.61E-06 0.00001 2.22E-09 1 2.485 480 VAC BKR 2B52-491 FROM 2B-49 TO D-02 TRANSFERS OPEN 480-BKR-CO15213C 7.61E-06 0.00001 2.22E-09 1 2.485 480 V BKR 1B52-13C BTWN BUS 1B-03 AND MCC 1B-39 480-BKR-CO25231A 7.61E-06 0.00001 2.22E-09 1 2.485 480 V BKR 2B52-31A BTWN BUS 2B-04 AND MCC 2B-49 ESF-REL-FT-SIM-A 3.00E-04 0.00001 5.45E-11 1 1.037 TRAIN A MANUAL SI MASTER RELAY SIM-A FAILS ESF-REL-FT-SIM-B 3.00E-04 0.00001 5.45E-11 1 1.037 TRAIN B MANUAL SI MASTER RELAY FAILS HEP-480--2B03-04 1.10E-01 0.00001 1.33E-13 1 1 OPERATOR FAILS TO TRANSFER POWER FROM 2B-03 TO 2B-04 HEP-480-2-ECA00F 5.30E-02 0.00001 2.77E-13 1 1 OPERATOR FAILS TO BACKFEED 480 VAC SAFEGUARDS BUSES UNIT 2 SI--MDP-FR-0014B 8.16E-04 0.00001 1.09E-11 1 1.007 CONT. SPRAY PUMP P-14B FAILS TO RUN (24 HR)

SI--MDP-FR-0015A 3.40E-05 0.00001 5.01E-10 1 1.336 A TRAIN SI PUMP FAIL TO RUN 1ST HOUR SI--MDP-FR-0015B 3.40E-05 0.00001 5.01E-10 1 1.336 B TRAIN SI PUMP FAIL TO RUN 1ST HOUR SI--MDP-TM-0014B 7.61E-04 0.00001 1.09E-11 1 1.007 CONT. SPRAY PUMP P-14B T/M UNAVAILABILITY SI--MOV-RE-0870B 1.00E-03 0.00001 1.09E-11 1 1.007 FAIL TO RESTORE MOV SI-870B AFTER T/M SI--MV--RE-0873B 1.00E-03 0.00001 1.09E-11 1 1.007 FAIL TO RESTORE MAN. VALVE SI-873B AFTER T/M 480-BKR-CO15214B 7.61E-06 0 9.33E-10 1 1.625 480 VAC BKR 1B52-14B FROM 1B-03TO MCC 1B-32 480-BKR-CO15223C 7.61E-06 0 9.24E-10 1 1.619 480 V BKR 1B52-23C BTWN BUS 1B-04 AND MCC 1B-42 480-BS--LP--1B03 2.40E-06 0 8.53E-10 1 1.572 480 VAC BUS 1B-03 LOSS OF POWER 480-BS--LP--2B04 2.40E-06 0 8.53E-10 1 1.572 480 VAC BUS 2B-04 LOSS OF POWER 480-BS--TM--2B04 2.41E-06 0 8.53E-10 1 1.572 480 VAC BUS 2B-04 UNAVAILABLE DUE TO TEST OR MAINTENANCE 480-MCC-LP--1B39 2.40E-06 0 8.53E-10 1 1.572 LOSS OF POWER FROM 480 VAC MCC 1B-39 480-MCC-LP--2B49 2.40E-06 0 8.53E-10 1 1.572 LOSS OF POWER FROM 480 VAC MCC 2B-49 ESF-REL-FT-SI11X 3.00E-04 0 8.54E-12 1 1.006 SI SLAVE RELAY SI-11X FAILS TO ENERGIZE ESF-REL-FT-SI14X 3.00E-04 0 8.54E-12 1 1.006 SI SLAVE RELAY SI-14X FAILS TO ENERGIZE ESF-REL-FT-SI21X 3.00E-04 0 8.54E-12 1 1.006 SI SLAVE RELAY SI-21X FAILS TO ENERGIZE ESF-REL-FT-SI24X 3.00E-04 0 8.54E-12 1 1.006 SI SLAVE RELAY SI-24X FAILS TO ENERGIZE ESF-REL-FT-SIA-A 3.00E-04 0 8.54E-12 1 1.006 TRAIN A AUTO SI MASTER RELAY SIA-A FAILS ESF-REL-FT-SIA-B 3.00E-04 0 8.54E-12 1 1.006 TRAIN B AUTO SI MASTER RELAY SIA-B FAILS HEP-ESF-EOP-0-04 1.30E-04 0 3.85E-11 1 1.026 OPERATOR FAILS TO MANUALLY INITIATE SI HEP-ESF-LO-PRES 1.00E-04 0 5.00E-11 1 1.033 MIS-CALIBRATE LOW PRESSURIZER SIGNAL HEP-SI--EOP-0-04 1.30E-03 0 3.84E-12 1 1.003 FAILURE TO MANUALLY ACTUATE SI AFTER AUTO-ACTUATION FAILS SI--CKV-CM-867AB 1.04E-07 0 3.84E-08 1 26.77 SI867A AND SI867B FAIL TO OPEN DUE TO CM FAILURE SI--CKV-CM-889AB 1.04E-07 0 3.84E-08 1 26.77 COMMON MODE FAILUREOF DISCHRG CHK VLVS889AB SI--CKV-CM-891AB 1.04E-07 0 3.84E-08 1 26.77 COMMON MODE FAILUREOF RECIRC CHK VLVS 891AB SI--CKV-CM-8ABEF 7.98E-08 0 2.84E-08 1 20.056 COMMON MODE FAILUREOF 845ABEF SI--MDP-FR-0014A 8.16E-04 0 5.46E-12 1 1.004 CONT. SPRAY PUMP P-14A FAILS TO RUN (24 HR)

SI--MDP-TM-0014A 7.61E-04 0 5.46E-12 1 1.004 CONT. SPRAY PUMP P-14A T/M UNAVAILABILITY SI--MOV-RE-0870A 1.00E-03 0 5.46E-12 1 1.004 FAILURE TO RESTORE MOV SI-870A AFTER T/M SI--VLV-RE-0873A 1.00E-03 0 5.46E-12 1 1.004 FAIL TO RESTORE MAN. VALVE SI-873A AFTER T/M XHOS-BKR14B-1B32 1.00E+00 0 7.10E-15 1 1 BREAKER 1B52-14B SUPPLYING BUS 1B32 XHOS-BKR23C-1B42 1.00E+00 0 7.03E-15 1 1 BREAKER 1B52-23C SUPPLYING BUS 1B-42 Page 109 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT F Demonstrably Conservative Seismic PRA Model Development Page 110 of 163

PBN-BFJR-17-019 Rev. 1 The Seismic CT Model is based on the NFPA 805 PRA models for Unit 1 and Unit 2. The NFPA 805 model includes the internal events model and the NFPA 805 compliant fire model. The model includes modification commitments made in the NFPA 805 LAR.

F.1 SEISMIC CT MODEL The main steam line break event tree from the internal events section of the NFPA 805 model was used as the basis for the demonstrably conservative seismic CT PRA model. Top events were adjusted based on a review of top events from the IPEEE seismic model. The table in section F.7 lists the IPEEE top events that were included and excluded.

The event tree was converted to a fault tree with a top gate G-CT-SEISMIC-CDF. The initiating event in the main steam line break event tree was replaced by two fault trees:

1. One fault tree is the probability of an earthquake of a given magnitude. The model was broken up into 10 different bins as described in section 2.2.1, Seismic Hazard.

2. The second fault tree is the CT seismic fragility fault tree using the data from tables in section 2.2.3.

Offsite power is assumed to be unrecoverable. The loss of offsite power recovery fault tree was not used.

Sequence markers were added to the logic model to facilitate assessing sequence importance.

A new gate G-CT-PORV was created to credit only the PORVs and not SI because SI has a separate system fault tree in the seismic model.

2 PORVs are available and 2 PORVs are required for success of feed and bleed.

F.2 QUANTIFICATION CORE DAMAGE FREQUENCY QUANTIFICATION. The G-CT-SEISMIC-CDF gate was solved by opening the model, right clicking on gate G-CT-SEISMIC-CDF, selecting Evaluate Gate G-CT-SEISMIC-CDF, Selecting method FTREX, modifying the run name if desired, selecting flag file SEISMIC-HEP-FINAL.flg, and ensuring the truncation probability is set to 1.000E-12. This provided the cutsets for the construction truss unmodified case core damage frequency which were used as input to ACUBE.

ACUBE [Ref 22]. The use of ACUBE is required because of the large number of basic events with high failure probabilities. ACUBE improves the accuracy of the minimal cut set calculation by employing a Binary Decision Diagram method. The top 1,000 cutsets were processed using ACUBE.

MODIFIED CONSTRUCTION TRUSS. The cutsets for the modified construction truss were obtained by running a recovery rule file on the cutsets from the unmodified case which replaced the unmodified construction truss fragilities with the modified construction truss fragilities.

Page 111 of 163

PBN-BFJR-17-019 Rev. 1 LARGE EARLY RELEASE FREQUENCY An AND gate G-CT-SEISMIC-LERF was added to the models. Inputs to the G-CT-SEISMIC-LERF are G-CT-SEISMIC-CDF and new OR gate G457, CONSTRUCTION TRUSS SEISMIC CONTAINMENT FAILURES. G457 has 10 AND gates as input. Each of the 10 AND gates has as one input the initiating event frequency for each of the 10 seismic ranges. The other input is an OR gate which has as inputs the seismic fragility of the containment isolation system and seismic fragility of the containment for the seismic range of interest.

The G-CT-SEISMIC-LERF gate was solved by opening the model, right clicking on gate G-CT-SEISMIC-LERF, selecting Evaluate Gate G-CT-SEISMIC-LERF, Selecting method FTREX, modifying the run name if desired, selecting flag file SEISMIC-HEP-FINAL.flg and ensuring the truncation probability is set to 1.000E-12. This provided the cutsets for the construction truss unmodified case large early release frequency which were used as input to ACUBE [Ref 22]. The use of ACUBE is required because of the large number of basic events with high failure probabilities.

ACUBE improves the accuracy of the minimal cut set calculation by employing a Binary Decision Diagram method. The top 1,000 cutsets were processed using ACUBE.

The cutsets for the modified construction truss were obtained by running a recovery rule file on the cutsets from the unmodified cases which replaced the unmodified construction truss fragilities with the modified construction truss fragilities.

CONVERGENCE Convergence was confirmed by running the Unit 1 model at different truncations until the change in CDF or LERF was less than 5% for a reduction of truncation of 10. This was determined to be 1E-12.

LERF is calculated is based on section 2.1.3, Inputs and Assumptions.

F.3 FRAGILITIES Component fragilities were added based on the insights from the PB Seismic IPEEE. Using the IPEEE fragilities is conservative since many of the SSCs have had structural or configuration improvements since the IPEEE was developed. The fragilities used are as follows:

Page 112 of 163

PBN-BFJR-17-019 Rev. 1 IPEEE RASP [Ref 25] Modified Fragility PRA Basic Event SSC since Details Am c Am r/u Basis IPEEE 480VAC SAFEGUARDS LOAD Switchgear and FRAG-B03B04- motor control centers Significant anchorage added to the base.

CENTER 0.45 0.23 IPEEE YES

%G01%G010 1B-03, 1B-04, 2B-03, 2B-04 3.1 0.30/0.35 X13, X14 TRANSFORMERS Transformers FRAG-X13-X14- Safeguards 4160 VAC transformers Friction clips replaced with rugged seismic anchorage. IPEEE 0.80 0.40 IPEEE YES

%G01%G010 for Safeguards 480 VAC Switchgear. 1.9 0.30/0.35 fragility used.

1X-13, 1X-14, 2X-13, 2X-14 Electrical equipment -

Significant improvement in anchorage. Fragility Function during seismic SI--CAB-SF-C1567- Reactor protection relay racks YES recalculated. Used same basic events as SI relay racks since they 0.45 0.23 event IPEEE

%G01%G010 C150-C154, C160-C164 are the same type of equipment on the same floor in the same 1.0 0.30 location. They are considered coupled.

Electrical equipment -

Function during seismic IPEEE assumed unanchored. Modification performed to add SI--CAB-SF-C1567- Safeguards relay racks 0.45 0.23 event IPEEE YES significant anchorage. Cabinets are correlated. They were not

%G01%G010 C155, C156, C165, C166 correlated in the IPEEE.

1.0 0.30 Large flat-bottom FRAG-T24A-B- Condensate Storage Tanks storage tanks 0.67 0.40 IPEEE YES Significant anchorage added.

%G01%G010 T-23A, T-23B 1.1 0.30/0.35 4160VAC SAFEGUARDS Switchgear and FRAG-4160V- motor control centers SWITCHGEAR 1.03 0.40 IPEEE NO No change in anchorage.

%G01%G010 1A-05, 1A-06, 2A-05, 2A-06 3.1 0.30/0.35 Batteries and Battery No change in fragility credited, however current PRA model credits Racks batteries D-105, D-106 and D-305 which are NOT located by the block walls affecting D-05 and D-06 (Am=0.84 due to block walls).

D-03 and D-04 which were added after IPEEE and are NOT located FRAG-125V-% 125V DC SYSTEM FRAGILITY 0.84 0.40 IPEEE YES by the block walls affecting D-01 and D-02. Three safeguards G01%G010 D-01, D-02, D-05 and D-06 3.8 0.30/0.35 batteries, three safeguards battery chargers and two additional DC distribution panels have been added to the plant after IPEEE which are at a different location than the original DC equipment examined in the IPEEE, i.e. not affected by block walls.

COMPONENT COOLING WATER Heat Exchangers and FRAG-12A12D- HEAT EXCHANGERS Small Tanks 0.76 0.40 IPEEE NO No change to anchorage.

%G01%G010 HX-12A, HX-12B, HX-12C, HX-1.9 0.30/0.35 12D COMPONENT COOLING WATER Motor Driven Pumps FRAG-11A11B-PUMPS 2.27 0.40 IPEEE NO No change to anchorage.

%G01%G010 2.0 0.30/0.35 1P-11A, 1P-11B, 2P-11A, 2P-11B Page 113 of 163

PBN-BFJR-17-019 Rev. 1 IPEEE RASP [Ref 25] Modified Fragility PRA Basic Event SSC since Details Am c Am r/u Basis IPEEE Heat Exchangers and N/A. Not modeled in Small Tanks CCW Surge Tank T12 1.85 0.40 N/A N/A Not modeled in the PRA.

the PRA 1.9 0.30/0.35 System has been revised to add additional valves which were FRAG-CIS-CONTAINMENT ISOLATION (CIS) NEW YES credited in the revised fragility of containment isolation. Refer to

%G01%G010 section 2.1.4.1 for development of revised fragility.

Battery Chargers Used limiting fragility from IPEEE which was failure of the DC FRAG-125V-% system due to block walls. Additional safeguards battery chargers Battery Chargers D-07 and D-08 0.85 0.40 IPEEE NO G01%G010 1.6 0.30/0.35 have been installed since IPEEE at a different location which are credited.

Heat Exchangers and FRAG-HX Small Tanks HX-98 FLOODS RHR PUMPS 0.59 0.40 IPEEE NO No change to anchorage.

%G01%G010 1.9 0.30/0.35 FRAG-10A10B- RHR PUMPS Motor Driven Pumps 3.19 0.40 IPEEE NO No change to anchorage.

%G01%G010 1P-10A, 1P-10B, 2P-10A, 2P-10B 2.0 0.30/0.35 SERVICE WATER PUMPS Motor Driven Pumps FRAG-P32A-F-P-32A, P-32B, P-32C, P-32D, P- 1.40 0.40 IPEEE YES Anchorage revised when pumps were replaced after IPEEE.

%G01%G010 2.0 0.30/0.35 32E, P-32F SI--HX--SF-HX Motor Driven Pumps HX-99 FLOODS SI PUMPS 1.18 0.40 IPEEE NO No change to anchorage.

%G01%G010 2.0 0.30/0.35 SI--MDP-SF-P15AB- 1P-15A, 1P-15B, 2P-15A, 2P-15B Motor Driven Pumps IPEEE NO No change to anchorage.

%G01%G010 SI pumps 2.0 0.30/0.35 SESIMICALLY CORRELATED Large flat-bottom SI--T---SF-12T13- storage tanks FAILURE OF T13 (RWST) 0.67 0.40 NEW YES Significant improvement in anchorage. Fragility recalculated.

%G01%G010 1T-12, 2T-12 RWSTs 1.1 0.30/0.35 Instrument Racks 1Y-01, 1Y-02, Panelboards and instrumentation panel Instrument racks in this list were modeled in the PRA. Am is FRAG-Y-%G01%G010 1Y-03, 1Y-04, 2Y-01, 2Y-02, 2Y- 0.70 0.40 IPEEE NO dominated by block wall collapse.

03, 2Y-04, 2Y-05, 2Y-06 3.8 0.30/0.35 Not modeled. Loss of offsite power fails power to the control rod NO RPS - Not modeled IPEEE drive MG sets which means rods will insert regardless of a reactor protection system signal to trip the plant.

FRAG-%G01(%G010)- Section Fragility of the construction truss with no modifications on Unit 2 CT FRAGILITY UNMODIFIED 0.42 0.40 N/A UNMODIFIED 2.3.2 and minor modifications on Unit 1.

FRAG-%G01(%G010)- Section Fragility of the construction truss if all construction truss CT FRAGILITY MODIFIED 0.53 0.40 N/A MODIFIED 2.2.2 modifications were completed.

FRAG-CT-LERF- CT CONTAINMENT FRAGILITY Containment buildings Section N/A Assumption based on probability that a penetration inside Page 114 of 163

PBN-BFJR-17-019 Rev. 1 IPEEE RASP [Ref 25] Modified Fragility PRA Basic Event SSC since Details Am c Am r/u Basis IPEEE

%G01%G010 1.1 0.30/0.35 2.1.3 containment will be damaged. Inputs used as the basis for this assumption are in Section 2.1.3 of this analysis.

Seismically induced SMALL NUREG/CR- From NUREG/CR-4840, Figure 3 same source used by IPEEE NUREG/CR-4840 IPEEE NO LOCA 4840 and RASP manual - see figure next page Page 115 of 163

PBN-BFJR-17-019 Rev. 1 Offsite Power Fragility Offsite power is included in this evaluation. Failure of ceramic insulators is typically the most fragile component of offsite distribution systems. The generic seismic fragility from the RASP [Ref 25]

manual, Table 4B-1, is Am = 0.3, beta-r = 0.30, beta-u = 0.45, and HCLPF = 0.10.

The tables below show that there is a reasonably high probability that offsite power will be available during the lower PGAs.

Am c OFFSITE POWER Bounding No Mod CDF [section 2.2.3]

OFFSITE Geo Cond Prob 0.30 0.54 bin Seismic Initiator Seismic Initiator CDF  % Total POWER Midpoint of Fail Source: RASP [Ref 25]

%G01 0.05g to <0.12g 0.0775 6.16E-03 0.05g to <0.12g 3.63E-09 manual Table 4B-1 0.1%

%G02 0.12g to <0.23g 0.1661 1.37E-01 0.12g to <0.23g 4.91E-07 7.8%

%G03 0.23g to <0.34g 0.2796 4.48E-01 0.23g to <0.34g 1.56E-06 24.8%

%G04 0.34g to <0.45g 0.3912 6.88E-01 0.34g to <0.45g 1.44E-06 22.9%

%G05 0.45g to <0.56g 0.502 8.29E-01 0.45g to <0.56g 1.04E-06 16.5%

%G06 0.56g to <0.67g 0.6125 9.07E-01 0.56g to <0.67g 6.39E-07 10.1%

%G07 0.67g to <0.78g 0.7229 9.48E-01 0.67g to <0.78g 3.96E-07 6.3%

%G08 0.78g to <0.89g 0.8332 9.71E-01 0.78g to <0.89g 2.45E-07 3.9%

%G09 0.89g to <1g 0.9434 9.83E-01 0.89g to <1g 1.51E-07 2.4%

%G10 >1g 1.1 9.92E-01 >1g 3.33E-07 5.3%

Total CDF 6.30E-06 Page 116 of 163

PBN-BFJR-17-019 Rev. 1 F.4 EVENT TREE Page 117 of 163

PBN-BFJR-17-019 Rev. 1 Page 118 of 163

PBN-BFJR-17-019 Rev. 1 F.5 TOP EVENTS SEISMIC EVENT INITIATING EVENT Fault tree GHAZARD-FREQ which provides the 10 groups of PGA ranges from the Point Beach Hazard Curve. Created by entering Hazard Curve into FRANX as described in section 2.2.1 and Attachment D.

CONSTRUCTION TRUSS FRAGILITY CT fragility is developed as described in Section 2.2.2. Fragilities were derived for the 10 groups of earthquakes. The fault tree G-CT-FRAG is an OR gate with 10 AND gates as inputs. Each of the 10 AND gates has a hazard group ANDd with the fragility for that hazard group.

REACTOR TRIP The Point Beach IPEEE modeled reactor protection cabinet failures. The failure of the reactor protection cabinets is conservatively assumed to directly to core damage. The Am and c values from the RASP manual [Ref 25] were entered into FRANX [Ref 2] Seismic Fragility Editor and fragilities for the reactor protection cabinets were generated.

The fault tree CT-SEISMIC-RP1 is an OR gate with 10 AND gates as inputs. Each of the 10 AND gates has a hazard group ANDd with the fragility for that hazard group.

SLB - STEAM LINE BREAK The falling construction truss strikes one steam generator main steam line causing a main steam line break. The probability of damaging the MSL is based on a series of postulated events beginning with the construction truss being overstressed and components above a main steam line dislodging. The illustration below shows the Unit 1 exposure of the two main steam lines to construction trusses. The shorter trusses, T2, weigh ~ 3000 lbs. and the longer, T1 trusses, weigh ~ 6000lbs. The T1 trusses, optimally oriented, may perforate the 1 inch thick pipe; the T2 will not. The A MSL is directly under one T1 truss with another in close proximity - see illustration below. Although the B MSL has the longest run of pipe, most of the pipe run is in close proximity to the containment wall and protected by the crane rail above. As such MSL B is exposed to just one T1 truss. A probability of 1.31E-01 is calculated for the A MSL and also applied to the B MSL; this value is based on the events, logic and bounding probabilities developed in Attachment G.

T1 T1 A B T2 T2 T1 T2 T2 T1 Page 119 of 163

PBN-BFJR-17-019 Rev. 1 SLB2 - SECOND STEAM LINE BREAK The falling construction truss strikes a main steam line from the other steam generator causing steam lines from both steam generators to be broken. The probability of damaging the MSL is based on a series of postulated events beginning with the construction truss being overstressed and components above a main steam line dislodging. A probability of 1.31E-01 (max of MSL A and B) is calculated based on the events and bounding probabilities are developed in Attachment G.

Note: The end state of sequences with 2 steam line breaks is indeterminate; MAAP cannot model both steam lines as broken. A sensitivity was performed to determine the impact of changing Sequence 51 from OK to CD. The result of this sensitivity was no risk significant increase in CDF.

IR - CONSEQUENTIAL TUBE RUPTURE Failure at this branch indicates a ruptured steam generator tube. The Point Beach PRA uses a value of 2.7E-02 for probability of induced tube rupture after a steam line break and failure to isolate, as this condition is needed to realize the 2600 psid. This number is used as a conservative upper bound. This number is based on the RG 1.200 Point Beach Internal Events PRA.

MS3 - MAIN STEAM ISOLATED Failure at this branch indicates the main steam isolation valve has failed to close and the non-return check valve has failed to close resulting in both steam generators blowing down through the break.

AFS - FAILURE OF AFW There are two fault trees associated with this branch depending on whether or not there is a steam line break. Gate GAFW100 represents the failure of AFW flow to both steam generators and is used if no steam line breaks have occurred. Gate GAFW300 is used if a steam line break has occurred on one steam generator. The logic under both gates was revised to include the seismic failure of the CSTs. The fragility of block walls falling on CST level transmitters is no longer a valid failure mechanism since a structural shield has been installed over the level transmitters preventing the block wall from failing the level transmitters, EC 283392.

LOCA -CT INDUCED VERY SMALL LOCA Plant drawings show and photographs confirm the construction truss does not directly impact the reactor coolant system (RCS). The RCS seal table has a deck plate and structural steel to reduce the probability of construction truss impact. If the construction truss were to impact the seal table the possibility of a small LOCA or very small LOCA being created exists. A small LOCA may eliminate the need for PORVs depending on LOCA break size. Since PRA does not typically model failures (Small LOCA) as leading to success (Bleed), a very small LOCA was used to represent this branch. In Attachment G a value of 3.22E-02 was calculated as a bounding value for the probability of a CT induced small LOCA.

Target Assessment, Section 3.5.11, has additional details on the in-core instrumentation seal table.

Page 120 of 163

PBN-BFJR-17-019 Rev. 1 PORVS - PORVS FAIL TO OPEN Failure of AFW or failure of both main steam lines means bleed and feed is used to remove decay heat. The bleed function is represented by the PORVS branch. Success of this branch represents both PORVs open with their associated block valves open.

Note: The end state of sequences with 2 steam line breaks is indeterminate; MAAP cannot model both steam lines as broken. A sensitivity was performed to determine the impact of changing Sequence 51 from OK to CD. The result of this sensitivity was no risk significant increase in CDF.

HHI - HIGH HEAD SAFETY High head safety injection fails. This is represented by gate G442. High head safety injection is failed if two of two high head safety injection pumps fail to provide injection to the RCS from the RWST. Failures can be due to random failures of the system, seismic failure of the safety injection relay racks, seismic failure of the RWST, seismic failure of the high head SI pumps or failure of a heat exchanger in the area. The fragilities for the high head SI pumps, heat exchanger and relay racks are based on the IPEEE fragilities. The seismic fragility of the RWST has been enhanced by modification since the IPEEE. Credit for the modification has been taken by revising the Am for the RWST from 0.59 in the IPEEE to 0.73 in the current model. This value is based on calculations showing Am is > 0.59. 0.73 is based on input from Structural Engineering. Seismic induced failure of the A train relay racks and B train relay racks were not correlated15 in the IPEEE. However, since it is the same equipment type with the same fragility on the same elevation, the relay racks were correlated for the current models.

LC1- LONG TERM COOLING If bleed and feed cooling is used for decay heat removal then recirculation would eventually be required to maintain decay heat removal. Success requires switchover from the RWST to the containment sump, associated valve realignments, plus operation of one of two low head SI (RHR) pumps. Switchover will be required several hours after bleed and feed is initiated. The open pressurizer PORVs essentially create a small LOCA, so the success criterion for high pressure recirculation for long term bleed and feed can be assumed to be the same as a small LOCA. Success therefore also requires operation of one high pressure SI pump and maintaining at least two PORVs open.

15 Seismic correlated basic events are developed to account for the common cause failure of identical equipment on the same elevation.

Page 121 of 163

PBN-BFJR-17-019 Rev. 1 The same success criterion used is one of two RHR pumps supplying flow to the suction of one of two SI pumps, injecting flow to at least one of two cold legs. Component cooling and service water support functions are also necessary for recirculation. Both PORVs must also be open. The random failures of the systems were included by using the internal events gate for the long term cooling function modified to include IPEEE fragilities for the RHR pumps, Service Water pumps, Component Cooling Water pumps, Component Cooling Water heat exchangers, room heat exchanger HX-98, 480VAC Safeguards Load Centers and associated supply transformers. The CCW surge tank which had seismic failures included in the IPEEE is not modeled in the Point Beach PRA and therefore, the seismic fragility for the CCW surge tanks was not included in these models.

Based on the most limiting feed and bleed case, a steam line break inside containment, MAAP run SBIC04 indicates that the internal events model does not require containment heat removal for success of feed and bleed scenarios. The four containment fan coolers and two trains of containment spray provide a significant margin of safety because of the high level of redundancy and diversity for the containment heat removal function.

F.6 SEQUENCE DESCRIPTIONS Only sequence descriptions which lead to core damage are described. The CDF cutset G-CT-SEISMIC-CDF.cut was used. The sequence flag was set to FALSE and the resulting CDF was subtracted from the total CDF. Values are FTREX; ACUBE was not applied.

SEQUENCE DESCRIPTION CDF SEISMIC-01. Earthquake fails the construction truss. Both main steam lines remain intact and AFW successfully removes decay heat.

There is no induced very small LOCA, so injection is not required and core damage is avoided.

OK SEISMIC-02. Earthquake fails the construction truss. Both main steam lines remain intact and AFW successfully removes decay heat.

The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory. High OK head safety injection is successful as is long term cooling, thus preventing core damage.

SEISMIC-03. Earthquake fails the construction truss. Both main steam lines remain intact and AFW successfully removes decay heat.

The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory.

Eventually the RWST water level drops to the point where recirculation from the containment sump is required. Core damage occurs 2.72E-07 when recirculation fails.

SEISMIC-04. Earthquake fails the construction truss. Both main steam lines remain intact and AFW successfully removes decay heat.

The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory. High 1.96E-07 head safety injection fails leading to core damage.

SEISMIC-05. Earthquake fails the construction truss. Both main steam lines remain intact. However, AFW fails to remove decay heat.

Two PORVs successfully open, and high head safety injection maintains inventory and removes decay heat. Long term decay heat OK removal is successful when recirculation from the containment sump occurs thus preventing core damage.

SEISMIC-06. Earthquake fails the construction truss. Both main steam lines remain intact. However, AFW fails to remove decay heat.

Two PORVs successfully open, and high head safety injection maintains inventory and removes decay heat. Core damage occurs when 1.90E-07 the RWST water level drops and recirculation from the containment sump fails.

SEISMIC-07. Earthquake fails the construction truss. Both main steam lines remain intact. However, AFW fails to remove decay heat.

Two PORVs successfully open. Core damage occurs when high head safety injection fails to maintain RCS inventory.

1.37E-07 SEISMIC-08. Earthquake fails the construction truss. Both main steam lines remain intact. However, AFW fails to remove decay heat.

Bleed and feed fails to remove heat when the bleed function is failed resulting in core damage.

2.54E-07 SEISMIC-09. Earthquake fails the construction truss. Both main steam lines remain intact. Main steam isolation fails resulting in failure of AFW to remove decay heat. Two PORVs successfully open resulting in success of the bleed function and an SI pump successfully injects for the feed function. Long term decay heat removal is successful when recirculation from the containment sump OK occurs thus preventing core damage.

SEISMIC-10. Earthquake fails the construction truss. Both main steam lines remain intact. Main steam isolation fails resulting in failure of AFW to remove decay heat. Two PORVs successfully open resulting in success of the bleed function and an SI pump <E-12 successfully injects for the feed function. Core damage occurs when the RWST is depleted and containment sump recirculation fails.

SEISMIC-11. Earthquake fails the construction truss. Both main steam lines remain intact. Main steam isolation fails resulting in failure of AFW to remove decay heat. Two PORVs successfully open resulting in success of the bleed function. High head injection fails <E-12 resulting in loss of the feed function and core damage.

SEISMIC-12. Earthquake fails the construction truss. Both main steam lines remain intact. Main steam isolation fails resulting in failure of AFW to remove decay heat. PORVs fail to open resulting in failure of the bleed function. With no decay heat removal 1.72E-10 capability, core damage occurs.

Page 122 of 163

PBN-BFJR-17-019 Rev. 1 SEQUENCE DESCRIPTION CDF SEISMIC-13. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful and AFW is supplied to the intact steam generator. No injection OK is required since there is no LOCA.

SEISMIC-14. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful and AFW is supplied to the intact steam generator. The construction truss strikes the seal table resulting in a very small LOCA. High head safety injection successfully maintains RCS OK inventory. Long term cooling is provided when containment sump recirculation is successful.

SEISMIC-15. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful and AFW is supplied to the intact steam generator. The construction truss strikes the seal table resulting in a very small LOCA. High head safety injection successfully maintains RCS 5.54E-08 inventory. Core damage occurs when the RWST is depleted and sump recirculation fails.

SEISMIC-16. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful and AFW is supplied to the intact steam generator. The construction truss strikes the seal table resulting in a very small LOCA. High head safety injection fails to make-up RCS inventory lost 4.14E-08 out the break resulting in core damage.

SEISMIC-17. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful. AFW to the intact steam generator fails, bleed is successful through the open PORVs and feed is successful with success of high head safety injection. Long term cooling is successful with the OK success of high head containment sump recirculation SEISMIC-18. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful. AFW to the intact steam generator fails, bleed is successful through the open PORVs and feed is successful with success of high head safety injection. Core damage occurs when the RWST is 5.58E-08 depleted and sump recirculation fails.

SEISMIC-19. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful. AFW to the intact steam generator fails, bleed is successful 5.94E-08 through the open PORVs but feed fails due to failure of high head safety injection resulting in core damage.

SEISMIC-20. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs. Isolation of the faulted steam generator is successful. AFW to the intact steam generator fails and the bleed function 1.35E-07 fails when one PORV fails to open resulting in loss of decay heat removal and core damage.

SEISMIC-21. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs which cannot be isolated. This means AFW cannot be used for decay heat removal. Bleed is successful when a PORVs open and feed is successful when one high head safety injection pump supplies inventory to the RCS. Eventually, the RCS depletes and OK recirculation is required. Core damage is avoided when recirculation succeeds.

SEISMIC-22. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs which cannot be isolated. This means AFW cannot be used for decay heat removal. Bleed is successful when PORVs open and feed is successful when one high head safety injection pump supplies inventory to the RCS. Eventually, the RCS depletes and

<E-12 recirculation is required. Core damage occurs when recirculation fails.

SEISMIC-23. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs which cannot be isolated. This means AFW cannot be used for decay heat removal. Bleed is successful when PORVs <E-12 open. Core damage occurs when high head safety injection fails to supply inventory to the RCS.

SEISMIC-24. Earthquake fails the construction truss. Both main steam lines remain intact. A consequential steam generator tube rupture occurs which cannot be isolated. This means AFW cannot be used for decay heat removal. The decay heat removal function is 4.28E-08 failed when PORVs fail to open leading to failure of the bleed function and eventually core damage.

SEISMIC-25. N/A. N/A SEISMIC-26. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW successfully removes decay heat. With no injection required, core damage is avoided.

OK SEISMIC-27. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW successfully removes decay heat. The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory. Eventually the RWST water level drops to the point where recirculation from the containment sump is OK required. Successful recirculation prevents core damage.

SEISMIC-28. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory.

Eventually the RWST water level drops to the point where recirculation from the containment sump is required. Core damage occurs 1.75E-07 when recirculation fails.

SEISMIC-29. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

The truss strikes the seal table resulting in a very small LOCA which requires high head safety injection to maintain inventory. High 1.30E-07 head safety injection fails leading to core damage.

SEISMIC-30. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW fails to remove decay heat. Bleed is successful when PORVs are opened and feed is successful when one high head safety OK injection pump succeeds in providing inventory to the RCS. Core damage is avoided when recirculation is successful.

SEISMIC-31. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW fails to remove decay heat. Bleed is successful when PORVs are opened and feed is successful when one high head safety 1.75E-07 Page 123 of 163

PBN-BFJR-17-019 Rev. 1 SEQUENCE DESCRIPTION CDF injection pump succeeds in providing inventory to the RCS. Core damage occurs when the RWST is depleted and recirculation fails.

SEISMIC-32. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW fails to remove decay heat. Bleed is successful when PORVs are opened. However, failure of high head safety injection leads to 1.15E-07 core damage when inventory cannot be supplied.

SEISMIC-33. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

AFW fails to remove decay heat. The bleed function is failed when PORVs fail to open resulting in core damage.

2.49E-07 SEISMIC-34. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

Main steam isolation fails which means AFW cannot be used for decay heat removal. PORVs open to fulfill the bleed function and one OK high head safety injection pump succeed in providing RCS inventory. Recirculation succeeds and core damage is avoided.

SEISMIC-35. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

Main steam isolation fails which means AFW cannot be used for decay heat removal. PORVs open to fulfill the bleed function and one high head safety injection pump succeed in providing RCS inventory. However, when the RWST is depleted and recirculation fails, core

<E-12 damage occurs.

SEISMIC-36. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

Main steam isolation fails which means AFW cannot be used for decay heat removal. PORVs open to fulfill the bleed function but <E-12 inventory makeup is failed when no high head safety injection pumps are available resulting in core damage.

SEISMIC-37. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris.

Main steam isolation fails which means AFW cannot be used for decay heat removal. Core damage occurs when all PORVs remain 5.97E-12 shut failing the bleed function.

SEISMIC-38. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated and OK AFW successfully removes decay heat using the remaining steam generator. Core damage is avoided.

SEISMIC-39. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated and AFW successfully removes decay heat using the remaining steam generator. The falling truss causes a very small LOCA when it strikes OK the seal table or the seismic event causes a consequential small LOCA which require high head safety injection. High head safety injection successfully makes up the inventory and high head containment sump recirculation is successful, avoiding core damage.

SEISMIC-40. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated and AFW successfully removes decay heat using the remaining steam generator. The falling truss causes a very small LOCA when it strikes 9.03E-09 the seal table or the seismic event causes a consequential small LOCA which require high head safety injection. High head safety injection successfully makes up the inventory until the RWST depletes and recirculation fails resulting in core damage.

SEISMIC-41. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated and AFW successfully removes decay heat using the remaining steam generator. The falling truss causes a very small LOCA when it strikes 6.26E-09 the seal table or the seismic event causes a consequential small LOCA which require high head safety injection. Core damage occurs when high head safety injection fails.

SEISMIC-42. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated but AFW fails to remove decay heat. PORVs open fulfilling the bleed function and high head safety injection successfully makes up RCS OK inventory. Core damage is avoided when sump recirculation is successful.

SEISMIC-43. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated but AFW fails to remove decay heat. PORVs open fulfilling the bleed function and high head safety injection successfully makes up RCS 8.69E-09 inventory. Core damage occurs when the RWST is depleted and sump recirculation is unsuccessful.

SEISMIC-44. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated but AFW fails to remove decay heat. PORVs open fulfilling the bleed function but no inventory makeup is available resulting in core 1.08E-08 damage.

SEISMIC-45. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. The faulted steam generator is successfully isolated but AFW fails to remove decay heat. The bleed function is failed when PORVs cannot be opened resulting in a loss of decay heat removal 4.30E-08 and core damage.

SEISMIC-46. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. Isolation of the faulted generator fails resulting in loss of AFW. Bleed is successful with the opening of PORVs and feed I successful with inventory makeup from high head safety injection.

OK Core damage is avoided with success of containment sump recirculation.

SEISMIC-47. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. Isolation of the faulted generator fails resulting in loss of AFW. Bleed is successful with the opening of PORVs and feed I successful with inventory makeup from high head safety injection.

<E-12 Core damage occurs when the RWST is depleted and containment sump recirculation fails.

SEISMIC-48. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. Isolation of the faulted generator fails resulting in loss

<E-12 Page 124 of 163

PBN-BFJR-17-019 Rev. 1 SEQUENCE DESCRIPTION CDF of AFW. Bleed is successful with the opening of PORVs but feed is failed when high head safety injection is failed.

SEISMIC-49. Earthquake fails the construction truss. One main steam line fails as a result of the falling construction truss debris. An induced steam generator tube rupture occurs in the faulted steam generator. Isolation of the faulted generator fails resulting in loss 6.06E-09 of AFW. All PORVs fail to open resulting in a loss of bleed, decay heat removal and core damage.

SEISMIC-50. N/A N/A SEISMIC-51. Earthquake fails the construction truss resulting in the failure of both main steam lines. With no main steam pipes from the steam generators, the only successful path available for decay heat removal is bleed and feed. PORVs successfully opens fulfilling the bleed function and a high head safety injection pump successfully provides inventory to the RCS. Containment sump recirculation is successful avoiding core damage.

OK Note: The end state of Sequence 51 is indeterminate; MAAP cannot model both steam lines as broken. A sensitivity was performed to determine the impact of changing Sequence 51 from OK to CD. The result of this sensitivity was no risk significant increase in CDF.

Refer to section 9.2.5.2.

SEISMIC-52. Earthquake fails the construction truss resulting in the failure of both main steam lines. With no main steam pipes from the steam generators, the only successful path available for decay heat removal is bleed and feed. PORVs successfully opens fulfilling the bleed function and a high head safety injection pump successfully provides inventory to the RCS. However, containment sump 6.76E-08 recirculation fails after the RWST is depleted resulting in core damage.

SEISMIC-53. This sequence begins with an earthquake which fails the construction truss resulting in the failure of both main steam lines. With no main steam pipes from the steam generators, the only successful path available for decay heat removal is bleed and feed. PORVs successfully open fulfilling the bleed function but makeup is not available due to failure of high head safety injection.

3.67E-08 This results in core damage.

SEISMIC-54. Earthquake fails the construction truss resulting in the failure of both main steam lines. With no main steam pipes from the steam generators, the only successful path available for decay heat removal is bleed and feed. The bleed function is failed when 5.61E-08 all PORVs fail to open resulting in core damage.

SEISMIC-55. Earthquake fails the construction truss. Core damage occurs when the reactor fails to trip. There is no credit for loss of offsite power or ATWS leading to a reactor trip.

4.96E-08 F.7 Review of Top Events Used in the Point Beach Seismic IPEEE PRA Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition BLD Containment and Auxiliary Building. This event represents the structural integrity of the EXCLUDED containment building and the auxiliary building during the seismic event. Basis for exclusion: Catastrophic failure of the containment building and the auxiliary building is screened out at 0.3g RV Reactor Vessel. Represents the structural integrity of the reactor vessel and associated EXCLUDED internal vessel structures. Basis for exclusion: Failure of the reactor vessel or any of its internal structures is screened out at 0.3g.

SUR Surrogate Element. This event represents the integrity of a surrogate element that forms EXCLUDED a conservative lower bound estimate of the seismic failure of all of the structures and Basis for exclusion: The IPEEE used a surrogate event to represent components that were screened out at a High Confidence of Low Probability of Failure all the screened events. Since these events would only fail at very (HCLPF) value of 0.3g. high peak ground accelerations all the structures/components contained in the surrogate element were assumed to result in core damage and large early release. No surrogate events were applied in this analysis.

CTO Cable Trays Outside CSR. This event represents the structural integrity of cable trays EXCLUDED outside the cable spreading room (CSR) during a seismic event. Basis for exclusion: Since we are only interested in the delta caused by the CT failure, this would be an equal contributor to both mods and no mods so the delta would be zero.

CT1 Cable Trays Inside CSR. This event represents the structural integrity of cable trays inside EXCLUDED the cable spreading room during a seismic event. Seismic failure of the cable trays inside Basis for exclusion: Since we are only interested in the delta caused the CSR is not assumed to cause core damage directly (since only control power is lost), by the CT failure, this would be an equal contributor to both mods but rather to cause a need to control the plant from remote shutdown panels. and no mods so the delta would be zero The fault tree model for event CTI is equal to the seismic basic event CABLETRAY-SC--IN, which represents a failure of cable trays in the CSR. A combination of plant walkdowns and functional evaluations resulted in the conclusion that seismic failure of the cable trays in the CSR would only result in loss of control from the Control Room. Control from the Remote Shutdown Panels is credited in the analysis since their control cables are not impacted by seismic failure of the cable trays in the CSR.

IL ISLOCA. Likelihood that a seismic-induced interfacing system LOCA (ISL) will not occur. EXCLUDED Page 125 of 163

PBN-BFJR-17-019 Rev. 1 Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition Occurrence of an ISL is assumed to cause core damage and large early release. This event Basis for exclusion: The calculated fragility associated with the is represented by fault tree ISL. seismically induced ISLOCA was essentially zero for the range of PGA considered in the IPEEE [Figure 3.1.5-5] The IPEEE core damage group associated with ISLOCA had a frequency of 4.51E-13 [table 3.1.5-13].

OP LOOP. This event represents availability of off-site power after the seismic event. This INCLUDED event tree top leads to event trees PB1 and PB2. Offsite power is included in this evaluation. Failure of ceramic insulators is typically the most fragile component of offsite Event tree PB1 addresses the status of AC and DC Power given that off-site power is distribution systems. The generic seismic fragility from the RASP available.

[Ref 25] manual, Table 4B-1, is Am = 0.3, beta-r = 0.30, beta-u =

Event tree PB2 addresses the status of AC and DC power given that off-site power is 0.45, and HCLPF = 0.10.

unavailable.

D: DC Power. This top event represents the availability of the DC power system. Failure of INCLUDED event D is represented by fault tree top event D which models the seismic induced failure Failure of block wall is in the fragility model using the IPEEE fragility of the DC power system. Seismic-induced failure of Block Wall 19/9 results in failure of since the block wall has not been changed since the IPEEE. This is DO1, D02, D05, D06, D07, and D08. Seismic failure of DC power results in a loss of control based on only two batteries installed at the plant with only two DC power to the EDGs and major safety-related pumps. Core damage and large early release distribution panels and three battery chargers. The IPEEE fault tree are assumed to occur. assumes the block wall by all this equipment fails leading to failure of all DC power. With the addition of 3 additional safety related batteries, 3 additional safety related battery chargers, and two additional safeguards DC buses which are not located by any block walls, this sequence no longer leads directly to core damage since DC power is still available even if the block wall collapses.

D-05 and D-06 are the batteries that are affected by the block wall.

D-105, D-106 and D-305 (installed spare) which are not affected by the block wall also affect mitigating functions.

OC: HEP DC Battery. This top event represents successful human actions to reload the EXCLUDED battery chargers DO7 and DO8 onto emergency DC buses DO1 and D02. Failure of event No longer applicable due to changes made to procedures and the OC is represented by fault tree top event OC which models the human failure to reload plant. The ability to reload battery chargers onto emergency DC the battery chargers. Failure to reload to battery chargers results in the loss of long-term buses was enhanced following the IPEEE. Operators can now reload DC control power to the EDGs and major safety-related pumps. Core damage and large battery chargers from the control room or locally. Reloading battery early release are assumed to occur. chargers from the control room was not available at the time of the IPEEE. The seismic event tree/fault tree has two operator actions for reloading of the battery chargers included. HEP-125-BAT-CHGA, OPS FAILS TO ALIGN PWR/RELOAD ALT TO BATT CHARGER FROM CR with a failure probability of 8.86E-2 and HEP-125-COG-REC, OPS FAILS TO RECOVERY BATTERY CHARGER AFTER BATTERIES DEPLETE with a failure probability of 0.1. Both of these actions must fail to fail the reload function.

DPS: DC panels D16 and D17. This top event represents the availability of DC panels D16 and EXCLUDED D17. Failure of event DPS is represented by fault tree top event DPS which models the Basis for exclusion: These panels do not appear in the seismic event seismic-induced failure of DC panels D16 and D17. Seismic-induced failure of Block Wall tree since they do not affect the systems modeled in the seismic 116/23 results in failure of D16 and D17. Seismic failure of D16 and D17 results in a loss event tree.

of DC control power to train A of safety related equipment.

DPN: DC panels D18, D19, and D22. This top event represents the availability of DC panels EXCLUDED D18, D19, and D22. Failure of event DPN is represented by fault tree top event DPN Basis for exclusion: These panels do not appear in the seismic event which models the seismic-induced failure of DC panels D18, D19, and D22. Seismic- tree since they do not affect the systems modeled in the seismic induced failure of Block Wall 111-l results in failure of D18, D19, and D22. Seismic failure event tree.

of D18, D19, and D22 results in a loss of DC control power to a train B of safety-related equipment.

FOS: Fuel Oil To The EDGs. This top event represents the availability of fuel oil to the EDGs. INCLUDED Failure of event FOS is represented by fault tree top event FOS which models the seismic- Added in X13, X14, B03 and B04 with IPEEE fragilities even though induced failure of the fuel oil supply to the EDGs. Seismic-correlated failure of safeguards their anchorage has been enhanced significantly.

4.16 KVAC/480 VAC transformers Xl3 and Xl4 or safeguards 480 VAC Load Centers lB03 and lB04 results in failure of the DG fuel oil supply. Failure of the DG fuel oil supply results in a loss of AC power to safety-related equipment. Core damage and large early release are assumed to occur.

A: Safeguards 4160 VAC Bus A05 or A06. This top event represents the availability of INCLUDED emergency power from safeguards 4160 VAC bus A05 or A06. Failure of event A is The fragility from the IPEEE has been included in the fragility model represented by fault tree top event A which models the seismic-induced failure of even though the A06 buses in the IPEEE have been relocated and emergency power from AC buses A05 and A06. Seismic-correlated failure of A05 and replaced.

A06, or seismic-correlated failure of EDG room exhaust fans W/2A-W12D (which would result in the failure of the EDGs due to overheating) results in failure of event A. Seismic failure of A05 and A06 results in a loss of all AC power to safety-related equipment. Core damage and large early release are assumed to occur.

Y: 120VAC instrument buses Y01, Y02, Y03, and Y04. This top event represents the INCLUDED availability of 120VAC instrument buses Y01, Y02, Y03, and Y04. Failure of event Y is CT seismic PRA assumed a LOOP occurred for all seismic events. As represented by fault tree top event Y which models the seismic-induced failure of such this top event does not apply. Sequence PB1-1 in the IPEEE.

120VAC instrument buses Y01, Y02, Y03, and Y04. Seismic-induced failure of Block Wall The description notes that LERF is assumed to occur which is Page 126 of 163

PBN-BFJR-17-019 Rev. 1 Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition ill-4S/23 results in failure of lYOl-lYO4. Seismic-induced failure of Block Wall ill-2/23 confusing [page 171 of 211 in the Seismic IPEEE]- i.e. implies that results in failure of 2YOl-2YO4. Seismic failure of the instrument buses results in a loss LOOP directly leads to LERF.

of control power and control room indication. Core damage and large early release are assumed to occur.

SL: SLOCA. A SLOCA could be initiated by a random or seismic-induced failure of the RCS INCLUDED pressure boundary with break sizes ranging from 3/8 to 2 equivalent diameter. The If there is a small LOCA, this would mean the bleed function for feed occurrence of a SLOCA event is represented by fault tree top event SL. Seismic-induced and bleed would be successful since the 2 inch LOCA would relieve failure of this small bore RCS piping results in a seismic-induced SLOCA, and is pressure instead of the PORV.

represented by the digitized fragility curve provided in Figure 3-6 of NUREG/CR-4840, Procedure for External Event Core Damage Frequency Analysis for NUREG-1150.

ML: MLOCA. A MLOCA could be initiated by a random or seismic-induced rupture of the RCS EXCLUDED piping with sizes ranging from 2-6 equivalent diameter. Two stuck open pressurizer Basis for exclusion: The MLOCA event was screened out at HCLPF safety valves would also be a MLOCA. One stuck open safety valve would be borderline capacity of 0.3g.

between a small and medium break LOCA.

LL: LLOCA. A LLOCA could be initiated by a random seismic-induced rupture in the RCS EXCLUDED piping with a size ranging from 6 equivalent pipe diameter to a double-ended Basis for exclusion: This event was screened out at a HCLPF capacity circumferential break of the largest pipe in the system (effectively 29 diameter - the 31 of 0.3g. Included in the Thermal only.

diameter pump suction line is larger, however, the 29 diameter hot leg is upstream of this location).

TR: Steam Generator Tube Rupture (SGTR). The SGTR could be initiated by a random or EXCLUDED seismic-induced failure of a SG tube ranging in magnitude from a small leak in a single Basis for exclusion: This event was screened out at a HCLPF capacity tube up to a double-ended break of a single tube. of 0.3g. Included in the Thermal only.

IB: Steamline/Feedline break inside containment (IB). Event IB could be initiated by a EXCLUDED random or seismic-induced secondary pipe failure in the steam or feedwater system Basis for exclusion: This event was screened out at a HCLPF capacity inside containment. On the feedline side, the break or opening would be downstream of of 0.3g.

the feedwater non-return valve inside containment. On the steamline side, the fault would be located upstream of the MSIV and inside containment. The fault is also assumed large enough to cause secondary isolation and safety injection actuation.

OB: Steamline Break Outside Containment (OB). The event is a random or seismic-induced EXCLUDED secondary pipe failure or spurious or consequential valve opening in the steam system Basis for exclusion: This event was screened out at a HCLPF capacity outside containment. The fault is also assumed large enough to cause secondary of 0.3g in the IPEEE.

isolation and safety injection actuation. The fault could be located upstream or downstream of the MSIV, and is located outside of containment.

AFS: AFW System (Seismic). This top event represents the availability of the AFW system after INCLUDED a seismic initiating event. Failure of this event is represented by fault tree top event AFS which models the seismic-induced failure of the AFW system. This top event models the This is included in the seismic event tree availability of the AFW system to remove decay heat. Success of the AFW system requires operation of at least one of three AFW pumps delivering a total flow of 200 gpm to at least one SG. The AFW pumps could be started automatically on low SG level or by manual actuation. The steam-driven pump would also start upon loss of both 4.16 kV buses supplying power to the MFW pumps. The success criterion assumed here is the same as that used for the loss of normal feedwater event (plus several other transients) described in Section 14.1 of the FSAR.

Success for AFS also assumes adequate steam relieving capability. This can be achieved by operation of one of the relief valves (one SG ASDV or one of four safety valves) for each active SG. Steam dump to the condenser for long-term steam relief would not be available since the CW pumps fail upon loss of off-site power. Loss of the CW pumps would cause loss of condenser vacuum. Therefore, no credit is taken for the Condenser Steam Dumps. For simplicity, the ASDV was ignored and it is assumed that operation of one of four SG safety valves is required for success. These valves automatically open if the SG pressure reaches their pressure setpoint, whereas a manual gag override would be necessary to operate the ASDV.

Since the SPSA mission time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the volume of the CST is limited, it will be necessary to supply a backup supply of SW (most likely after several hours) to the suction of the AFW pumps, to ensure success for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Seismic-induced failure of the AFW system includes; 1) seismic-correlated failure of the CSTs, or 2) loss of all CST level transmitters due to the failure of the Block Walls that comprise the Operations Office (located directly above the transmitters) in conjunction with the failure of the operators to align the AFW suction to the backup service water supply.

AFN: AFW System (Non-Seismic]. This top event represents the availability of the AFW system INCLUDED after a seismic initiating event. Failure of this event is represented by fault tree top event AFN which models the non-seismic failure of the AFW system. The discussion of AFW This is included in the seismic event tree system success criteria is provided in the description of event AFS above.

RCCS: PORV Re-shuts (Seismic). The seismic event is assumed to cause a loss of IA. The loss of EXCLUDED IA leads to closure of the MSIVs and failure of MFW with off-site power available. This transient has a high probability of causing a PORV demand. This top event looks at Failure to re-shut only applies if it opens which means success of the whether or not the PORV recloses and, if it fails to reclose, whether or not the operator PORV gate. For all cases where PORV is opened the model logic asks Page 127 of 163

PBN-BFJR-17-019 Rev. 1 Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition isolates it. The PORVs are powered by IA and this begs the question why will they open if SI successful or not. If not, the result is core damage. If SI is in the first place after a loss of IA? It was conservatively assumed that the initial break successful, whether a PORV is stuck open or not, there is no core or failure in the IA system was far away from the PORVs, so that the air could be damage. Put another way, core damage is avoided when a PORV available in that part of the system for a long time. The initial PORV demand will take sticks open if SI is successful. So whether the PORV is stuck open is place very soon after the transient. Failure to isolate PORV path is modeled by fault tree irrelevant based on the structure of the event tree, success of SI top event RCCS.

SIS: SI (Seismic). This top event is asked following a failure of RC function. Failure of RCCS INCLUDED results in a SLOCA. The LOCA must be mitigated just as in the SLOCA event tree. SI IPEEE assumed cabinets were not anchored. Modification success is defined as one of two pumps injecting into one of two cold legs. Mission time performed to seismically anchor cabinets. Seismic modifications to is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This top event represents the availability of the SI system after a seismic RWST since IPEEE make SI seismic failure used in IPEEE overly initiating event. Failure of this event is represented by fault tree top event SIS which conservative.

models the seismic-induced failure of the SI system.

High pressure SI is automatically actuated upon receipt of a low pressurizer pressure SI signal or high containment pressure SI signal. The high pressure SI pumps take suction from the RWST. During the injection phase, the SI pumps inject water into the cold legs.

As analyzed in Section 14.3 of the FSAR, the success criterion is one of two SI pumps injecting into the intact loop cold leg. For a SLOCA, limited or no spillage from the broken loop would be expected, so the success criteria for SI can be used as injection into one of two loops. The SI actuation signal and start of the SI pumps is modeled in the fault trees.

Seismic-induced failure of the SI system includes; 1) seismic failure of engineered safety features actuation system (ESFAS) panels C156-17 or C165-167, 2) seismic-correlated failure of SI pumps P15A and B, 3) seismic-correlated failure of the RWSTs, or 4) seismic failure of HX-99 (flooding concern for SURHR equipment).

SIN: SI (Non-Seismic). This top event is asked following a failure of RCCS function. Failure of INCLUDED RCCS results in a SLOCA. The LOCA must be mitigated just as in the S2 event tree. SI This has been included in the models.

success is defined as one of two pumps injecting into one of two cold legs. Mission time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This top event represents the availability of the SI system after a seismic initiating event. Failure of this event is represented by fault tree top event SIN which models the non-seismic failure of the SI system.

High pressure SI is automatically actuated upon receipt of a low pressurizer pressure SI signal or high containment pressure SI signal. The high pressure SI pumps take suction from the RWST. During the injection phase, the SI pumps inject water into the cold legs.

As analyzed in Section 14.3 of the FSAR, the success criterion is one of two SI pumps injecting into the intact loop cold leg. For a SLOCA, limited or no spillage from the broken loop would be expected, so the success criteria for SI can be used as injection into one of two loops. The SI actuation signal and start of the SI pumps is modeled in the fault trees.

LCS: Long-Term Cooling (Seismic). If the SI system is used in response to a stuck open PORV, INCLUDED then recirculation would eventually be required to maintain decay heat removal. Since the primary system pressure would remain high, long-term cooling and RCS makeup can Added long term cooling to model.

be established by pumping containment sump water via the RHR pumps to the suction of the high pressure SI pumps. Success requires switchover from the RWST to the containment sump, associated valve realignments, plus operation of one of two low-head SI (RHR) pumps supplying flow to the suction of one of two SI pumps, injecting flow to at least one of two cold legs. The CCW and SW support systems are also necessary for recirculation. In addition to pump seal cooling, CCW and SW are needed to cool the RHR heat exchangers. This top event represents the availability of long-term cooling after a seismic initiating event. Failure of this event is represented by fault tree top event LCS which models the seismic induced failure of long-term cooling.

Seismic-induced failure of long-term cooling includes 1) operator failure to align the system for HP Recirculation during a seismic event, 2) seismic-correlated failure of RHR pumps P10A and B, or 3) seismic failure of HX-98 (causing flooding of the RHR pump room).

LCN: Long-Term Cooling (Non-Seismic). If the SI system is used in response to a stuck open INCLUDED PORV, then recirculation would eventually be required to maintain decay heat removal.

Since the primary system pressure would remain high, long-term cooling and RCS Added to the model.

makeup can be established by pumping containment sump water via the RHR pumps to the suction of the high pressure SI pumps. Success requires switchover from the RWST to the containment sump, associated valve realignments, plus operation of one of two low-head SI (RHR) pumps supplying flow to the suction of one of two SI pumps, injecting flow to at least one of two cold legs. The CCW and SW support systems are also necessary for recirculation. In addition to pump seal cooling, CCW and SW are needed to cool the RHR heat exchangers. This top event represents the availability of long-term cooling after a seismic initiating event. Failure of this event is represented by fault tree top event LCN which models the non-seismic-induced failure of long-term cooling.

Since high pressure recirculation for a SLOCA would not be needed for several hours or Page 128 of 163

PBN-BFJR-17-019 Rev. 1 Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition longer, it is possible that the operator would have stopped the RHR pumps during the injection phase in accordance with the emergency operating procedures (in EOP-1 or EOP-1.2). The operator would have stopped the RHR pumps if RCS pressure is stable and greater than the shutoff head pressure of the RHR pumps (including uncertainties, 200 psig for normal containment and 425 psig for adverse containment). Therefore, the fault tree considers the possibility that the RHR pump has to be restarted for high pressure recirculation. Mission time for LC is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

CIS: Containment Isolation (Seismic). This top event represents the successful containment INCLUDED isolation after a seismic initiating event. Failure of this event is represented by fault tree This has been included in the seismic fragility model.

top event CIS which models the seismic-induced failure of the containment isolation function.

In the event of a major accident, the containment isolation system functions to minimize the radiological releases to the environment. The containment isolation system acts to isolate the RCS and containment atmosphere from the environment. Systems which could become connected to the RCS or containment atmosphere as a result of, or subsequent to, the accident are isolated. To achieve isolation, at least two barriers are provided between the RCS or containment atmosphere and the environment. System design is such that no manual action is required for immediate isolation.

Seismic-induced failure of the containment isolation system includes 1) seismic failure of Block Walls 5-5/2A and 5-2 9/2A (which fail UT-947 and 2PT-947 respectively) or 2) seismic failure of RM A04-3200A and B.

CIN: Containment Isolation (Non-Seismic). This top event represents the successful INCLUDED containment isolation after a seismic initiating event. Failure of this event is represented This has been included in the seismic model for LERF.

by fault tree top event CIN which models the non-seismic failure of the containment isolation function.

In the event of a major accident, the containment isolation system functions to minimize the radiological releases to the environment. The containment isolation system acts to isolate the RCS and containment atmosphere from the environment. Systems which could become connected to the RCS or containment atmosphere as a result of, or subsequent to, the accident are isolated. To achieve isolation, at least two barriers are provided between the RCS or containment atmosphere and the environment. System design is such that no manual action is required for immediate isolation.

FCN: Fan Coolers (Non-Seismic). This top event represents the availability of the containment INCLUDED cooling function after a seismic initiating event. Failure of this event is represented by Fan coolers built into thermal model. Fan coolers are assumed to fault tree top event FCN which models the non-seismic failure of the fan coolers. fail.

The containment air recirculation cooling system consists of four air fan cooling units, a duct distribution system, and associated instrumentation and control systems. The reactor containment fan cooling (RCFC) units are designed to remove heat from the containment building during both normal operation and in the event of a LOCA or MSLB inside containment. At least one fan cooling unit must be available to remove heat during accident conditions.

RTN: Reactor Trip (Non-Seismic). The reactor trip top event requires the successful insertion EXCLUDED of the control rods. With off-site power failed due to the seismic event, the power to the The only way the reactor trip could be prevented would be if most Control Rod Drive Mechanism (CRDMs) is lost, and the control rods should insert into the of the control rods were to stick out of the reactor. The probability reactor. The only way that a reactor trip could be prevented in this scenario would be if of this is 1.20E-6 for basic event RP--CRD-FO-00000 from our most of the control rods were to stick out of the reactor. This phenomenon was modeled internal events PRA. The probability of this occurring at the same in the PSA as a basic event and has been included in the seismic event tree as top event time as a seismic event is below 1E-7 and not considered further. It RTN. Non-seismic-induced failure of the reactor trip function is assumed to result in core should be pointed out that failure of most rods to drop in is not core damage. damage in internal events, but a transfer to ATWS.

DGN Emergency Diesel Generator Operation. Upon loss of off-site power, the EDGs are INCLUDED (Non- designed to automatically start and come up to speed within 10 seconds (per Point Diesel generators are included in our seismic model.

Seismic): Beach FSAR Section 8.2.3). If an EDG fails to start the first time, up to two restarts will be IPEEE description is no longer valid because of the addition of two attempted automatically. Operator action is then required for additional start attempts. more safety related diesel generators after the IPEEE. The two fuel Success for the DG top event requires successful startup (within these three start oil transfer pumps have been replaced by four fuel oil transfer attempts) and operation of at least one of two EDGs to supply power to its associated pumps which are not subject to block wall failure because there are 4.16 kV safeguards buses. For a loss of off-site power event with successful reactor trip, no block walls in the vicinity of the four fuel oil transfer pumps.

startup of the EDG could be delayed for as long as 30 minutes, i.e., a limiting time for SG secondary dryout and also a minimum time to potential core uncover-y if a pressurizer relief valve opens following reactor trip and fails to reseat. As in the Point Beach IPE study, for the case of a transition to ATWS, a more rapid EDG startup would be required (i.e., within about 1 minute). This would preclude the operator backup in the event that the automatic start of the EDGs failed. It is therefore conservatively assumed that in all cases, the EDG startup must occur within the three automatic start attempts (i.e., no credit is taken for operator action). For event tree modeling, it is assumed that operation of the EDG is required for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. During this time, one of two fuel oil transfer pumps would be required to operate periodically to replenish the 550 gallon day tanks for the Page 129 of 163

PBN-BFJR-17-019 Rev. 1 Review of Top Events Used in the Point Beach Seismic IPEEE PRA IPEEE ID Full IPEEE Description CT PRA Disposition EDGs.

SWS: Service Water System (Seismic). This top event represents the availability of the SW INCLUDED system after a seismic initiating event. Failure of this event is represented by fault tree To go on recirculation, we need service water for CCW for RHR top event SW system which models the seismic-induced failure of the SW system. A decay heat removal. The SI pumps do not require CCW for injection.

discussion of the SW system is provided in the description of the SW system event in The TDAFWP no longer requires service water since they are now Section 3.1.3.1.5. self-cooled pumps. Service water supplies three of the four air compressors. One air compressor is air cooled. Air is no longer required since a nitrogen supply to the PORVs is available.

SWN: Service Water System (Non-Seismic). This top event represents the availability of the SW INCLUDED system after a seismic initiating event. Failure of this event is represented by fault tree top event SWN which models the non-seismic failure of the SW system. This includes the additional failure of the running pumps to restart upon restoration of power following the LOSP. A discussion of the SW system is provided in the description of the SWN event in Section 3.1.3.1.5.

CCS: CCW System (Seismic). This top event represents the availability of the CCW system after INCLUDED a seismic initiating event. Failure of this event is represented by fault tree top event CCS which models the seismic-induced failure of the CCW system.

CCN: CCW System (Non-Seismic). This top event represents the availability of the CCW system INCLUDED after a seismic initiating event. Failure of this event is represented by fault tree top event CCN which models the non-seismic failure of the CCW system. This includes the additional failure of the running pumps to restart upon restoration of power following the LOSP.

FCS: Fan Coolers (Seismic). This top event represents the availability of the containment INCLUDED Cooling after a seismic initiating event. Failure of this event is represented by fault tree top event FCS which models the seismic-induced failure of the containment fan coolers.

Seismic-induced failure of the fan coolers is represented by an operator failure to re-start the fan coolers after a seismic event resulting in a loss of off-site power.

RTS: Reactor Trip (Seismic). The reactor trip top event requires the successful insertion of the INCLUDED control rods. With off-site power available (SL3A-SLSA), a reactor trip signal could be generated by any one of the reactor trip protective functions. Failure of reactor trip would lead to an ATWS. The resulting transient would progress slow enough that manual reactor trip could be successful if automatic trip fails or is delayed. A successful reactor trip requires one of the above trip signals (automatic or manual), opening of the reactor trip breakers, and entry of the control rods into the core to stop the nuclear chain reaction. This top event represents a successful reactor trip following a seismic initiating event. Failure of this event is represented by fault tree top event RTS which models the seismic-induced failure of the reactor trip function. Seismic-induced failure of the reactor trip function is assumed to result in core damage.

Page 130 of 163

PBN-BFJR-17-019 Rev. 1 F.8 RESULTS UNIT 1 (Truncation = 1E-12)

ACUBE Results G-CT-SEISMIC-CDF 1.2336E-06 G-CT-SEISMIC-CDF-MODS 1.0185E-06 CDF = 2.15E-07 G-CT-SEISMIC-LERF 5.9064E-07 G-CT-SEISMIC-LERF-MODS 5.3917E-07 LERF = 5.15E-08 UNIT 2 (Truncation = 1E-12)

ACUBE Results G-CT-SEISMIC-CDF 1.2406E-06 G-CT-SEISMIC-CDF-MODS 1.0240E-06 CDF = 2.17E-07 G-CT-SEISMIC-LERF 5.9449E-07 G-CT-SEISMIC-LERF-MODS 5.4260E-07 LERF = 5.19E-08 Unit 1 CDF UNCERTAINTY G-CT-SEISMIC-CDF Parameter Estimate Confidence Range Point Est 1.21E-06 Samples 50000 Mean 1.19E-06 [1.4E-09 , 1.6E-09]

5% 2.05E-07 [1.2E-11 , 1.3E-11]

Median 7.36E-07 [2.1E-10 , 2.2E-10]

95% 3.42E-06 [4.7E-09 , 5.1E-09]

Standard Deviation 1.95E-06 Skewness 19.42763 Smp Size @ 10% 1032 Smp Size @ 2% 25803 Selected Target(s) G-CT-SEISMIC-CDF ACUBE TRUE ACUBE Count 5000 Page 131 of 163

PBN-BFJR-17-019 Rev. 1 F.9 CUTSETS The top 50 cutsets are listed below:

Cutset Report - UNIT 1 G-CT-SEISMIC-CDF = 1.764515E-06 (Probability) FTREX. ACUBE = 1.2336E-06 Cutset

1. Prob. BE Prob Inputs 1 2.30E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED %G10 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 9.40E-01 FRAG-HX-98-%G10 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G10 2 2.01E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 8.22E-01 FRAG-12A12D-%G10 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED %G10 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 3 1.84E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 7.50E-01 FRAG-125V-%G10 125V DC SYSTEM FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED%G10 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 4 1.43E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 5.82E-01 SI--CAB-SF-C1567-%G10 SEISMIC-INDUCED FAILURE OF C156-157 %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED%G10 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 5 1.38E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 5.65E-01 FRAG-4160V-%G10 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED%G10 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 6 1.22E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 5.00E-01 SI--T---SF-12T13-%G10 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED%G10 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 7 1.05E-07 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 PGA RANGE >1G 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED%G10 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 4.30E-01 SI--HX--SF-HX-99-%G10 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP AREA) %G10 8 7.48E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 PGA RANGE 0.78G TO <0.89G 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED%G08 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 8.06E-01 FRAG-HX-98-%G08 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G08 9 7.31E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 PGA RANGE 0.67G TO <0.78G 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED%G07 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 6.94E-01 FRAG-HX-98-%G07 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G07 10 6.92E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 PGA RANGE 0.89G TO <1G 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED%G09 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG Page 132 of 163

PBN-BFJR-17-019 Rev. 1 8.80E-01 FRAG-HX-98-%G09 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G09 11 6.10E-08 7.72E-07 INIT-%G06 SEISMIC INITIATING EVENT %G06 1.78E-01 FRAG-S2-%G06 SMALL LOCA FRAGILITY %G06 8.27E-01 FRAG-%G06-UNMODIFIED CT FRAGILITY UNMODIFIED%G06 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 5.37E-01 FRAG-HX-98-%G06 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G06 12 5.55E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 PGA RANGE 0.89G TO <1G 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 7.06E-01 FRAG-12A12D-%G09 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED%G09 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 13 5.49E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 PGA RANGE 0.78G TO <0.89G 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 5.91E-01 FRAG-12A12D-%G08 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED%G08 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 14 4.83E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 PGA RANGE 0.89G TO <1G 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 6.14E-01 FRAG-125V-%G09 125V DC SYSTEM FRAGILITY %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED%G09 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 15 4.74E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 PGA RANGE 0.67G TO <0.78G 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 4.50E-01 FRAG-12A12D-%G07 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED%G07 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 16 4.58E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.87E-01 SI--MDP-SF-P15AB-%G10 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G10 17 4.57E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 4.92E-01 FRAG-125V-%G08 125V DC SYSTEM FRAGILITY %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 18 3.83E-08 1.54E-06 INIT-%G05 SEISMIC INITIATING EVENT %G05 1.08E-01 FRAG-S2-%G05 SMALL LOCA FRAGILITY %G05 6.72E-01 FRAG-%G05-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 3.43E-01 FRAG-HX-98-%G05 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G05 19 3.73E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 3.54E-01 FRAG-125V-%G07 125V DC SYSTEM FRAGILITY %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 20 3.60E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.50E-01 FRAG-125V-%G10 125V DC SYSTEM FRAGILITY %G10 9.92E-01 FRAG-LOOP-%G10 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G10 1.45E-01 AFWLB CT BREAKS AFW PIPE 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-08_SEQ CT-SEISMIC-08 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 Page 133 of 163

PBN-BFJR-17-019 Rev. 1 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 21 3.54E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 4.50E-01 SI--CAB-SF-C1567-%G09 SEISMIC-INDUCED FAILURE OF C156-157 %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 22 3.35E-08 7.72E-07 INIT-%G06 SEISMIC INITIATING EVENT %G06 1.78E-01 FRAG-S2-%G06 SMALL LOCA FRAGILITY %G06 2.95E-01 FRAG-12A12D-%G06 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G06 8.27E-01 FRAG-%G06-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 23 3.25E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 1.31E-01 SLB CT INDUCED SLB 7.50E-01 FRAG-125V-%G10 125V DC SYSTEM FRAGILITY %G10 9.92E-01 FRAG-LOOP-%G10 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-33_SEQ CT-SEISMIC-33 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 24 3.25E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 4.13E-01 FRAG-4160V-%G09 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 25 3.21E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 3.46E-01 SI--CAB-SF-C1567-%G08 SEISMIC-INDUCED FAILURE OF C156-157 %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 26 2.91E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 3.70E-01 SI--T---SF-12T13-%G09 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 27 2.89E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 1.18E-01 FRAG-X13-X14-%G10 X13, X14 TRANSFORMERS FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 XHOS-1B49-D04 480 VAC MCC 1B-49 SUPPLYING D-04 1.00E+00 XHOS-1B39-D01 BUS 1B-39 SUPPLYING D-01 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 28 2.73E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 5.65E-01 FRAG-4160V-%G10 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G10 1.45E-01 AFWLB CT BREAKS AFW PIPE 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-07_SEQ CT-SEISMIC-07 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 Page 134 of 163

PBN-BFJR-17-019 Rev. 1 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 29 2.54E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 2.41E-01 SI--CAB-SF-C1567-%G07 SEISMIC-INDUCED FAILURE OF C156-157 %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 30 2.53E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 2.73E-01 SI--T---SF-12T13-%G08 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 31 2.50E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 1.00E-01 HEP-AF--STARTPMP-SEIS-HI FAILURE TO MANUALLY START AFW PUMP 7.50E-01 FRAG-125V-%G10 125V DC SYSTEM FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-08_SEQ CT-SEISMIC-08 SEQUENCE TAG 1.00E+00 XHOS-AFW-MOD MODIFICATION FOR NFPA-805 DD AFW PUMP TO SG B (CREDIT = 1.0 OR TRUE) 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 32 2.47E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 1.31E-01 SLB CT INDUCED SLB 5.65E-01 FRAG-4160V-%G10 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-32_SEQ CT-SEISMIC-32 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 33 2.45E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 1.00E-01 HEP-HHR-EOP13L34-SEIS-HI OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND PART SEISMIC HIGH 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 34 2.45E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 1.00E-01 HEP-HHR-EOP13L60-SEIS-HI OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST PART SEISMIC HIGH 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 35 2.44E-08 7.72E-07 INIT-%G06 SEISMIC INITIATING EVENT %G06 1.78E-01 FRAG-S2-%G06 SMALL LOCA FRAGILITY %G06 2.15E-01 FRAG-125V-%G06 125V DC SYSTEM FRAGILITY %G06 8.27E-01 FRAG-%G06-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 36 2.43E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 1.00E-01 HEP-125-BAT-CHG-SEIS-HI OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER FROM CR SEISMIC HIGH 9.92E-01 FRAG-LOOP-%G10 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 XHOS-2B49-D02 BUS 2B-49 SUPPLYING D-02 Page 135 of 163

PBN-BFJR-17-019 Rev. 1 1.00E+00 XHOS-1B39-D01 BUS 1B-39 SUPPLYING D-01 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 37 2.43E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 1.00E-01 HEP-125-COG-SEIS-HI OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER SEISMIC HIGH 9.92E-01 FRAG-LOOP-%G10 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.00E+00 XHOS-2B49-D02 BUS 2B-49 SUPPLYING D-02 1.00E+00 XHOS-1B39-D01 BUS 1B-39 SUPPLYING D-01 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 38 2.39E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 7.35E-01 FRAG-S2-%G10 SMALL LOCA FRAGILITY %G10 9.74E-02 FRAG-P32A-F-%G10 SERVICE WATER PUMP FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 39 2.26E-08 1.54E-07 INIT-%G09 SEISMIC INITIATING EVENT %G09 5.22E-01 FRAG-S2-%G09 SMALL LOCA FRAGILITY %G09 9.78E-01 FRAG-%G09-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 2.88E-01 SI--HX--SF-HX-99-%G09 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP AREA) %G09 40 1.98E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 1.88E-01 FRAG-4160V-%G07 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 41 1.94E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 1.00E-01 HEP-RP--CSPS1-01-SEIS-HI FAILURE TO SCRAM RX VIA OPENING MG SET BKR 5.82E-01 SI--CAB-SF-C1567-%G10 SEISMIC-INDUCED FAILURE OF C156-157 %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-55_SEQ CT-SEISMIC-55 SEQUENCE TAG 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 42 1.93E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 3.54E-01 FRAG-125V-%G07 125V DC SYSTEM FRAGILITY %G07 9.48E-01 FRAG-LOOP-%G07 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G07 1.45E-01 AFWLB CT BREAKS AFW PIPE 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-08_SEQ CT-SEISMIC-08 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 43 1.91E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 2.66E-01 FRAG-S2-%G07 SMALL LOCA FRAGILITY %G07 1.81E-01 SI--T---SF-12T13-%G07 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 44 1.88E-08 3.36E-07 INIT-%G10 SEISMIC INITIATING EVENT %G09 1.00E-01 HEP-AF--STARTPMP-SEIS-HI FAILURE TO MANUALLY START AFW PUMP 5.65E-01 FRAG-4160V-%G10 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G10 9.92E-01 FRAG-%G10-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-07_SEQ CT-SEISMIC-07 SEQUENCE TAG 1.00E+00 XHOS-AFW-MOD MODIFICATION FOR NFPA-805 DD AFW PUMP TO SG B (CREDIT = 1.0 OR TRUE)

Page 136 of 163

PBN-BFJR-17-019 Rev. 1 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 45 1.81E-08 7.72E-07 INIT-%G06 SEISMIC INITIATING EVENT %G06 2.15E-01 FRAG-125V-%G06 125V DC SYSTEM FRAGILITY %G06 9.07E-01 FRAG-LOOP-%G06 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G06 1.45E-01 AFWLB CT BREAKS AFW PIPE 8.27E-01 FRAG-%G06-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-08_SEQ CT-SEISMIC-08 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 46 1.78E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 1.92E-01 SI--HX--SF-HX-99-%G08 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP AREA) %G08 47 1.75E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 3.79E-01 FRAG-S2-%G08 SMALL LOCA FRAGILITY %G08 1.88E-01 FRAG-4160V-%G08 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G08 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-04_SEQ CT-SEISMIC-04 SEQUENCE TAG 48 1.74E-08 4.34E-07 INIT-%G07 SEISMIC INITIATING EVENT %G07 1.31E-01 SLB CT INDUCED SLB 3.54E-01 FRAG-125V-%G07 125V DC SYSTEM FRAGILITY %G07 9.48E-01 FRAG-LOOP-%G07 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G07 9.13E-01 FRAG-%G07-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-33_SEQ CT-SEISMIC-33 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 49 1.70E-08 2.56E-07 INIT-%G08 SEISMIC INITIATING EVENT %G08 4.92E-01 FRAG-125V-%G08 125V DC SYSTEM FRAGILITY %G08 9.71E-01 FRAG-LOOP-%G08 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G08 1.45E-01 AFWLB CT BREAKS AFW PIPE 9.57E-01 FRAG-%G08-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-08_SEQ CT-SEISMIC-08 SEQUENCE TAG 1.00E+00 XHOS-NO-P53-XTIE HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY 1.00E+00 XHOS-NO-P29-XTIE HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY 1.00E+00 XHOS-2B39-D03 480 VAC MCC 2B-39 SUPPLYING D-03 1.00E+00 XHOS-D06-D02 BATTERY D06 SUPPLIES BUS D-02 1.00E+00 XHOS-D05-D01 BATTERY D05 SUPPLIES BUS D-01 1.00E+00 XHOS-G05-STBY HOUSE EVENT TO SET G-05 IN STANDBY MODE 1.00E+00 125-BAT-DEP-FLAG 125 VDC BATTERY DEPLETES AFTER 1 HOUR 1.00E+00 NO-FIRE-FLAG NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE 1.00E+00 FLAG-1BSG-OUT FLAG TO IDENTIFY WHEN 1BSG HAS BREAK 50 1.68E-08 1.54E-06 INIT-%G05 SEISMIC INITIATING EVENT %G05 1.08E-01 FRAG-S2-%G05 SMALL LOCA FRAGILITY %G05 1.50E-01 FRAG-12A12D-%G05 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G05 Page 137 of 163

PBN-BFJR-17-019 Rev. 1 6.72E-01 FRAG-%G05-UNMODIFIED CT FRAGILITY UNMODIFIED 1.00E+00 CT-SEISMIC-03_SEQ CT-SEISMIC-03 SEQUENCE TAG Report Summary:

Filename: R:\Fleet-Site-Specific\PBN\1- Dome Truss - LAR\8 - CT PRA Model\03-14-18 CT\U1 - BASE\G-CT-SEISMIC-CDF.cut Print date: 3/28/2018 1:27 PM Printed the first 50 F.10 IMPORTANCES The following table provides basic event importances generated by ACUBE evaluation of 20,000 cutsets.

Event Probability Fus Ves BirnBm Red W RAW Description NO-FIRE-FLAG 1.00E+00 0.67630 1.19E-06 1 1 NO FIRE-FLAG SET TO LOGICAL FALSE FOR FIRE CT-SEISMIC-03_SEQ 1.00E+00 0.56114 9.90E-07 1 1 CT-SEISMIC-03 SEQUENCE TAG CT-SEISMIC-04_SEQ 1.00E+00 0.48657 8.59E-07 1 1 CT-SEISMIC-04 SEQUENCE TAG 125-BAT-DEP-FLAG 1.00E+00 0.42506 7.50E-07 1 1 125 VDC BATTERY DEPLETES AFTER 1 HOUR XHOS-NO-P29-XTIE 1.00E+00 0.41179 7.27E-07 1 1 HOUSE EVENT FOR NO P-29 CROSS TIE CAPABILITY XHOS-NO-P53-XTIE 1.00E+00 0.41138 7.26E-07 1 1 HOUSE EVENT FOR NO P-53 CROSS TIE CAPABILITY XHOS-2B39-D03 1.00E+00 0.35177 6.21E-07 1 1 480 VAC MCC 2B-39 SUPPLYING D-03 AFWLB 1.45E-01 0.29529 1.05E-06 1.1199 1.489 CT BREAKS AFW PIPE FLAG-1BSG-OUT 1.00E+00 0.28428 5.02E-07 1 1 FLAG TO IDENTIFY WHEN 1BSG HAS BREAK XHOS-G05-STBY 1.00E+00 0.27078 4.78E-07 1 1 HOUSE EVENT TO SET G-05 IN STANDBY MODE SLB 1.31E-01 0.25809 9.90E-07 1.0996 1.471 CT INDUCED SLB XHOS-D05-D01 1.00E+00 0.21646 3.82E-07 1 1 BATTERY D05 SUPPLIES BUS D-01 SEISMIC INITIATING EVENT %G06 INIT-%G06 7.72E-07 0.21274 4.86E-01 1.2702 3E+05 PGA RANGE 0.56G TO <0.67G FRAG-%G06-UNMODIFIED 8.27E-01 0.21274 4.28E-07 1.2702 1.03 CT FRAGILITY UNMODIFIED %G06 XHOS-D06-D02 1.00E+00 0.20914 3.69E-07 1 1 BATTERY D06 SUPPLIES BUS D-02 CT-SEISMIC-08_SEQ 1.00E+00 0.20441 3.61E-07 1 1 CT-SEISMIC-08 SEQUENCE TAG SEISMIC INITIATING EVENT %G09 INIT-%G10 3.36E-07 0.19025 9.99E-01 1.235 6E+05 PGA RANGE >1G FRAG-%G10-UNMODIFIED 9.92E-01 0.19025 3.36E-07 1.235 1 CT FRAGILITY UNMODIFIED %G10 FRAG-S2-%G10 7.35E-01 0.18967 7.40E-08 1.0436 1 SMALL LOCA FRAGILITY %G10 SEISMIC INITIATING EVENT %G07 INIT-%G07 4.34E-07 0.1805 7.34E-01 1.2203 4E+05 PGA RANGE 0.67G TO <0.78G FRAG-%G07-UNMODIFIED 9.13E-01 0.1805 3.33E-07 1.2203 1.008 CT FRAGILITY UNMODIFIED %G07 MODIFICATION FOR NFPA-805 DD AFW PUMP TO SG B (CREDIT =

XHOS-AFW-MOD 1.00E+00 0.1768 3.12E-07 1 1 1.0 OR TRUE)

XHOS-1B39-D01 1.00E+00 0.16323 2.88E-07 1 1 BUS 1B-39 SUPPLYING D-01 FRAG-125V-%G10 7.50E-01 0.13877 3.26E-07 1.0004 1 125V DC SYSTEM FRAGILITY %G10 FRAG-HX-98-%G10 9.40E-01 0.13624 2.56E-07 1.0004 1 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G10 XHOS-1B49-D04 1.00E+00 0.13354 2.36E-07 1 1 480 VAC MCC 1B-49 SUPPLYING D-04 CT-LOCA 3.22E-02 0.13113 1.87E-06 1.0509 2.011 CONSTRUCTION TRUSS INDUCED LOCA SEISMIC INITIATING EVENT %G08 INIT-%G08 2.56E-07 0.12946 8.92E-01 1.1487 5E+05 PGA RANGE 0.78G TO <0.89G FRAG-%G08-UNMODIFIED 9.57E-01 0.12946 2.31E-07 1.1487 1.002 CT FRAGILITY UNMODIFIED %G08 INIT-%G05 1.54E-06 0.12802 1.47E-01 1.1468 83132 SEISMIC INITIATING EVENT %G05 PGA RANGE 0.45G TO <0.56G FRAG-%G05-UNMODIFIED 6.72E-01 0.12802 3.24E-07 1.1468 1.056 CT FRAGILITY UNMODIFIED %G05 FRAG-S2-%G07 2.66E-01 0.12555 2.26E-07 1.0732 1.06 SMALL LOCA FRAGILITY %G07 FRAG-12A12D-%G10 8.22E-01 0.12054 2.59E-07 1.0003 1 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G10 FRAG-S2-%G06 1.78E-01 0.11249 4.51E-07 1.0844 1.178 SMALL LOCA FRAGILITY %G06 FRAG-S2-%G08 3.79E-01 0.10968 1.12E-07 1.0509 1.015 SMALL LOCA FRAGILITY %G08 CT-SEISMIC-07_SEQ 1.00E+00 0.10922 1.93E-07 1 1 CT-SEISMIC-07 SEQUENCE TAG FRAG-4160V-%G10 5.65E-01 0.1078 3.37E-07 1.0002 1 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G10 CT-SEISMIC-33_SEQ 1.00E+00 0.1025 1.81E-07 1 1 CT-SEISMIC-33 SEQUENCE TAG XHOS-2B49-D02 1.00E+00 0.0964 1.70E-07 1 1 BUS 2B-49 SUPPLYING D-02 XHOS-TM-NORM-10B 1.00E+00 0.09535 1.68E-07 1 1 NORMAL POWER SUPPLY FOR P10B UNAVAILABLE FRAG-LOOP-%G10 9.92E-01 0.09471 1.68E-07 1.0002 1 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G10 SI--CAB-SF-C1567-%G10 5.82E-01 0.09333 2.83E-07 1.0002 1 SEISMIC-INDUCED FAILURE OF C156-157 %G10 CT-SEISMIC-06_SEQ 1.00E+00 0.09266 1.64E-07 1 1 CT-SEISMIC-06 SEQUENCE TAG HEP-AF--STARTPMP-SEIS-HI 1.00E-01 0.09209 2.44E-07 1.0169 1.122 FAILURE TO MANUALLY START AFW PUMP SEISMIC HIGH INIT-%G09 1.54E-07 0.08537 9.78E-01 1.0933 6E+05 SEISMIC INITIATING EVENT %G09 PGA RANGE 0.89G TO <1G FRAG-%G09-UNMODIFIED 9.78E-01 0.08537 1.51E-07 1.0933 1 CT FRAGILITY UNMODIFIED %G09 HEP-125-BAT-CHG-SEIS-HI 1.00E-01 0.0821 2.64E-07 1.0189 1.131 OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER FROM CR Page 138 of 163

PBN-BFJR-17-019 Rev. 1 SEISMIC HIGH OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER SEISMIC HEP-125-COG-SEIS-HI 1.00E-01 0.0821 2.64E-07 1.0189 1.131 HIGH AFWLB2 1.45E-01 0.08146 3.67E-07 1.0326 1.176 CT BREAKS SECOND AFW PIPE FRAG-S2-%G09 5.22E-01 0.08136 4.95E-08 1.0269 1.002 SMALL LOCA FRAGILITY %G09 FRAG-LOOP-%G06 9.07E-01 0.07925 9.58E-08 1.0523 1.005 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G06 SI--T---SF-12T13-%G10 5.00E-01 0.07568 2.67E-07 1.0001 1 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G10 XHOS-NO-B08-P38 1.00E+00 0.07368 1.30E-07 1 1 HOUSE EVENT FOR NO B08 SUPPLY TO P38 PUMPS XHOS-D11-1B03 1.00E+00 0.07323 1.29E-07 1 1 NORMAL CONTROL POWER TO 1B-03 FROM DC DIST PANEL D-11 SLB2 1.31E-01 0.06674 3.32E-07 1.0264 1.162 SECOND STEAM LINE BREAK OCCURS GIVEN FIRST ONE HAS FAILED SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G10 4.30E-01 0.06553 2.69E-07 1.0001 1 AREA) %G10 FRAG-LOOP-%G07 9.48E-01 0.06494 4.34E-08 1.024 1.001 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G07 FRAG-125V-%G07 3.54E-01 0.06165 8.85E-08 1.0224 1.028 125V DC SYSTEM FRAGILITY %G07 FRAG-125V-%G08 4.92E-01 0.05677 2.98E-08 1.0101 1.007 125V DC SYSTEM FRAGILITY %G08 IRB-INDUCED-SGTR 2.70E-02 0.05673 8.53E-07 1.0168 1.467 INDUCED STEAM GENERATOR TUBE RUPTURE INIT-%G04 3.36E-06 0.05639 2.96E-02 1.0598 16783 SEISMIC INITIATING EVENT %G04 PGA RANGE 0.34G TO <0.45G FRAG-%G04-UNMODIFIED 4.30E-01 0.05639 2.27E-07 1.0598 1.072 CT FRAGILITY UNMODIFIED %G04 FRAG-125V-%G06 2.15E-01 0.05596 2.20E-07 1.0341 1.092 125V DC SYSTEM FRAGILITY %G06 CT-SEISMIC-31_SEQ 1.00E+00 0.05557 9.80E-08 1 1 CT-SEISMIC-31 SEQUENCE TAG FRAG-S2-%G05 1.08E-01 0.05503 6.64E-07 1.0528 1.326 SMALL LOCA FRAGILITY %G05 CT-SEISMIC-32_SEQ 1.00E+00 0.05447 9.61E-08 1 1 CT-SEISMIC-32 SEQUENCE TAG FRAG-HX-98-%G07 6.94E-01 0.05389 4.56E-08 1.0187 1.007 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G07 FP--DDP-FT--P805 5.07E-02 0.05349 3.94E-07 1.013 1.211 AFW DIESEL DRIVEN PUP FAILS TO RUN AFTER THE FIRST HOUR FRAG-HX-98-%G06 5.37E-01 0.05154 9.58E-08 1.0309 1.024 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G06 FRAG-HX-98-%G08 8.06E-01 0.05014 1.78E-08 1.0083 1.002 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G08 FRAG-LOOP-%G08 9.71E-01 0.0498 1.48E-08 1.0082 1 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G08 FRAG-125V-%G09 6.14E-01 0.04689 5.41E-09 1.0022 1.001 125V DC SYSTEM FRAGILITY %G09 OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND PART HEP-HHR-EOP13L34-SEIS-HI 1.00E-01 0.04552 1.37E-07 1.0084 1.07 SEISMIC HIGH OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST PART HEP-HHR-EOP13L60-SEIS-HI 1.00E-01 0.04552 1.37E-07 1.0084 1.07 SEISMIC HIGH FRAG-HX-98-%G09 8.80E-01 0.04326 3.71E-09 1.0019 1 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G09 DG--DG--FR---G01 6.28E-02 0.04291 5.04E-07 1.0189 1.267 DIESEL GENERATOR G-01 FAILS TO RUN FRAG-HX-98-%G05 3.43E-01 0.04006 1.79E-07 1.0372 1.066 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G05 CT-SEISMIC-52_SEQ 1.00E+00 0.03981 7.03E-08 1 1 CT-SEISMIC-52 SEQUENCE TAG FRAG-12A12D-%G08 5.91E-01 0.03744 1.57E-08 1.0055 1.003 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G08 FRAG-LOOP-%G09 9.83E-01 0.03606 2.40E-09 1.0013 1 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G09 FRAG-12A12D-%G07 4.50E-01 0.03558 4.16E-08 1.0112 1.013 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G07 FRAG-12A12D-%G09 7.06E-01 0.03525 3.14E-09 1.0013 1 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G09 CT-SEISMIC-55_SEQ 1.00E+00 0.03246 5.73E-08 1 1 CT-SEISMIC-55 SEQUENCE TAG FRAG-125V-%G05 9.91E-02 0.03207 4.38E-07 1.0292 1.22 125V DC SYSTEM FRAGILITY %G05 FRAG-4160V-%G09 4.13E-01 0.03185 3.79E-09 1.0011 1.001 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G09 FRAG-LOOP-%G05 8.29E-01 0.03174 5.96E-08 1.0289 1.006 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G05 FRAG-4160V-%G07 1.88E-01 0.03169 7.20E-08 1.0098 1.031 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G07 FRAG-X13-X14-%G10 1.18E-01 0.0308 4.61E-07 1 1 X13, X14 TRANSFORMERS FRAGILITY %G10 XHOS-1P29-NORMAL 1.00E+00 0.03034 5.35E-08 1 1 SERVICE WATER NORM.ALIGNMENT FOR TDP 1P29 - CLOSED HEP-RP--CSPS1-01-SEIS-HI 1.00E-01 0.03026 8.50E-08 1.0048 1.043 FAILURE TO SCRAM RX VIA OPENING MG SET BKR SI--MDP-SF-P15AB-%G10 1.87E-01 0.02917 2.75E-07 1 1 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G10 FRAG-12A12D-%G06 2.95E-01 0.02873 9.04E-08 1.016 1.035 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G06 DG--DG--FT---G01 4.10E-02 0.02798 5.01E-07 1.0122 1.272 DIESEL GENERATOR G-01 FAILS TO RUN IN HOURS 2-24 XHOS-1P53-ALT 1.00E+00 0.02781 4.91E-08 1 1 SW ALT. ALIGNMENT FOR MDP 1P53 - CLOSED SI--CAB-SF-C1567-%G08 3.46E-01 0.02643 1.61E-08 1.0035 1.006 SEISMIC-INDUCED FAILURE OF C156-157 %G08 SI--CAB-SF-C1567-%G09 4.50E-01 0.02582 2.86E-09 1.0008 1.001 SEISMIC-INDUCED FAILURE OF C156-157 %G09 FP--DDP-TM-P805 2.41E-02 0.0256 3.88E-07 1.0061 1.214 AFW DIESEL-DRIVEN PUMP TEST AND MAINTENANCE SI--CAB-SF-C1567-%G07 2.41E-01 0.02433 4.76E-08 1.0072 1.02 SEISMIC-INDUCED FAILURE OF C156-157 %G07 FRAG-4160V-%G06 9.69E-02 0.02414 1.93E-07 1.0133 1.096 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G06 FRAG-P32A-F-%G10 9.74E-02 0.02234 4.05E-07 1 1 SERVICE WATER PUMP FRAGILITY %G10 FRAG-4160V-%G08 1.88E-01 0.02222 2.03E-08 1.0028 1.009 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G08 CT-SEISMIC-20_SEQ 1.00E+00 0.02149 3.79E-08 1 1 CT-SEISMIC-20 SEQUENCE TAG SI--CAB-SF-C1567-%G06 1.44E-01 0.01918 1.15E-07 1.0104 1.055 SEISMIC-INDUCED FAILURE OF C156-157 %G06 SI--T---SF-12T13-%G09 3.70E-01 0.01903 2.39E-09 1.0005 1.001 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G09 XHOS-D13-2B04 1.00E+00 0.0178 3.14E-08 1 1 NORMAL CONTROL POWER TO 2B-04 FROM DC DIST PANEL D-13 SI--T---SF-12T13-%G08 2.73E-01 0.01775 1.32E-08 1.0022 1.005 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G08 FRAG-12A12D-%G05 1.50E-01 0.01766 1.74E-07 1.0156 1.083 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G05 FRAG-HX-98-%G04 1.52E-01 0.01743 1.94E-07 1.0174 1.093 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G04 FRAG-LOOP-%G04 6.88E-01 0.01715 4.30E-08 1.0171 1.008 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G04 FRAG-T24A-B-%G10 5.00E-01 0.01601 5.65E-08 1 1 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G10 INIT-%G03 1.01E-05 0.01543 2.70E-03 1.0157 1529 SEISMIC INITIATING EVENT %G03 PGA RANGE 0.23G TO <0.34G FRAG-%G03-UNMODIFIED 1.55E-01 0.01543 1.74E-07 1.0157 1.083 CT FRAGILITY UNMODIFIED %G03 Page 139 of 163

PBN-BFJR-17-019 Rev. 1 CT-SEISMIC-53_SEQ 1.00E+00 0.01522 2.69E-08 1 1 CT-SEISMIC-53 SEQUENCE TAG SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G09 2.88E-01 0.01492 2.26E-09 1.0004 1.001 AREA) %G09 FRAG-S2-%G04 4.69E-02 0.01474 5.09E-07 1.0146 1.274 SMALL LOCA FRAGILITY %G04 SI--T---SF-12T13-%G07 1.81E-01 0.01459 3.78E-08 1.0041 1.017 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G07 FP--DDP-FR--P805 1.34E-02 0.01424 3.84E-07 1.0033 1.214 AFW DIESEL DRIVEN PUMP FAILS TO RUN IN THE FIRST HOUR BATTERY CHARGER D-108 UNAVAILABLE DUE TO TEST AND 125-CHG-TM--D108 2.68E-02 0.01374 1.44E-07 1.0023 1.08 MAINTENANCE CT-SEISMIC-24_SEQ 1.00E+00 0.01355 2.39E-08 1 1 CT-SEISMIC-24 SEQUENCE TAG SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G08 1.92E-01 0.01256 1.27E-08 1.0015 1.006 AREA) %G08 CT-SEISMIC-54_SEQ 1.00E+00 0.01255 2.21E-08 1 1 CT-SEISMIC-54 SEQUENCE TAG XHOS-P38A-ALT 1.00E+00 0.01193 2.11E-08 1 1 SERVICE WATER ALT. ALIGNMENT FOR MDP P-38A - CLOSED CT-SEISMIC-18_SEQ 1.00E+00 0.01143 2.02E-08 1 1 CT-SEISMIC-18 SEQUENCE TAG FRAG-4160V-%G05 3.62E-02 0.01134 4.15E-07 1.0099 1.226 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G05 CT-SEISMIC-19_SEQ 1.00E+00 0.01129 1.99E-08 1 1 CT-SEISMIC-19 SEQUENCE TAG FRAG-125V-%G04 2.80E-02 0.01012 5.74E-07 1.01 1.316 125V DC SYSTEM FRAGILITY %G04 SI--T---SF-12T13-%G06 1.02E-01 0.01004 8.64E-08 1.0053 1.044 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G06 XHOS-SWPD-STBY 1.00E+00 0.00996 1.76E-08 1 1 EVENT USED TO SET SW P-32D LOGIC TO STANDBY MODE XHOS-NORM-DC 1.00E+00 0.00994 1.75E-08 1 1 SET = 1.0 FOR NORMAL DC POWER SI--CAB-SF-C1567-%G05 6.75E-02 0.00942 2.01E-07 1.0082 1.106 SEISMIC-INDUCED FAILURE OF C156-157 %G05 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G07 1.10E-01 0.00891 3.69E-08 1.0025 1.018 AREA) %G07 TSB-TFB-A 5.00E-01 0.00797 8.85E-09 1.0025 1.003 FRACTION OF STM/FW LINE BREAKS IN/OUT CTMT IN TRAIN "A" TSB-TFB-B 5.00E-01 0.00693 7.12E-09 1.002 1.002 FRACTION OF STM/FW LINE BREAKS IN/OUT CTMT IN TRAIN "B" FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 HEP-RCS-CSPH1-12-SEIS-HI 1.00E-01 0.00665 2.93E-08 1.0017 1.015 MOD. HIGH SEISMIC XHOS-HX12C-U2 1.00E+00 0.00641 1.13E-08 1 1 HX-12C ALIGNED TO UNIT 2 XHOS-HX12B-U1 1.00E+00 0.00641 1.13E-08 1 1 HX-12B ALIGNED TO UNIT 1 XHOS-HX12C-STBY 1.00E+00 0.00641 1.13E-08 1 1 CCW HX-12C IN STANDBY XHOS-UNIT-1-CCWP 1.00E+00 0.00641 1.13E-08 1 1 SWITCH TO LIMIT CC PUMP FAILURE LOGIC TO UNIT 1 ONLY FRAG-LOOP-%G03 4.48E-01 0.00638 2.51E-08 1.0064 1.008 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G03 FRAG-X13-X14-%G09 6.44E-02 0.0059 2.61E-09 1.0001 1.001 X13, X14 TRANSFORMERS FRAGILITY %G09 FRAG-12A12D-%G04 4.84E-02 0.00556 1.93E-07 1.0054 1.104 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G04 DG--DG--FR---G03 6.28E-02 0.00542 5.03E-08 1.0018 1.027 DIESEL GENERATOR G-03 FAILS TO RUN SI--MDP-SF-P15AB-%G09 1.01E-01 0.00531 1.99E-09 1.0001 1.001 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G09 SI--T---SF-12T13-%G05 4.44E-02 0.00525 1.72E-07 1.0045 1.093 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G05 FRAG-11A11B-%G10 3.26E-02 0.00515 2.79E-07 1 1 COMPONENT COOLING WATER PUMP FRAGILITY %G10 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G06 5.06E-02 0.00499 8.53E-08 1.0026 1.046 AREA) %G06 SI--MDP-FS-0015A 5.79E-03 0.00467 7.02E-07 1.0024 1.396 A TRAIN SI PUMP FAIL TO START FRAG-P32A-F-%G09 5.16E-02 0.00453 2.54E-09 1.0001 1.001 SERVICE WATER PUMP FRAGILITY %G09 FRAG-X13-X14-%G08 3.69E-02 0.00451 1.74E-08 1.0005 1.009 X13, X14 TRANSFORMERS FRAGILITY %G08 FO--MOV-CC-03930 6.27E-03 0.0042 4.88E-07 1.0018 1.275 MOV FO-3930 FAILS TO OPEN SI--MDP-TM-0015A 5.11E-03 0.00412 7.02E-07 1.0021 1.396 A SI PUMP TEST AND MAINTENANCE HEP-416-G04-1A06-SEIS-HI 1.00E-01 0.00408 6.68E-09 1.0004 1.003 OPERATOR FAILS TO ALIGN G-04 TO 1A-06 UNIT 1 SEISMIC HIGH DG--DG--FR---G04 6.28E-02 0.00404 5.09E-08 1.0018 1.027 DIESEL GENERATOR G-04 FAILS TO RUN SI--MDP-SF-P15AB-%G08 5.66E-02 0.00374 1.19E-08 1.0004 1.006 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G08 FRAG-T24A-B-%G08 2.73E-01 0.00363 2.51E-09 1.0004 1.001 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G08 FRAG-P32A-F-%G08 2.88E-02 0.00359 1.77E-08 1.0004 1.01 SERVICE WATER PUMP FRAGILITY %G08 NO HARD PIPED CROSS CONNECT BETWEEN FIRE PROTECTION XHOS-NO-FIRE-MOD 1.00E+00 0.00358 6.31E-09 1 1 SYSTEM AND SERVICE WATER SYS XHOS-VLV104-OPEN 1.00E+00 0.00357 6.30E-09 1 1 HOUSE EVENT SETTING SW-104 OPEN XHOS-VLV146-OPEN 1.00E+00 0.00357 6.30E-09 1 1 HOUSE EVENT SETTING SW-146 OPEN SW--VLV-TM---104 4.09E-02 0.00354 9.78E-08 1.0023 1.053 SW DISCHARGE VALVE SW-104 IN TEST AND MAINTENANCE SW--VLV-TM---146 4.09E-02 0.00354 9.78E-08 1.0023 1.053 SW DISCHARGE VALVE SW-146 IN TEST AND MAINTENANCE FAILURE TO INITIATE RCS B&F (SI NOT REQUIRED BY IE). AFTER N2 HEP-RCS-CSPH1-12-SEIS-LO 2.19E-02 0.00345 2.64E-07 1.0033 1.146 MOD. LOW SEISMIC DG--DG--FT---G03 4.10E-02 0.0034 4.80E-08 1.0011 1.026 DIESEL GENERATOR G-03 FAILS TO RUN IN HOURS 2-24 FRAG-T24A-B-%G09 3.07E-01 0.0032 1.84E-08 1.0001 1 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G09 SI--CAB-SF-C1567-%G04 2.09E-02 0.00303 2.41E-07 1.003 1.134 SEISMIC-INDUCED FAILURE OF C156-157 %G04 FRAG-4160V-%G04 7.76E-03 0.00302 6.15E-07 1.0029 1.346 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G04 AF--MDP-TM--1P53 6.85E-03 0.00301 9.37E-08 1.0004 1.053 AF MDP 1P53 OOS FOR TESTING OR MAINTENANCE CC--MOV-CC-0738A 3.70E-03 0.00298 7.02E-07 1.0015 1.396 CCW TO RHR A HX MOV FAILS TO OPEN FRAG-B03B04-%G10 1.23E-02 0.00292 4.18E-07 1 1 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G10 BATTERY CHARGER D-107 UNAVAILABLE DUE TO TEST AND 125-CHG-TM--D107 2.68E-02 0.0029 6.29E-08 1.001 1.035 MAINTENANCE FRAG-T24A-B-%G07 1.81E-01 0.00286 7.32E-09 1.0008 1.003 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G07 FRAG-HX-98-%G03 3.10E-02 0.00285 1.61E-07 1.0029 1.088 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G03 FRAG-X13-X14-%G07 1.80E-02 0.00272 5.62E-08 1.0007 1.031 X13, X14 TRANSFORMERS FRAGILITY %G07 Page 140 of 163

PBN-BFJR-17-019 Rev. 1 DG--DG--FS---G01 4.03E-03 0.00268 4.84E-07 1.0011 1.273 DIESEL GENERATOR GO1 FAILS TO START DG--DG--FT---G04 4.10E-02 0.00253 4.89E-08 1.0011 1.027 DIESEL GENERATOR G-04 FAILS TO RUN IN HOURS 2-24 FRAG-P32A-F-%G07 1.36E-02 0.00241 6.33E-08 1.0006 1.035 SERVICE WATER PUMP FRAGILITY %G07 NFPA 805 DD AFW PUMP SGB CONTROL AOV FAILS TO OPEN ON AF--AOV-CC-Z100 2.15E-03 0.00224 3.74E-07 1.0005 1.211 DEMAND XHOS-G02-N1A5 1.00E+00 0.00223 3.93E-09 1 1 G02 NOT ALIGNED TO 1A-05 HEP-RP--CSPS1-01-SEIS-LO 3.70E-02 0.00219 9.35E-08 1.002 1.051 FAILURE TO SCRAM RX VIA OPENING MG SET BKR SI--MDP-SF-P15AB-%G07 2.63E-02 0.00214 3.58E-08 1.0006 1.02 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G07 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G05 1.63E-02 0.00193 1.71E-07 1.0017 1.095 AREA) %G05 DG--DG--TM---G01 2.78E-03 0.00184 4.80E-07 1.0008 1.272 DIESEL GENERATOR G-01 TEST OR MAINTENANCE SEISMIC INITIATING EVENT %G02 INIT-%G02 4.82E-05 0.00183 6.68E-05 1.0018 38.88 PGA RANGE 0.12G TO <0.23G FRAG-%G02-UNMODIFIED 1.02E-02 0.00183 3.15E-07 1.0018 1.177 CT FRAGILITY UNMODIFIED %G02 FRAG-T24A-B-%G06 1.02E-01 0.00176 1.55E-08 1.0009 1.008 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G06 DG--DG--FR---G02 6.28E-02 0.0016 7.76E-09 1.0003 1.004 DIESEL GENERATOR G-02 FAILS TO RUN XHOS-G03-N2A6 1.00E+00 0.00158 2.78E-09 1 1 G03 NOT ALIGNED TO 2A-06 HEP-416-G03-2A06-SEIS-HI 1.00E-01 0.00147 5.99E-09 1.0003 1.003 OPERATOR FAILS TO ALIGN G-03 TO 2A-06 UNIT 2 SEISMIC HIGH SI--HOV-CC-0850A 1.79E-03 0.00144 7.01E-07 1.0007 1.397 A TRAIN RHR SUMP SUCTION HOV FAILS TO OPEN SI--T---SF-12T13-%G04 1.25E-02 0.00143 1.92E-07 1.0014 1.107 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G04 FRAG-P32A-F-%G06 5.13E-03 0.00131 1.83E-07 1.0007 1.103 SERVICE WATER PUMP FRAGILITY %G06 FRAG-X13-X14-%G06 7.04E-03 0.00124 1.35E-07 1.0006 1.076 X13, X14 TRANSFORMERS FRAGILITY %G06 FRAG-S2-%G03 1.04E-02 0.00117 1.96E-07 1.0012 1.11 SMALL LOCA FRAGILITY %G03 DG--DG--FT---G02 4.10E-02 0.00101 7.09E-09 1.0002 1.004 DIESEL GENERATOR G-02 FAILS TO RUN IN HOURS 2-24 XHOS-LT60F 1.00E+00 0.00098 1.74E-09 1 1 AMBIENT AIR TEMP IS LESS THAN 60 DEG F SI--MOV-CC-0851A 1.18E-03 0.00095 7.01E-07 1.0005 1.397 A TRAIN RHR SUMP SUCTION MOV FAILS TO OPEN SI--MOV-CC-0857A 1.18E-03 0.00095 7.01E-07 1.0005 1.397 A RHR TO A SI CROSS-TIE MOV FAILES TO OPEN SI--MDP-SF-P15AB-%G06 9.31E-03 0.00092 8.42E-08 1.0005 1.047 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G06 OPS FAIL TO ALIGNSI FOR HH CONT SUMP RECIR FIRST PART HEP-HHR-EOP13L60-SEIS-LO 2.50E-03 0.00088 5.69E-07 1.0008 1.322 SEISMIC LOW FRAG-125V-%G03 2.98E-03 0.00082 4.73E-07 1.0008 1.267 125V DC SYSTEM FRAGILITY %G03 CONTAINMENT SUMP STRAINER TRAIN A PLUGS MLOCA, LLOCA SI--STR-PG-ATRNL 1.00E-03 0.0008 7.01E-07 1.0004 1.397 SLB/FLB IN CONT SI--MOV-OO-0896A 8.54E-04 0.00069 7.01E-07 1.0004 1.397 A SI PUMP SUCTION MOV SI-896A FAILS TO CLOSE FRAG-11A11B-%G09 1.29E-02 0.00068 1.88E-09 1 1.001 COMPONENT COOLING WATER PUMP FRAGILITY %G09 RH--MDP-FS-0010A 7.73E-04 0.00062 7.01E-07 1.0003 1.397 A TRAIN RHR PUMP FAIL TO START FRAG-10A10B-%G10 3.80E-03 0.0006 2.78E-07 1 1 RHR PUMP FRAGILITY %G10 AF--TDP-TM--1P29 1.17E-02 0.0006 2.23E-08 1.0001 1.012 TURBINE DRIVEN PUMP 1P29 TEST AND MAINTENANCE FRAG-12A12D-%G03 6.22E-03 0.00057 1.61E-07 1.0006 1.091 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G03 NFPA 805 DD AFW PUMP SGB BLOCK MOV FAILS TO OPEN ON AF--MOV-CC--Z100 5.50E-04 0.00056 3.66E-07 1.0001 1.207 DEMAND AF--MDP-FS--1P53 1.47E-03 0.00054 5.64E-08 1.0001 1.032 AF MDP 1P53 FAILS TO START AF--AOV-CC14074A 2.15E-03 0.00054 4.64E-08 1.0001 1.026 AOV 1-4074A FAILS TO OPEN FROM 1P53 TO "A" SG FLAG-1ASG-OUT 1.00E+00 0.00054 9.60E-10 1 1 FLAG TO IDENTIFY WHEN 1ASG HAS BREAK OPS FAILS TO ALIGN PWR/RELOAD TO BATT CHARGER FROM CR HEP-125-BAT-CHG-SEIS-LO 6.50E-04 0.00047 1.11E-06 1.0004 1.628 SEISMIC LOW FRAG-LOOP-%G02 1.37E-01 0.00047 6.04E-09 1.0005 1.003 LOSS OF OFFSITE POWER AFTER SEISMIC EVENT %G02 FP--DDP-FS--P805 4.56E-04 0.00046 3.64E-07 1.0001 1.206 AFW DIESEL-DRIVEN PUMP FAILS TO START VDG-W---FS--183C 7.34E-03 0.00045 3.36E-08 1.0001 1.019 DG-02 ROOM FAN W-183C FO--MDP-FS-0206A 6.70E-04 0.00044 4.72E-07 1.0002 1.268 FUEL OIL TRANSTER PUMP P-206A FAILS TO START FRAG-B03B04-%G09 4.93E-03 0.00044 2.42E-09 1 1.001 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G09 FRAG-P32A-F-%G05 1.36E-03 0.00043 4.09E-07 1.0004 1.232 SERVICE WATER PUMP FRAGILITY %G05 FRAG-T24A-B-%G05 4.44E-02 0.00042 1.43E-08 1.0004 1.008 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G05 4160 VAC BUS 2A-06 UNAVAILABLE DUE TO TEST OR 416-BS--TM--2A06 1.21E-03 0.0004 4.01E-07 1.0003 1.227 MAINTENANCE 416-BKR-CC1A5257 5.73E-04 0.00037 4.72E-07 1.0002 1.268 BREAKER 1A52-57 FAILS TO OPEN TO SHED LOADS 480-BKR-OO-52391 5.73E-04 0.00037 4.72E-07 1.0002 1.268 480 VAC BKR 1B52-391 FROM 1B-39 TO D-07 FAILS TO CLOSE FRAG-11A11B-%G08 5.57E-03 0.00037 1.16E-08 1 1.007 COMPONENT COOLING WATER PUMP FRAGILITY %G08 416-BKR-OO-A5260 5.73E-04 0.00037 4.72E-07 1.0002 1.268 4160 VAC BKR A52-60G-01 TO 1A-05 NOFO SI--CAB-SF-C1567-%G03 2.85E-03 0.00036 2.18E-07 1.0004 1.123 SEISMIC-INDUCED FAILURE OF C156-157 %G03 FRAG-X13-X14-%G05 1.94E-03 0.00035 2.49E-07 1.0003 1.141 X13, X14 TRANSFORMERS FRAGILITY %G05 SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G04 2.89E-03 0.00033 1.92E-07 1.0003 1.109 AREA) %G04 XHOS-SWPE-STBY 1.00E+00 0.00032 5.61E-10 1 1 EVENT USED TO SET SW P-32E LOGIC TO STANDBY MODE VDG-W---FS--184B 7.34E-03 0.00032 3.50E-08 1.0001 1.02 DG-02 ROOM FAN W-184B HEP-416-G01-2A05-SEIS-HI 1.00E-01 0.0003 5.28E-09 1.0001 1.001 OPERATOR FAILS TO ALIGN G-01 TO 2A-05 UNIT 2 SEISMIC HIGH XHOS-G01-N2A5 1.00E+00 0.0003 5.28E-10 1 1 G01 NOT ALIGNED TO 2A-05 DUMMY EVENT TO MAP SAFETY MONITOR LOSS OF NORMAL XHOS-B03-P32B--N 1.00E+00 0.0003 5.21E-10 1 1 POWER XHOS-SWPB-STBY 1.00E+00 0.0003 5.21E-10 1 1 EVENT USED TO SET SW P-32B LOGIC TO STANDBY MODE Page 141 of 163

PBN-BFJR-17-019 Rev. 1 DUMMY EVENT TO MAP SAFETY MONITOR LOSS OF NORMAL XHOS-B04-32E--N 1.00E+00 0.0003 5.21E-10 1 1 POWER XHOS-G04-N1A6 1.00E+00 0.00028 4.85E-10 1 1 GO4 NOT ALIGNED TO 1A-06 4160 VAC BUS 2A-05 UNAVAILABLE DUE TO TEST OR 416-BS--TM--2A05 1.21E-03 0.00028 1.13E-07 1.0001 1.064 MAINTENANCE FRAG-B03B04-%G08 2.19E-03 0.00027 1.72E-08 1 1.01 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G08 SI--MDP-SF-P15AB-%G05 2.18E-03 0.00026 1.70E-07 1.0002 1.096 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G05 FAILURE TO MANUALLY START AFW PUMP HEP-AF--STARTPMP-SEIS-LO 2.07E-03 0.00025 1.84E-07 1.0002 1.104 SEISMIC LOW AF--TDP-FR--1P29 6.08E-03 0.00024 1.43E-08 1 1.008 BLOCK 9 TDP 1P29 FAILS TO RUN IN THE FIRST HOUR ESF-TDR-FT-TDR11 3.00E-04 0.00024 6.98E-07 1.0001 1.395 TIME DELAY RELAY TDR-11 FAILS TO ENERGIZE RH--MDP-FR-0010A 2.85E-04 0.00023 6.98E-07 1.0001 1.395 A TRAIN RHR PUMP FAIL TO RUN SI--T---RP-00013 2.88E-04 0.00023 6.98E-07 1.0001 1.395 RWST TANK T-13 EXCESSIVE LEAKAGE OR RUPTURE IA--AOV-CC-06310 1.01E-03 0.00022 2.91E-07 1.0002 1.165 PRESSURE REGULATOR IA-6310 FAILS TO OPEN IA--AOV-CC-06311 1.01E-03 0.00022 2.91E-07 1.0002 1.165 PRESSURE REGULATOR IA-6311 FAILS TO OPEN FRAG-4160V-%G03 5.58E-04 0.00022 6.66E-07 1.0002 1.377 4160VAC SAFEGUARDS SWITCHGEAR FRAGILITY %G03 DG--DG--FS---G03 4.03E-03 0.0002 2.74E-08 1.0001 1.015 DIESEL GENERATOR GO3 FAILS TO START RC--POR-CC-00430 8.21E-04 0.00018 2.91E-07 1.0001 1.165 PZR PORV RC-430 FAILS TO OPEN RC--POR-CC-0431C 8.21E-04 0.00018 2.91E-07 1.0001 1.165 PZR PORV RC-431C FAILS TO OPEN FO--MDP-FR-0206A 2.72E-04 0.00017 4.64E-07 1.0001 1.263 FUEL OIL TRANSTER PUMP 206A FAILS TO RUN AF--MOV-CC1-4067 5.50E-04 0.00017 3.54E-08 1 1.02 SW SUPPLY TO 1P53 SUCTION MOV FAILS TO OPEN MANUAL VALVE 0-SW-496 SUPPLY TO 1P53 MDAFWP HEP-SW--TY-00496 5.00E-04 0.00015 3.28E-08 1 1.019 RESTORATION ERROR 480-BKR-OO152494 5.73E-04 0.00015 3.26E-08 1 1.018 480 VAC BKR 1B52-494 FROM 1B-39 TO D-108 FAILS TO CLOSE FRAG-11A11B-%G07 1.91E-03 0.00015 3.53E-08 1 1.02 COMPONENT COOLING WATER PUMP FRAGILITY %G07 416-BKR-CC1A5277 5.73E-04 0.00015 3.26E-08 1 1.018 1A52-77 FAILS TO OPEN TO SHED LOADS BTWN 1A06-1A04 FRAG-B03B04-%G07 7.95E-04 0.00014 6.26E-08 1 1.035 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G07 SI--T---SF-12T13-%G03 1.48E-03 0.00014 1.61E-07 1.0001 1.091 SESIMICALLY CORRELATED FAILURE OF T13 (RWST) %G03 DG--DG--FS---G04 4.03E-03 0.00014 2.87E-08 1.0001 1.016 DIESEL GENERATOR GO4 FAILS TO START OPS FAIL TO ALIGN SI FOR HH CONT SUMP RECIR SECOND PART HEP-HHR-EOP13L34-SEIS-LO 3.59E-04 0.00013 5.67E-07 1.0001 1.321 SEISMIC LOW FO--MOV-CC-03931 6.27E-03 0.00013 3.91E-09 1 1.002 MOV FO-3931 FAILS TO OPEN 125-CHG-LP--0D07 1.65E-04 0.00013 6.89E-07 1.0001 1.39 BATTERY CHARGER D-07 FAILS 416-BKR-CC2A5296 5.73E-04 0.00013 2.64E-07 1.0001 1.15 BREAKER 2A52-96 FAILS TO OPEN TO SHED LOADS DG--DG--CMT-1234 8.85E-05 0.00013 1.30E-06 1.0001 1.736 DG G-01 / 02 / 03 / 04 COMMON MODE FAIL TO RUN HOURS 2-24 SW--STR-PG-F215 1.77E-04 0.00011 4.59E-07 1 1.26 SERVICE WATER STRAINER F-215 FOR G-01 PLUGS DG--DG--TM---G03 2.78E-03 0.00011 2.28E-08 1 1.013 DIESEL GENERATOR G-03 TEST OR MAINTENANCE VDG-W---FT--183C 2.55E-03 0.0001 2.13E-08 1 1.012 DG-02 ROOM FAN W-183C FAILS TO RUN IN HOURS 2-24 FLAG-NON-ATWS 1.00E+00 0.0001 1.76E-10 1 1 FLAG TO IDENTIFY NON-ATWS FAILURES DG--DG--CMT-134 7.27E-05 0.0001 1.28E-06 1.0001 1.725 DG G-01 / 03 / 04 COMMON MODE FAIL TO RUN IN HOURS 2-24 HEP-416-G03-2A06-SEIS-LO 7.49E-03 0.0001 2.29E-08 1.0001 1.013 OPERATOR FAILS TO ALIGN G-03 TO 2A-06 UNIT 2 SEISMIC LOW FAILURE TO RESTORE MANUAL VALVE 1-194A FROM 1P53 TO "A" HEP-AF--TY-1194A 5.00E-04 0.0001 2.67E-08 1 1.015 SG FAILURE TO RESTORE MANUAL VALVE 1-195A FROM 1P53 TO "A" HEP-AF--TY-1195A 5.00E-04 0.0001 2.67E-08 1 1.015 SG CT-SEISMIC-12_SEQ 1.00E+00 0.0001 1.72E-10 1 1 CT-SEISMIC-12 SEQUENCE TAG AF--MDP-FR--1P53 3.78E-04 0.0001 2.43E-08 1 1.014 AF MDP 1P53 FAILS TO RUN IN THE FIRST HOUR SI--MDP-FT-0015A 1.33E-04 0.0001 6.81E-07 1.0001 1.386 A TRAIN SI PUMP FAILS TO RUN 2-24 HOURS FRAG-P32A-F-%G04 2.01E-04 0.00008 6.09E-07 1.0001 1.345 SERVICE WATER PUMP FRAGILITY %G04 MS--SV--OO1-2005 6.76E-05 0.00008 3.63E-07 1 1.206 BLOCK 13 SAFETY RELIEF VLV UNIT 1 "B" STEAM GENERATOR 480-BKR-OO252491 5.73E-04 0.00008 1.71E-07 1.0001 1.097 480 VAC BREAKER 2B52-491 BETWEEN 2B-49 AND D-08 DG--DG--TM---G04 2.78E-03 0.00008 2.43E-08 1 1.014 DIESEL GENERATOR G-04 TEST OR MAINTENANCE DG--DG--FS---G02 4.03E-03 0.00008 2.28E-09 1 1.001 DIESEL GENERATOR GO2 FAILS TO START VDG-W---FT--184B 2.55E-03 0.00007 2.27E-08 1 1.013 DG-02 ROOM FAN W-184B FAILS TO RUN IN HOURS 2-24 CONTAINMENT SUMP STRAINERS TRAIN A AND B PLUG COMMON SI--STR-CM-SUMPL 1.00E-04 0.00007 6.60E-07 1 1.374 CAUSE MLOCA, LLOCA AF--AOV-CC14074B 2.15E-03 0.00006 4.40E-09 1 1.002 AOV 1-4074B FAILS TO OPEN FROM 1P53 TO "B" SG HEP-AF--CST--LOW-SEIS-HI 1.00E-01 0.00006 1.12E-09 1 1 CST LEVEL MONITORING FAILS SEISMIC HIGH HEP-AF--CST-SWMD-SEIS-HI 1.00E-01 0.00006 1.12E-09 1 1 Pe FOR SW SUPPLY TO MDAFW SEISMIC HIGH IA-T-RP-T242 2.88E-04 0.00006 2.87E-07 1 1.163 PZR ACCUMULATOR RUPTURES - T-243 IA-T-RP-T243 2.88E-04 0.00006 2.87E-07 1 1.163 PZR ACCUMULATOR RUPTURES - T-243 DG--DG--CMT-13 1.06E-04 0.00006 4.47E-07 1 1.254 DG G-01 / 03 COMMON MODE FAIL TO RUN IN HOURS 2-24 DG--DG--CMT-14 1.06E-04 0.00006 4.47E-07 1 1.254 DG G-01 / 04 COMMON MODE FAIL TO RUN IN HOURS 2-24 FRAG-10A10B-%G09 1.13E-03 0.00006 1.86E-09 1 1.001 RHR PUMP FRAGILITY %G09 AF--AOV-CC1-4002 2.15E-03 0.00006 5.81E-09 1 1.003 BLOCK 9 1P-29 MIN FLOW RECIRC 1-AF-4002 DG--DG--CMT-12 1.06E-04 0.00006 4.47E-07 1 1.254 DG G-01 / 02 COMMON MODE FAIL TO RUN IN HOURS 2-24 FRAG-T24A-B-%G04 1.25E-02 0.00006 8.48E-09 1.0001 1.005 CONDENSATE STORAGE TANKS T24A, T24B FRAGILITY %G04 FRAG-B03B04-%G06 2.18E-04 0.00006 1.81E-07 1 1.103 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G06 OPS FAILS TO RECOGNIZE NEED TO PWR BATT CHARGER SEISMIC HEP-125-COG-SEIS-LO 7.93E-05 0.00005 1.05E-06 1.0001 1.596 LOW Page 142 of 163

PBN-BFJR-17-019 Rev. 1 FO--MV--PG--0128 8.96E-05 0.00005 4.38E-07 1 1.248 MANUAL VALVE FO-128 PLUGGED FO--MV--PG--0156 8.96E-05 0.00005 4.38E-07 1 1.248 MANUAL VALVE FO-156 PLUGGED FRAG-11A11B-%G06 4.71E-04 0.00005 8.37E-08 1 1.047 COMPONENT COOLING WATER PUMP FRAGILITY %G06 MS--CKV-OO-2018A 1.04E-04 0.00005 2.00E-07 1 1.114 NON-RETURN CHECK VALVE MS-2018A FAILS TO CLOSE MS--CKV-OO-2017A 1.04E-04 0.00005 2.00E-07 1 1.114 NON-RETURN CHECK VALVE MS-2017A FAILS TO CLOSE SW--SOV-CC1-2090 2.05E-03 0.00005 5.26E-09 1 1.003 BLOCK 28 SERVICE WATER COOLING TO TDP 1P-29 SW-2090 P-29 BEARING COOLING MODIFICATION NOT INSTALLED (CLG XHOS-P29-NOBRGCLGMOD 1.00E+00 0.00005 9.08E-11 1 1 REQUIRED IF 1.0)

DG--DG--TM---G02 2.78E-03 0.00005 1.97E-09 1 1.001 DIESEL GENERATOR G-02 TEST OR MAINTENANCE RC--POR-TM-00430 1.93E-04 0.00004 2.82E-07 1 1.16 PORV RC-430 IN TEST/ MAINT RH--MDP-FT-0010A 5.38E-05 0.00004 5.87E-07 1 1.332 A TRAIN RHR PUMP FAIL TO RUN AFTER THE FIRST HOUR RC--POR-TM-0431C 1.93E-04 0.00004 2.82E-07 1 1.16 PORV RC-431C IN TEST/ MAINT DG--DG--CMT-123 7.27E-05 0.00004 4.06E-07 1 1.23 DG G-01 / 02 / 03 COMMON MODE FAIL TO RUN IN HOURS 2-24 DG--DG--CMT-124 7.27E-05 0.00004 4.06E-07 1 1.23 DG G-01 / 02 / 04 COMMON MODE FAIL TO RUN IN HOURS 2-24 FRAG-X13-X14-%G04 3.04E-04 0.00004 2.38E-07 1 1.135 X13, X14 TRANSFORMERS FRAGILITY %G04 FRAG-Y-%G10 8.71E-01 0.00003 5.36E-11 1 1 120 VAC INSTRUMENT BUS FRAGILITY %G10 125-CHG-LP--D108 1.65E-04 0.00003 5.37E-09 1 1.003 BATTERY CHARGER D-108 FAILS 125-CHG-LP--0D08 1.65E-04 0.00003 2.77E-07 1 1.157 BATTERY CHARGER D-08 FAILS SI--CKV-CC-0891A 5.00E-05 0.00003 5.72E-07 1 1.324 A SI PUMP MINI FLOW CHECK VALVE AF--TDP-FS--1P29 1.58E-03 0.00003 3.11E-09 1 1.002 BLOCK 9 TDP 1P29 FAILS TO START SI--CKV-CC-0889A 5.00E-05 0.00003 5.72E-07 1 1.324 A SI PUMP DISCHARGE CHK VLV AF--TDP-FT--1P29 1.65E-03 0.00003 3.64E-09 1 1.002 BLOCK 9 TDP 1P29 FAILS TO RUN IN HOURS 2-24 VDG-W---FS---12B 7.34E-03 0.00003 2.93E-09 1 1.002 DG-01 ROOM FAN W-12B RH--CKV-CC-0710A 5.00E-05 0.00003 5.72E-07 1 1.324 A TRAIN RHR PUMP DISCH CHK VALVE FAILS TO OPEN SW--VLV-TY---146 5.00E-04 0.00003 7.56E-08 1 1.043 FAILURE TO RESTORE DISCHARGE VALVE SW-146 VDG-W---FS---12A 7.34E-03 0.00003 2.93E-09 1 1.002 DG-01 ROOM FAN W-12A SI--MDP-SF-P15AB-%G04 2.56E-04 0.00003 1.92E-07 1 1.109 SEISMICALLY CORRELATED FAILURE OF P15A AND P15B %G04 SW--VLV-TY---104 5.00E-04 0.00003 7.56E-08 1 1.043 FAILURE TO RESTORE DISCHARGE VALVE SW-104 SI--HOV-OC-0850A 4.46E-05 0.00003 5.46E-07 1 1.309 A TRAIN RHR SUMP SUCTION HOV TRANSFERS CLOSED SW--MDP-FR---32F 1.29E-04 0.00002 5.74E-08 1 1.033 LOSS OF SERVICE WATER SW--MDP-FS---32E 1.19E-03 0.00002 2.78E-08 1 1.001 SW PUMP P-32E FAILS TO START FRAG-HX-98-%G02 7.66E-04 0.00002 4.58E-08 1 1.026 HX-98 FRAGILITY (FLOODS RHR PUMPS) %G02 HEP-ESF-SGLOLO 1.00E-04 0.00002 4.28E-08 1 1.024 MIS-CALIBRATION LOW LOW STEAM GENERATOR LEVEL FUEL OIL TRANSTER PUMP 206A FAILS TO RUN AFTER THE FIRST FO--MDP-FT-0206A 4.06E-05 0.00002 2.68E-07 1 1.152 HOUR MS--SV--OO1-2010 6.76E-05 0.00002 3.25E-08 1 1.018 BLOCK 12 SAFETY RELIEF VLV UNIT 1 "A" STEAM GENERATOR AF--MDP-FT--1P53 1.33E-04 0.00002 2.48E-07 1 1.001 AF MDP 1P53 FAILS TO RUN AFTER THE FIRST HOUR RH--MDP-TM-0010A 3.41E-05 0.00002 4.71E-07 1 1.267 A RHR PUMP TEST AND MAINTENANCE SI--MDP-FR-0015A 3.40E-05 0.00002 4.71E-07 1 1.267 A TRAIN SI PUMP FAIL TO RUN 1ST HOUR FRAG-10A10B-%G08 3.84E-04 0.00002 1.15E-08 1 1.006 RHR PUMP FRAGILITY %G08 SW--MDP-FR---32A 1.29E-04 0.00002 5.74E-08 1 1.033 LOSS OF SERVICE WATER SW--MDP-FS---32D 1.19E-03 0.00002 2.78E-08 1 1.001 SW PUMP P-32D FAILS TO START SW--MDP-FR---32C 1.29E-04 0.00002 5.74E-08 1 1.033 LOSS OF SERVICE WATER DG--DG--CMT-34 1.06E-04 0.00002 1.56E-07 1 1.088 DG G-03 / 04 COMMON MODE FAIL TO RUN IN HOURS 2-24 XHOS-K2A-RUNNING 1.00E+00 0.00002 3.38E-11 1 1 EVENT SET TO 1.0 WHEN K-2A IS RUNNING ELSE 0.0 SI--CKV-OO-0891B 1.00E-03 0.00002 9.52E-09 1 1.005 B SI PUMP MINI FLOWCHECK VALVE STUCK OPEN PRE-INITIATOR FLAG-A-CL-REC 1.00E+00 0.00001 1.51E-11 1 1 FLAG A COLD LEG RECIRCULATION FLAG-B-CL-REC 1.00E+00 0.00001 1.51E-11 1 1 B COLD LEG RECIRCULATION ESF-REL-FT-1531X 3.00E-04 0.00001 4.25E-09 1 1.002 RELAY 1P53-1X FAILS TO ENERGIZE FRAG-10A10B-%G07 1.00E-04 0.00001 3.06E-08 1 1.017 RHR PUMP FRAGILITY %G07 FO--MDP-FS-0207A 6.70E-04 0.00001 1.66E-08 1 1 FUEL OIL TRANSTER PUMP 207A FAILS TO START FRAG-11A11B-%G05 7.10E-05 0.00001 1.67E-07 1 1.095 COMPONENT COOLING WATER PUMP FRAGILITY %G05 416-X---LP--1X13 1.94E-05 0.00001 2.59E-07 1 1.147 TRANSFORMER 1X13 FAILS DUE TO LOSS OF POWER SI--MDP-CM-S15AB 2.00E-05 0.00001 3.10E-07 1 1.176 P15A AND B FAIL TO START CCF 2/2 MS--MOV-CC1-2020 9.19E-04 0.00001 1.60E-08 1 1 BLOCK 22 MAIN STEAM SUPPLY VALVE FOR TDP 1P-29 IA--CKV-CC-01301 5.00E-05 0.00001 1.87E-07 1 1.106 CHECK VALVE IA-1301 FAILS TO OPEN SESIMIC-INDUCED FAILURE OF HX-99 (FLOODING OF SI PUMP SI--HX--SF-HX-99-%G03 1.59E-04 0.00001 1.55E-07 1 1.088 AREA) %G03 AF--CKV-CC-1-101 1.30E-05 0.00001 1.87E-07 1 1.106 BLOCK 13 CHECK VLV FROM 1P-29 TO "B" STEAM GENERATOR 416-BKR-CC2A5276 5.73E-04 0.00001 6.45E-09 1 1.004 BREAKER 2A52-76 FAILS TO OPEN TO SHED LOADS HEP-AF--CST-SWMD-SEIS-LO 2.60E-02 0.00001 5.06E-10 1 1 Pe FOR SW SUPPLY TO MDAFW SEISMIC LOW SI--MOV-CM-857AB 1.35E-05 0.00001 1.94E-07 1 1.11 COMMON MODE FAILURE FOR A RHR TO A SI MOV SI--MOV-CO-0896A 1.85E-05 0.00001 2.59E-07 1 1.147 A SI PUMP SUCTION MOV TRANSFERS OPEN XHOS-RC-516-SHUT 2.01E-02 0.00001 1.24E-09 1 1 SET TO 1.0 WHEN RC-516 POSITIONED SHUT ELSE 0.0 FRAG-B03B04-%G05 3.93E-05 0.00001 3.83E-07 1 1.217 480VAC SAFEGUARDS LOAD CENTER FRAGILITY %G05 IA--CKV-CC-01302 5.00E-05 0.00001 1.87E-07 1 1.106 CHECK VALVE IA-1302 FAILS TO OPEN SI--MOV-CO-0871A 1.85E-05 0.00001 2.59E-07 1 1.147 MOV-871A SPURIOUSLY OPENS FOR PEN. 69 SUMP B FO--MOV-CM-C3031 2.33E-05 0.00001 2.15E-07 1 1.122 CCF OF FUEL OIL TRANSFER VALVES F0-3930 AND F0-3931 DG--DG--CMT-234 7.27E-05 0.00001 1.11E-07 1 1.063 DG G-02 / 03 / 04 COMMON MODE FAIL TO RUN IN HOURS 2-24 AF--CKV-OO-1-106 1.04E-04 0.00001 1.76E-07 1 1 BLOCK 17 FAILURE FOR BLOCK 10 VALVE 1-AF-00106 Page 143 of 163

PBN-BFJR-17-019 Rev. 1 480-BKR-OO252394 5.73E-04 0.00001 6.45E-09 1 1.004 480 VAC BKR 2B52-394 FROM 2B-39 TO D-107 FAILS TO CLOSE RH--MOV-CO-00720 1.85E-05 0.00001 2.59E-07 1 1.147 RHR SHUT DOWN COOLING DISCHARGE MOV RH--HX--IL-0011A 2.40E-05 0.00001 3.54E-07 1 1.201 RHR HEAT EXCHANGER HX-11A INTERNAL LEAK AF--MOV-CC1-4006 5.50E-04 0.00001 1.68E-08 1 1 BLOCK 6 SERVICE WATER FEED MOV TO TDP 1P-29 AF--MDP-CM-S-P53 1.04E-04 0.00001 2.15E-07 1 1 COMMON MODE FAILURE TO START 1P53 AND 2P53 VDG-W---FT---12A 2.55E-03 0.00001 5.80E-09 1 1.001 DG-01 ROOM FAN W-12A FAILS TO RUN IN HOURS 2-24 VDG-W---FT---12B 2.55E-03 0.00001 5.80E-09 1 1.001 DG-01 ROOM FAN W-12B FAILS TO RUN IN HOURS 2-24 416-BKR-OO-A5267 5.73E-04 0.00001 1.66E-08 1 1 4160 VAC BKR A52-67G-02 TO 2A-05 NOFO RC--POR-CM-PORV 5.58E-05 0.00001 2.04E-07 1 1.115 PZR PORVS RC-431C AND RC-430 FAILS TO OPEN DUE TO CCF 416-BKR-CO1A5260 7.61E-06 0 2.43E-07 1 1 BREAKER 1A52-60 BETWEEN G-01 TO 1A-05 DG G-01 / 02 / 04 COMMON MODE FAIL TO RUN IN THE FIRST DG--DG--CMR-124 7.04E-06 0 2.43E-07 1 1 HOUR SI--MDP-CM-R15AB 1.16E-05 0 1.92E-07 1 1.109 P15A AND B FAIL TO RUN IN THE FIRST HOUR CCF 2/2 MAN. VLV FROM 1P29 TO "A" STM GENER MISALGN AFTER TEST HEP-AF--TY-A-018 5.00E-04 0 1.09E-08 1 1 AND MAINT FRAG-%G01-UNMODIFIED 1.20E-05 0 3.81E-07 1 1.216 CT FRAGILITY UNMODIFIED %G01 125 VDC BKR D72-01-01 BETWEEN D-05 AND D-01 TRANSFERS 125-BKR-CO--0101 7.61E-06 0 2.45E-07 1 1 OPEN 480-BKR-CO15213C 7.61E-06 0 2.45E-07 1 1 480 V BKR 1B52-13C BTWN BUS 1B-03 AND MCC 1B-39 DG--DG--CMS-123 4.61E-06 0 2.43E-07 1 1 DG G-01 / 02 / 03 COMMON MODE FAIL TO START FRAG-Y-%G08 6.68E-01 0 7.37E-12 1 1 120 VAC INSTRUMENT BUS FRAGILITY %G08 DG--DG--CMS-13 8.30E-06 0 2.43E-07 1 1 DG G-01 / 03 COMMON MODE FAIL TO START 120-INV-LP-1DY04 2.02E-04 0 6.51E-09 1 1 YELLOW CHANNEL INVERTER 1DY-04 FAILS SW--MDP-TM---32F 3.93E-05 0 6.90E-08 1 1 SW PUMP P-32F UNAVAILABLE DUE TO TEST AND MAINT SW--MDP-TM---32A 3.93E-05 0 6.90E-08 1 1 SW PUMP P-32A UNAVAIL. DUE TO TEST AND MAINT DG--DG--CMR-1234 8.58E-06 0 3.67E-07 1 1.208 DG G-01 / 02 / 03 / 04 COMMON MODE FAIL TO RUN 1ST HOUR FO--MDP-CMS6A7AB 6.27E-06 0 2.43E-07 1 1 CC FAIL TO START OF P-206A & P-207A & P-207B 125 VDC BKR D72-26-10 FROM D-26 TO G-01 SUPPLY TRANSFERS 125-BKR-CO--2610 7.61E-06 0 2.43E-07 1 1 OPEN IA--MV--OC-01203 4.18E-05 0 1.69E-07 1 1.096 MANUAL VALVE IA-1203 SPURIOUS CLOSE DG--DG--CMS-14 8.30E-06 0 2.43E-07 1 1 DG G-01 / 04 COMMON MODE FAIL TO START BLOCK 8 SW HAND VLV TO TDP 2P-29 0-SW-140 MISALGN AFTER HEP-SW--TY-A-140 5.00E-04 0 1.48E-08 1 1 TEST AND MAINT FRAG-Y-%G06 3.69E-01 0 1.28E-11 1 1 120 VAC INSTRUMENT BUS FRAGILITY %G06 SW--VLV-TY---013 5.00E-04 0 1.48E-08 1 1 VALVE INADVERTENTLY LEFT IN CLOSED POSITION AFTER T&M 416-BKR-CO1A5258 7.61E-06 0 2.45E-07 1 1 4.16 KV BKR 1A52-58FROM BUS 1A-05 TO TRANSFORMER 1X-13 DG G-01 / 03 / 04 COMMON MODE FAIL TO RUN IN THE FIRST DG--DG--CMR-134 7.04E-06 0 1.40E-07 1 1.079 HOUR FO--AOV-CO-3982A 1.29E-05 0 1.69E-07 1 1.096 FUEL OIL RECIRC VALVE FO-3982A TRANSFERS OPEN DG--DG--CMR-14 1.03E-05 0 7.98E-08 1 1.045 DG G-01 / 04 COMMON MODE FAIL TO RUN IN THE FIRST HOUR SW--MDP-TM---32C 3.93E-05 0 6.90E-08 1 1 SW PUMP P-32C UNAVAILABLE DUE TO TEST AND MAINT COMMON CAUSE FAILURE 1P-11A AND 1P-11B TO RUN FOR 24 CC--MDP-CM-1-11R 8.23E-06 0 2.45E-07 1 1 HOURS 125 VDC BKR D72-01-07 BETWEEN D-07 AND D-01 TRANSFERS 125-BKR-CO--0107 7.61E-06 0 2.45E-07 1 1 OPEN OPERATOR FAILS TO RESTORE VALVE FOLLOWING TEST AND HEP-MS--TY-1-235 5.00E-04 0 1.09E-08 1 1 MAINTENANCE XHOS-BKR14B-1B32 1.00E+00 0 1.86E-12 1 1 BREAKER 1B52-14B SUPPLYING BUS 1B32 DG G-01 / 02 / 03 COMMON MODE FAIL TO RUN IN THE FIRST DG--DG--CMR-123 7.04E-06 0 2.43E-07 1 1 HOUR DG--DG--CMS-134 4.61E-06 0 2.43E-07 1 1 DG G-01 / 03 / 04 COMMON MODE FAIL TO START FRAG-10A10B-%G06 1.79E-05 0 5.84E-08 1 1.033 RHR PUMP FRAGILITY %G06 480-BKR-CO15216B 7.61E-06 0 2.45E-07 1 1 480 VAC BKR 1B52-16B FROM 1X13 TO BUS 1B-03 HEP-AF--TY-1195B 5.00E-04 0 4.32E-09 1 1 FAIL TO RESTORE MANUAL VALVE 1-195B FROM 1P53 TO "B" SG FO--MDP-CMS6AB7B 6.27E-06 0 2.43E-07 1 1 CC FAIL TO START OF P-206A & P-206B & P-207B HEP-SW--TY-1-135 5.00E-04 0 1.48E-08 1 1 SWS FEED MAN.VLV TO TDP P29 MISALGN AFTER TEST AND MAINT FO--MDP-FS-0207B 6.70E-04 0 1.50E-09 1 1 FUEL OIL TRANSFER PUMP 207B FAILS TO START 480-BKR-CO-1B14B 7.61E-06 0 2.43E-07 1 1 480 V BREAKER 1B52-14B TRANSFERS OPEN 480-BKR-CO-1B16B 7.61E-06 0 2.43E-07 1 1 480 V BREAKER 1B-16B TRANSFERS OPEN 125 VDC BRK D72-01-08 BETWEEN D-01 AND D-11 TRANSFERS 125-BKR-CO--0108 7.61E-06 0 2.45E-07 1 1 OPEN 480-BKR-CO-1B32D 7.61E-06 0 2.43E-07 1 1 480 VAC BREAKER 1B52-302D TRANSFERS OPEN SW--STR-PG-F222 1.77E-04 0 5.66E-09 1 1 SERVICE WATER STRAINER F-222 FOR D-02 PLUGS FRAG-Y-%G09 7.72E-01 0 2.60E-12 1 1 120 VAC INSTRUMENT BUS FRAGILITY %G09 SW--VLV-TY---014 5.00E-04 0 1.48E-08 1 1 VALVE INADVERTENTLY LEFT IN CLOSED POSITION ATER T&M 125-BKR-CO-D11-9 7.61E-06 0 2.43E-07 1 1 BKR D11-9 1A-05 NORM CONT. PWR FAILS OPEN FO--MDP-CMS-6A7A 1.12E-05 0 1.69E-07 1 1.096 CC FAIL TO START OF P-206A & P-207A HEP-AF--TY-1194B 5.00E-04 0 4.32E-09 1 1 FAIL TO RESTORE MANUAL VALVE 1-194B FROM 1P53 TO "B" SG 125 VDC BKR D72-11-13 BETWEEN D-11 AND D-16 TRANSFERS 125-BKR-CO--1113 7.61E-06 0 2.45E-07 1 1 OPEN Page 144 of 163

PBN-BFJR-17-019 Rev. 1 DG--DG--CMS-124 4.61E-06 0 2.43E-07 1 1 DG G-01 / 02 / 04 COMMON MODE FAIL TO START FO--MDP-CMS6AB7A 6.27E-06 0 2.43E-07 1 1 CC FAIL TO START OF P-206A & P-206B & P-207A FO--MDP-CMS-6A7B 1.12E-05 0 1.69E-07 1 1.096 CC FAIL TO START OF P-206A & P-207B FRAG-S2-%G02 2.50E-04 0 4.23E-09 1 1.002 SMALL LOCA FRAGILITY %G02 FO--MDP-CMS-ALL4 8.93E-06 0 4.55E-07 1 1.258 CC FAIL TO START OF P-206A & P-206B & P-207A & P-207B FO--MDP-CMS-6A6B 1.12E-05 0 1.69E-07 1 1.096 CC FAIL TO START OF P-206A & P-206B 120-INV-LP-1DY03 2.02E-04 0 6.51E-09 1 1 WHITE CHANNEL INVERTER 1DY-03 FAILS 125 VDC BKR D72-11-11 FROM D-11 FOR BUS 1B-03 TRANSFERS 125-BKR-CO--1111 7.61E-06 0 2.45E-07 1 1 OPEN 480-BKR-CO-52391 7.61E-06 0 2.45E-07 1 1 BKR 1B52-391 1B39 TO D07 FAILS OPEN XHOS-K2B-SWSN 1.00E+00 0 1.99E-12 1 1 K-2B ALIGNED TO NORTH SERVICE WATER HEADER 125 VDC BKR D72-11-07 FROM D-11 FOR BUS 1A-05 TRANSFERS 125-BKR-CO--1107 7.61E-06 0 2.43E-07 1 1 OPEN DG--DG--CMR-12 1.03E-05 0 7.98E-08 1 1.045 DG G-01 / 02 COMMON MODE FAIL TO RUN IN THE FIRST HOUR DG--DG--CMR-13 1.03E-05 0 7.98E-08 1 1.045 DG G-01 / 03 COMMON MODE FAIL TO RUN IN THE FIRST HOUR FO--MDP-FS-0206B 6.70E-04 0 1.11E-08 1 1 FUEL OIL TRANSTER PUMP 206B FAILS TO START HEP-AF--TY-1-190 5.30E-05 0 6.31E-08 1 1 1P53 SUCTION MANUAL VALVE 1-190 RESTORATION ERROR SI--MDP-TM-0015B 5.11E-03 0 2.45E-10 1 1 A SI PUMP TEST AND MAINTENANCE DG--DG--CMS-12 8.30E-06 0 2.43E-07 1 1 DG G-01 / 02 COMMON MODE FAIL TO START RP--CRD-FO-00000 1.20E-06 0 3.85E-06 1 3.18 MOST CONTROL RODS FAIL TO DROP INTO CORE SW--STR-PG1-2998 1.77E-04 0 5.70E-09 1 1 BLOCK 28 SERVICE WATER COOLING FOR 1P-29 125-CHG-LP--D107 1.65E-04 0 6.51E-09 1 1 BATTERY CHARGER D-107 FAILS 480-BKR-CO15214B 7.61E-06 0 2.45E-07 1 1 480 VAC BKR 1B52-14B FROM 1B-03TO MCC 1B-32 125-BKR-CO-D01-8 7.61E-06 0 2.43E-07 1 1 BKR D01-8 DC PANEL D01 TO D11 FAILS OPEN SEISMIC INITIATING EVENT %G01 INIT-%G01 3.04E-04 0 1.50E-08 1 1.009 PGA RANGE 0.05G TO <0.12G SI--MDP-FS-0015B 5.79E-03 0 2.45E-10 1 1 B TRAIN SI PUMP FAIL TO START OPERATOR FAILS TO RESTORE VALVES IN MINI-FLOW HEP-AF--TY-1P29 5.00E-04 0 1.48E-08 1 1 RECIRCULATION PATH FOLLOWING T&M 480-BKR-CO-1B32F 7.61E-06 0 2.43E-07 1 1 480 V BREAKER 1B52-3212F TRANSFERS OPEN 416-BKR-CO-1A558 7.61E-06 0 2.43E-07 1 1 4160 V BREAKER 1A52-58 TRANSFERS OPEN IA--MV--OC-01204 4.18E-05 0 1.69E-07 1 1.096 MANUAL VALVE IA-1204 SPURIOUS CLOSE MAN VLV FROM MAIN STM VLVS TO TDP P-29 MISALGN AFTER HEP-AF--TY-A-126 5.00E-04 0 1.48E-08 1 1 TEST AND MAINT HEP-416-G04-1A06-SEIS-LO 7.49E-03 0 1.56E-10 1 1 OPERATOR FAILS TO ALIGN G-04 TO 1A-06 UNIT 1 SEISMIC LOW 416-BKR-OO1A5280 5.73E-04 0 8.04E-09 1 1 1A52-80 FROM G-03 TO 1A-06 NOFO FO--MDP-FR-0207A 2.72E-04 0 1.47E-08 1 1 FUEL OIL TRANSFER PUMP 207A FAILS TO RUN SI--MDP-CM-T15AB 4.19E-06 0 2.45E-07 1 1 P15A AND B FAIL TO RUN AFTER THE FIRST HOUR, CCF 2/2 OPERATOR FAILS TO MANUALLY ALIGN FROM NORMAL TO HEP-120--U12-INV 1.00E+00 0 2.64E-12 1 1 ALTERNATE INVERTER FRAG-12A12D-%G02 7.19E-05 0 1.58E-08 1 1.009 COMPONENT COOLING WATER HEAT EXCHANGER FRAGILITY %G02 XHOS-D11-1A05 1.00E+00 0 1.85E-12 1 1 NORMAL CONTROL POWER TO 1A-05 FROM DC DIST PANEL D-11 FRAG-P32A-F-%G03 9.89E-06 0 4.26E-07 1 1.242 SERVICE WATER PUMP FRAGILITY %G03 480-BKR-CO-1B31M 7.61E-06 0 2.43E-07 1 1 480 V BREAKER 1B52-301M TRANSFERS OPEN FRAG-Y-%G07 5.32E-01 0 1.03E-11 1 1 120 VAC INSTRUMENT BUS FRAGILITY %G07 AF--AOV-CM-14074 4.80E-05 0 2.27E-08 1 1 AOVS 1-4074A AND 1-4074B FAIL DUE TO COMMON CAUSE 1P53 Page 145 of 163

PBN-BFJR-17-019 Rev. 1 F.11 INSIGHTS

1. The following tables provide CDF and LERF values for each seismic initiator for the DCA and Bounding analysis, as well as the difference between the bounding and DCA results. The difference between the DCA and Bounding are associated with crediting mitigating functions in the DCA. The Bounding is dominated by the higher frequency, but lower PGA, initiators. The DCA is dominated by the lower frequency more severe initiators where mitigating functions are more likely to fail.

A Unit 1 CDF by DCA Unit 2 CDF by Bounding CDF by Bounding vs DCA Seismic Initiator Seismic Initiator Seismic Initiator %CDF by Initiator Initiator CDF Initiator CDF Initiator CDF Initiator CDF INIT-%G01 4.57E-12 INIT-%G01 4.57E-12 INIT-%G01 3.63E-09 INIT-%G01 99.9%

INIT-%G02 3.09E-09 INIT-%G02 3.10E-09 INIT-%G02 4.91E-07 INIT-%G02 99.4%

INIT-%G03 2.45E-08 INIT-%G03 2.49E-08 INIT-%G03 1.56E-06 INIT-%G03 98.4%

INIT-%G04 7.90E-08 INIT-%G04 8.01E-08 INIT-%G04 1.44E-06 INIT-%G04 94.4%

INIT-%G05 1.59E-07 INIT-%G05 1.60E-07 INIT-%G05 1.04E-06 INIT-%G05 84.6%

INIT-%G06 2.29E-07 INIT-%G06 2.31E-07 INIT-%G06 6.39E-07 INIT-%G06 63.8%

INIT-%G07 1.94E-07 INIT-%G07 1.95E-07 INIT-%G07 3.96E-07 INIT-%G07 50.7%

INIT-%G08 1.48E-07 INIT-%G08 1.49E-07 INIT-%G08 2.45E-07 INIT-%G08 39.3%

INIT-%G09 1.10E-07 INIT-%G09 1.10E-07 INIT-%G09 1.51E-07 INIT-%G09 27.2%

INIT-%G10 2.86E-07 INIT-%G10 2.87E-07 INIT-%G10 3.33E-07 INIT-%G10 13.9%

TOTAL 1.23E-06 TOTAL 1.24E-06 TOTAL 6.30E-06 TOTAL 80.3%

DCA Unit 1 LERF by DCA Unit 2 LERF by Bounding LERF by Bounding vs DCA Seismic Initiator Seismic Initiator Seismic Initiator %LERF by Initiator Initiator LERF Initiator LERF Initiator LERF Initiator LERF INIT-%G01 <E-12 INIT-%G01 <E-12 INIT-%G01 1.06E-13 INIT-%G01 100.0%

INIT-%G02 <E-12 INIT-%G02 <E-12 INIT-%G02 5.76E-09 INIT-%G02 100.0%

INIT-%G03 3.39E-10 INIT-%G03 3.39E-10 INIT-%G03 2.17E-07 INIT-%G03 99.8%

INIT-%G04 4.66E-09 INIT-%G04 4.69E-09 INIT-%G04 4.71E-07 INIT-%G04 99.0%

INIT-%G05 2.03E-08 INIT-%G05 2.05E-08 INIT-%G05 4.77E-07 INIT-%G05 95.7%

INIT-%G06 5.55E-08 INIT-%G06 5.65E-08 INIT-%G06 3.59E-07 INIT-%G06 84.3%

INIT-%G07 8.06E-08 INIT-%G07 8.15E-08 INIT-%G07 2.64E-07 INIT-%G07 69.1%

INIT-%G08 8.97E-08 INIT-%G08 9.04E-08 INIT-%G08 1.88E-07 INIT-%G08 52.0%

INIT-%G09 8.37E-08 INIT-%G09 8.43E-08 INIT-%G09 1.29E-07 INIT-%G09 34.6%

INIT-%G10 2.56E-07 INIT-%G10 2.56E-07 INIT-%G10 3.11E-07 INIT-%G10 17.7%

TOTAL 5.91E-07 TOTAL 5.94E-07 TOTAL 2.42E-06 TOTAL 75.5%

2. The availability of 6 pumps to provide AFW to two units reduced the importance of feed and bleed.

3. With few RAWs above 2 and few SSCs with high FV, the risk profile is relatively balanced for seismic.

Page 146 of 163

PBN-BFJR-17-019 Rev. 1 TTACHMENT G TARGET DAMAGE PROBABILITY G.1 INPUTS and ASSUMPTIONS For a target to be damaged by falling CT debris the following must happen:

1. Truss must be dislodged. Given an overstress condition the probability of CT components dislodging and falling is a function of various factors.

a. Loading Direction. The stress impacting the CT varies with seismic loading direction. In order to determine the maximum seismic capacity of the CT, various loading directions were tested for the seismic model. The critical direction was found to be 10° east of north, midway between a T1 and T2 truss, perpendicular to a set of T2 trusses [Ref. 3]. Since it is not possible to determine a likely seismic loading direction, there is some probability that the loading direction will not be in the most critical direction.

b. Load Redistribution. It is likely that the truss structure, supported at 18 different locations, will exhibit some degree of load redistribution and energy absorption. While the structural evaluation approximately accounts for these effects through the use of ductility and load redistribution factors, their application is limited to a local failure mode that may not result in global instability.

c. Energy Absorbed by CT Components. When the CT is overstressed, the bolted connections, assumed to be the weakest links, will fail randomly due to asymmetrical stresses. Failure of one or more of these connections may relieve sufficient stress to preclude fully dislodging a CT component. This assumes the remaining intact connections continue to support the component.

Given the significant uncertainty and complications in quantifying the impact of all these attributes, a bounding probability of 0.5 is chosen as the likelihood of a 6000 lb. T1 truss, the heaviest truss, fully dislodging and falling. Note that the engineering calculations determined that the construction trusses will retain their structural stability and will not catastrophically fail or result in a seismic II/I interaction (dropped object) as a result of a design basis seismic or thermal event.

The following assumptions are qualitative; based on spatial considerations and attributes of the structures and components below.

2. Truss is NOT deflected from its path to the target by barriers in its path. Assume a bounding probability of 0.5.

3. The closer the target is to the center of the truss the more likely it will be hit. The following probabilities are applied for relative proximity: Center=0.55, quarter=0.33, edge=0.11.

4. There are two types of trusses, T1 and T2. T2 is half the weight of T1. An adjustment of 0.5 is made for robust targets hit by a T2 truss. Robust target is defined as a target that will likely survive a T1 hit. For a non-robust target the probability is 1.0.

5. If a robust target is hit by a truss the probability of damage is conservatively assumed to be 0.5. For a non-robust target the probability is 1.0.

The probabilities developed in the sections that follow apply to both units.

Page 147 of 163

PBN-BFJR-17-019 Rev. 1 G.2 Assessment of MSL A Break Probability MSL A is exposed to 6 trusses, labeled K through P on the illustration below.

The illustration below shows the exposure of the two main steam lines to construction trusses. The shorter trusses, T2, weigh ~ 3000 lbs. and the longer, T1 trusses, weigh ~ 6000lbs. The T1 trusses, optimally oriented, may perforate the 1 inch thick pipe; the T2 will not. A MSL is directly adjacent to one T1 truss and another in close proximity.

Although B MSL has the longest run of pipe, most of the pipe run is in close proximity to the containment wall and protected by the crane rail above. As such MSL B is exposed to one T1 truss.

The fault trees that follow were used to calculate the MSL A break probability based on the rules presented in the previous section.

MSL A Break Probabilities Probability TYPE Assumptions T1 trusses and, to a lesser extent, T2 trusses can damage the MSL. Probability 1.31E-01 Conservative adjusted for proximity to the center of the truss. Probability reduced if barriers are in the path of the truss.

4.1E-02 Realistic Only T1 trusses have the potential to cause damage.

4.3E-01 Bounding All trusses are detached with P=1.0, and result in missiles targeting MSL A Page 148 of 163

PBN-BFJR-17-019 Rev. 1 M ain Steam LIne B is Perforated M SL_B_PERFORATED 1.309E-01 Target Geometry One or more trusses in the adjustment. Large robust vicinity of the target pipe = 0.5. dislodge from the CT structure EFFECTIVE_AREA M SL_B_TARGET_HIT 5.00E-01 2.618E-01 HIT_TRUSS_K HIT_TRUSS_N 6.875E-02 1.375E-02 HIT_TRUSS_L HIT_TRUSS_O 4.125E-02 4.125E-02 HIT_TRUSS_M HIT_TRUSS_P 8.250E-02 6.875E-02 HIT_TRUSS_K HIT_TRUSS_L 6.875E-02 4.125E-02 Bounding value for Truss O T2 TRUSS ADJUSTM ENT Bounding value for Truss L T2 TRUSS ADJUSTM ENT dislodging. for Robust Target dislodging. for Robust Target (T2=0.5T1) (T2=0.5T1)

TRUSS_J_DISLODGES T2_TRUSS TRUSS_L_DISLODGES T2_TRUSS 5.00E-01 5.00E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0.996 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Proximity of target to Truss Barriers in the path of the Proximity of target to Truss falling truss K do not K center. Center=0.55, falling truss L do not deflect L center. Center=0.55, deflect it from the target quarter=0.33, edge=0.11 it from the target quarter=0.33, edge=0.11 TRUSS_K_NOT_DEFLECTEK TARGET_K_EXPOSURK TRUSS_L_NOT_DEFLECTEL TARGET_L_EXPOSURL 5.00E-01 5.50E-01 5.00E-01 3.30E-01 Page 149 of 163

PBN-BFJR-17-019 Rev. 1 HIT_TRUSS_M HIT_TRUSS_N 8.250E-02 1.375E-02 Bounding value for Truss M Proximity of target to Truss Bounding value for Truss N T2 TRUSS ADJUSTM ENT dislodging. M center. Center=0.55, dislodging. for Robust Target quarter=0.33, edge=0.11 (T2=0.5T1)

TRUSS_M _DISLODGES TARGET_M _EXPOSURM TRUSS_N_DISLODGES T2_TRUSS 5.00E-01 3.30E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Barriers in the path of the Proximity of target to Truss falling truss M do not falling truss Ndo not deflect J center. Center=0.55, deflect it from the target it from the target quarter=0.33, edge=0.11 TRUSS_M _NOT_DEFLECTEM TRUSS_N_NOT_DEFLECTEN TARGET_N_EXPOSURN 5.00E-01 5.00E-01 1.10E-01 HIT_TRUSS_O HIT_TRUSS_P 4.125E-02 6.875E-02 Bounding value for Truss O T2 TRUSS ADJUSTM ENT Bounding value for Truss P T2 TRUSS ADJUSTM ENT dislodging. for Robust Target dislodging. for Robust Target (T2=0.5T1) (T2=0.5T1)

TRUSS_O_DISLODGES T2_TRUSS TRUSS_P_DISLODGES T2_TRUSS 5.00E-01 5.00E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0.996 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Proximity of target to Truss Barriers in the path of the Proximity of target to Truss falling truss O do not O center. Center=0.55, falling truss P do not P center. Center=0.55, deflect it from the target quarter=0.33, edge=0.11 deflect it from the target quarter=0.33, edge=0.11 TRUSS_O_NOT_DEFLECTEO TARGET_O_EXPOSURO TRUSS_P_NOT_DEFLECTEP TARGET_P_EXPOSURP 5.00E-01 3.30E-01 5.00E-01 5.50E-01 Page 150 of 163

PBN-BFJR-17-019 Rev. 1 G.3 Assessment of MSL B Break Probability MSL B is exposed to 10 trusses, labeled A through J on the illustration below. The fault trees that follow were used to calculate the MSL B break probability based on the rules presented in the previous section. .

MSL B Break Probability Probability TYPE Assumptions T1 trusses and, to a lesser extent, T2 trusses can damage the MSL. Probability adjusted 1.25E-01 Conservative for proximity to the center of the truss. Probability reduced if barriers are in the path of the truss.

Only T1 trusses have the potential to cause damage. Assume the pipe section along the 4.13E-02 Realistic containment wall is fully protected by the crane rail and its proximity to the wall which limits truss exposure.

4.13E-01 Bounding All trusses are detached, P=1.0, and result in missiles targeting MSL B Page 151 of 163

PBN-BFJR-17-019 Rev. 1 M ain Steam LIne A is Perforated M SL_A_PERFORATED 1.248E-01 Target Geometry One or more trusses in the adjustment. Large robust vicinity of the target pipe = 0.5. dislodge from the CT structure EFFECTIVE_AREA M SL_A_TARGET_HIT 5.00E-01 2.486E-01 HIT_TRUSS_A HIT_TRUSS_F 6.875E-02 1.375E-02 HIT_TRUSS_B HIT_TRUSS_G 8.250E-02 1.375E-02 HIT_TRUSS_C HIT_TRUSS_H 1.375E-02 2.750E-02 HIT_TRUSS_D HIT_TRUSS_I 1.375E-02 1.375E-02 HIT_TRUSS_E HIT_TRUSS_J 2.750E-02 1.375E-02 Page 152 of 163

PBN-BFJR-17-019 Rev. 1 HIT_TRUSS_A HIT_TRUSS_B 6.875E-02 8.250E-02 Bounding value for Truss A T2 TRUSS ADJUSTM ENT Bounding value for Truss B Proximity of target to Truss dislodging. for Robust Target dislodging. B center. Center=0.55, (T2=0.5T1) quarter=0.33, edge=0.11 TRUSS_A_DISLODGES T2_TRUSS TRUSS_B_DISLODGES TARGET_B_EXPOSURE 5.00E-01 5.00E-01 5.00E-01 3.30E-01 Select 2.25 error factor to limit upper range to 0.996 Barriers in the path of the Proximity of target to Truss Barriers in the path of the falling truss A do not A center. Center=0.55, falling truss B do not deflect it from the target quarter=0.33, edge=0.11 deflect it from the target TRUSS_A_NOT_DEFLECTED TARGET_A_EXPOSURE TRUSS_B_NOT_DEFLECTED 5.00E-01 5.50E-01 5.00E-01 HIT_TRUSS_C HIT_TRUSS_D 1.375E-02 1.375E-02 Bounding value for Truss C T2 TRUSS ADJUSTM ENT Bounding value for Truss D T2 TRUSS ADJUSTM ENT dislodging. for Robust Target dislodging. for Robust Target (T2=0.5T1) (T2=0.5T1)

TRUSS_C_DISLODGES T2_TRUSS TRUSS_D_DISLODGES T2_TRUSS 5.00E-01 5.00E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0.996 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Proximity of target to Truss Barriers in the path of the Proximity of target to Truss falling truss C do not C center. Center=0.55, falling truss D do not D center. Center=0.55, deflect it from the target quarter=0.33, edge=0.11 deflect it from the target quarter=0.33, edge=0.11 TRUSS_C_NOT_DEFLECTED TARGET_C_EXPOSURE TRUSS_D_NOT_DEFLECTED TARGET_D_EXPOSURE 5.00E-01 1.10E-01 5.00E-01 1.10E-01 HIT_TRUSS_E HIT_TRUSS_F 2.750E-02 1.375E-02 Bounding value for Truss E Proximity of target to Truss Bounding value for Truss F T2 TRUSS ADJUSTM ENT dislodging. E center. Center=0.55, dislodging. for Robust Target quarter=0.33, edge=0.11 (T2=0.5T1)

TRUSS_E_DISLODGES TARGET_E_EXPOSURE TRUSS_F_DISLODGES T2_TRUSS 5.00E-01 1.10E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Barriers in the path of the Proximity of target to Truss falling truss E do not falling truss F do not F center. Center=0.55, deflect it from the target deflect it from the target quarter=0.33, edge=0.11 TRUSS_E_NOT_DEFLECTEE TRUSS_F_NOT_DEFLECTEF TARGET_F_EXPOSURF 5.00E-01 5.00E-01 1.10E-01 Page 153 of 163

PBN-BFJR-17-019 Rev. 1 HIT_TRUSS_G HIT_TRUSS_H 1.375E-02 2.750E-02 Bounding value for Truss G T2 TRUSS ADJUSTM ENT Bounding value for Truss H Proximity of target to Truss dislodging. for Robust Target dislodging. H center. Center=0.55, (T2=0.5T1) quarter=0.33, edge=0.11 TRUSS_G_DISLODGES T2_TRUSS TRUSS_H_DISLODGES TARGET_H_EXPOSURH 5.00E-01 5.00E-01 5.00E-01 1.10E-01 Select 2.25 error factor to limit upper range to 0.996 Barriers in the path of the Proximity of target to Truss Barriers in the path of the falling truss G do not G center. Center=0.55, falling truss H do not deflect it from the target quarter=0.33, edge=0.11 deflect it from the target TRUSS_G_NOT_DEFLECTEG TARGET_G_EXPOSURG TRUSS_H_NOT_DEFLECTEH 5.00E-01 1.10E-01 5.00E-01 HIT_TRUSS_I HIT_TRUSS_J 1.375E-02 1.375E-02 Bounding value for Truss I T2 TRUSS ADJUSTM ENT Bounding value for Truss O T2 TRUSS ADJUSTM ENT dislodging. for Robust Target dislodging. for Robust Target (T2=0.5T1) (T2=0.5T1)

TRUSS_I_DISLODGES T2_TRUSS TRUSS_J_DISLODGES T2_TRUSS 5.00E-01 5.00E-01 5.00E-01 5.00E-01 Select 2.25 error factor to limit upper range to 0.996 Select 2.25 error factor to limit upper range to 0 Barriers in the path of the Proximity of target to Truss Barriers in the path of the Proximity of target to Truss falling truss I do not deflect I center. Center=0.55, falling truss J do not deflect J center. Center=0.55, it from the target quarter=0.33, edge=0.11 it from the target quarter=0.33, edge=0.11 TRUSS_I_NOT_DEFLECTEI TARGET_I_EXPOSURI TRUSS_J_NOT_DEFLECTEJ TARGET_J_EXPOSURJ 5.00E-01 1.10E-01 5.00E-01 1.10E-01 Page 154 of 163

PBN-BFJR-17-019 Rev. 1 G.4 Assessment of AFW A/B Damage Probability AFW A/B are non-robust targets exposed to 2 trusses each. The fault trees that follow were used to calculate the AFW damage probability based on the rules presented in the previous section.

AFW A/B Break Probability Probability TYPE Assumptions T1/T2 trusses but barriers in their path are effective in deflecting/protecting AFW 1.45E-01 Conservative pipe 7.37E-02 Realistic Barriers are twice as effective in deflecting trusses 6.00E-01 Bounding If all trusses are detached, P=1.0 AFW_A_PERFORATED 1.450E-01 Target Geometry One or more trusses in the adjustment - 3" Pipe vicinity of the AFW piping hits.

SM ALL_PIPE G007 1.00E+00 1.450E-01 Non-truss sections will not perforate the AFW pipe - thickness is 0.216 inches HIT_TRUSS_A1 HIT_TRUSS_A2 1.000E-01 5.000E-02 Bounding value for Truss A1 Barriers in the path of the Bounding value for Truss A2 Barriers in the path of the dislodging. falling truss P do not dislodging. falling truss P do not deflect it from the target deflect it from the target TRUSS_A1_DISLODGES TRUSS_A1_NOT_DEFLECTEP TRUSS_A2_DISLODGES TRUSS_A2_NOT_DEFLECTEP 5.00E-01 2.00E-01 5.00E-01 1.00E-01 Will likely be deflected by M SL above SG Will likely be deflected by M SL above SG as well a Page 155 of 163

PBN-BFJR-17-019 Rev. 1 AFW_B_PERFORATED 1.450E-01 Target Geometry One or more trusses in the adjustment - 3" Pipe vicinity of the AFW piping hits.

SM ALL_PIPE G008 1.00E+00 1.450E-01 Non-truss sections will not perforate the AFW pipe - thickness is 0.216 inches HIT_TRUSS_B1 HIT_TRUSS_B2 5.000E-02 1.000E-01 Bounding value for Truss A1 Barriers in the path of the Bounding value for Truss Barriers in the path of the dislodging. falling truss B1 do not B2 dislodging. falling truss B2 do not deflect it from the target deflect it from the target TRUSS_B1_DISLODGES TRUSS_B1_NOT_DEFLECTEP TRUSS_B2_DISLODGES TRUSS_B2_NOT_DEFLECTEP 5.00E-01 1.00E-01 5.00E-01 2.00E-01 THE TRUSS WILL BE PUSHED AWAY FROM THE TARGET BY THE STEAM GENERATOR Will likely be deflected by M SL above SG and by B2 A2 B1 AFW A

A1 The following drawings illustrate the layout of the AFW pipes.

Page 156 of 163

PBN-BFJR-17-019 Rev. 1 AFW B AFW B AFW A AFW A AFW A AFW B Page 157 of 163

PBN-BFJR-17-019 Rev. 1 G.5 IN-CORE INSTRUMENTATION SEAL TABLE The deck plate over top of the seal table at EL 66 is a non-robust target exposed to 2 trusses as well as several bolted truss components. The deck plate is sufficiently robust to not be damaged by falling CT bolted components - the heaviest would be roughly 500 lbs [Ref 3]. The trusses will damage and perforate the seal table if the trusses strike the table in an orientation that maximizes energy, point A, B and C. These orientations will likely allow the truss, along with the damaged deck plate, to contact the frame above the seal table and then proceed to damage the seal table; which may compromise some of the seals and result in a very small or small LOCA. The deck plate and opening are roughly 6 x 6 so other truss orientations will likely not damage the seal table or allow the truss to pass through. Refer to section 3.3.1 in the Target Assessment [Ref 3] for additional detail.

SEAL TABLE DAMAGE PROBABILITY Probability TYPE Assumptions Overhead trusses fall but barriers in their path likely deflecting/protecting deck 3.22E-02 Conservative plate from damage.

Low probability that trusses will be oriented in a way to damage deck plate or if 9.75E-03 Realistic damaged to result in a break larger than a very small LOCA 3.30E-01 Bounding If all trusses are detached, P=1.0, and barriers do not deflect trusses The representative fault tree is shown below. The resulting damage probability is 3.22E-02.

Page 158 of 163

PBN-BFJR-17-019 Rev. 1 S1 S2 DECK PLATE Page 159 of 163

PBN-BFJR-17-019 Rev. 1 The fault tree below was used to develop seal table damage probabilities.

SEAL TABLE DAM AGED SEAL_TABLE 3.218E-02 G019 NON_ROBUST_TARGET 3.218E-02 1.00E+00 HIT_TRUSS_S1 HIT_TRUSS_S2 1.650E-02 1.650E-02 Bounding value for Truss A2 Bounding value for Truss A2 dislodging. dislodging.

TRUSS_S1_DISLODGES ORIENTATION TRUSS_S2_DISLODGES ORIENTATION 5.00E-01 3.30E-01 5.00E-01 3.30E-01 BASIS: TARGET NB SEC 3.3.1.2 BASIS: TARGET NB SEC 3.3.1.2 Barriers in the path of the Barriers in the path of the falling truss P do not falling truss P do not deflect it from the target deflect it from the target TRUSS_S1_NOT_DEFLECTEP TRUSS_S2_NOT_DEFLECTEP 1.00E-01 1.00E-01 Will likely be deflected by M SL above SG as well as SG. Will likely be deflected by M SL above SG as well as SG.

Page 160 of 163

PBN-BFJR-17-019 Rev. 1 ATTACHMENT H External Hazards Screening TABLE H.1 External Hazards Screening Screening Result Screened Screening External Hazard

? Criterion Comment (Y/N) [SEE TABLE I.2]

Screened based on low probability of aircraft crash and small Aircraft Impact Y PS4 target size of SR structures.

Excluded due to site topography that would not support snow Avalanche Y C3 buildup that would lead to an avalanche.

Biological Event - Animal C4 Included implicitly in LOOP initiator.

Y Infestation C5 Slow developing with limited impact.

C1 Organic Material in Water is a more credible scenario to cause Biological Event - Aquatic Y C3 intake blockage than normal aquatic growth.

Grown Slow developing hazard, can be detected and managed.

C5 Biological Event - Organic C3 Y Slow developing hazard, can be detected and managed.

Material in Water C5 Coastal Erosion Y C3 Excluded based on design of plant.

Excluded since the capacity of the Ultimate Heat Sink (UHS) is not Drought Y C3 impacted by drought.

The external flooding hazard at the site was recently evaluated as a result of the post-Fukushima 50.54(f) Request for Information and the flood hazard reevaluation report (FHRR) was submitted to NRC for review on March 12, 2015. The results indicate that Y flooding from all hazards, except local intense precipitation, are bounded by the current licensing basis (CLB) and do not pose a External Flooding C1 see challenge to the plant. Flooding from local intense precipitation comments was subsequently evaluated. Point Beach's focused evaluation and Mitigating Strategies Assessment (MSA) for flooding conclude that the current station procedures for implementing the FLEX strategy provide an acceptable method of assuring safe shutdown.

The High Winds hazard was originally screened from applicability in the IPEEE. This conclusion is consistent with screening criteria in section 6-2 of the ASME/ANS RA-Sa 2009. Significant plant Extreme Wind or Tornado Y n/a modifications installed since the IPEEE will lower the High Winds CDF; therefore screening this hazard from applicability based on the IPEEE is judged to be conservative.

Fog and mist may increase the frequency of accidents involving aircraft, ships, or vehicles. This weather condition is included Fog Y C4 implicitly in the accident rate data for these Transportation Accidents.

C1 Included implicitly in LOOP initiator. Forest & grass are C3 Forest or Range Fire Y somewhat distant from the plant with no immediate impact on C4 equipment.

C5 Frost Y C4 Included implicitly in weather-related LOOP.

C1 Building design for high wind and missiles is bounding. Included Hail Y C4 implicitly in weather-related LOOP initiator.

High Summer Temperature - C1 Plant AC ventilation is designed for extreme heat load. Slow Y

Air C5 developing hazard, can be detected and managed.

Page 161 of 163

PBN-BFJR-17-019 Rev. 1 TABLE H.1 External Hazards Screening Screening Result Screened Screening External Hazard

? Criterion Comment (Y/N) [SEE TABLE I.2]

High Summer Temperature - C1 Plant is designed for extreme high Lake Michigan temperature.

Y Water C5 Slow developing hazard, can be detected and managed.

High Tide and River Stage hazards are not applicable to Point High Tide, Lake Level, or C3 Beach since Point Beach is not located on an ocean or a river.

Y River Stage C4 Lake Level hazard is included in External Flooding PRA documented in IPEEE.

Not applicable to Point Beach since Point Beach is not located in a Hurricane Y C3 Hurricane zone.

Ice Cover Y C4 Included implicitly in weather-related LOOP.

There are no industrial or military facilities in the vicinity of Point Beach Nuclear Plant which would cause: 1) pressure wave that Industrial or Military Facility C1 Y would fail a SR structure, 2) sufficient ground vibration for relay Accident C3 chatter, 3) control room habitability issues, or 4) chemical release into the water sufficient to impact the UHS Internal Flooding N n/a Internal Flooding PRA documented in PRA Notebook.

Internal Fire N n/a Internal Fire PRA documented in PRA Notebooks.

Excluded due to site topography that would not support landslide Landslide Y C3 of any significance.

Included implicitly in weather-related LOOP.

C1 Lightning Y The plant grounding system provides protection to emergency AC C4 power to reduce the likelihood of lightning-induced failure.

Excluded based on location of intake which is approximately 22 Low Lake Level or River Stage Y C3 feet below the surface of Lake Michigan.

Low Winter Temperature - C1 Seasonal Readiness process prepares site for reliable operation Y

Air C5 sustained cold weather periods.

Low Winter Temperature - C1 Excluded based on location of intake which is approximately 22 Y

Water C3 feet below the surface of Lake Michigan.

Conservative bounding assessment shows that these events can PS4 be screened. Extremely unlikely for satellite debris of any Meteorite or Satellite Impact Y C2 significant size to hit the site. Any such strike would be localized and not expected to cause direct core damage.

Pipeline Accident Y C3 There are no pipelines in the vicinity of Point Beach Nuclear Plant.

Release of Chemicals in There are no hazardous chemicals on or near the site which Y C1 Onsite Storage would cause control room habitability issues.

River Diversion Y C3 Excluded since UHS does not depend on a river.

C1 Plant equipment is protected from or designed to preclude Sand or Dust Storm Y C3 foreign material.

Seiche N n/a Included in External Flooding PRA documented in IPEEE.

Seismic margins analysis (SMA) performed for the Individual Plant Seismic Activity N n/a Evaluation-External Events (IPEEE).

C1 Plant design includes snow loads and other bounding loads.

Snow Y C4 Included implicitly in weather-related LOOP initiator.

C5 Soil Shrink-Swell Excluded based on structures founded on bedrock and/or Y C3 Consolidation engineered fill.

Storm Surge N n/a Included in External Flooding PRA documented in IPEEE.

There are no hazardous chemicals on or near the site which Toxic Gas Y C3 would cause control room habitability issues.

Page 162 of 163

PBN-BFJR-17-019 Rev. 1 TABLE H.1 External Hazards Screening Screening Result Screened Screening External Hazard

? Criterion Comment (Y/N) [SEE TABLE I.2]

C1 C2 Conservative bounding assessment shows that these events can Transportation Accident Y C3 be screened.

C4 Not applicable to Point Beach since Point Beach is not located on Tsunami Y C3 an ocean.

Screened based on low probability of turbine wheel failure and Turbine-Generated Missiles Y PS4 low probability of missile impacting safety-related equipment.

C3 Volcanic Activity Y Excluded due to distance from nearest potentially active volcano.

C5 Waves N n/a Included in External Flooding PRA documented in IPEEE.

TABLE H.2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Initial Preliminary C1. Event damage potential is < events for which plant is NUREG/CR-2300 and ASME/ANS Screening designed. Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse NUREG/CR-2300 and ASME/ANS consequences than other events analyzed. Standard RA-Sa-2009 NUREG/CR-2300 and ASME/ANS C3. Event cannot occur close enough to the plant to affect it. Standard RA-Sa-2009 NUREG/CR-2300 and ASME/ANS C4. Event is included in the definition of another event. Standard RA-Sa-2009 C5. Event develops slowly, allowing adequate time to eliminate ASME/ANS Standard or mitigate the threat.

Progressive PS1. Design basis hazard cannot cause a core damage accident. ASME/ANS Standard RA-Sa-2009 Screening PS2. Design basis for the event meets the criteria in the NRC NUREG-1407 and ASME/ANS 1975 Standard Review Plan (SRP). Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the NUREG-1407 as modified in mean conditional core damage probability is < 0.1. ASME/ANS Standard RA-Sa-2009 NUREG-1407 and ASME/ANS PS4. Bounding mean CDF is < 1E-6/y. Standard RA-Sa-2009 Screening not successful. PRA needs to meet requirements in NUREG-1407 and ASME/ANS Detailed PRA Standard RA-Sa-2009 the ASME/ANS PRA Standard.

Page 163 of 163