RA-18-0178, Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for ...

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (Sscs) for ...

ML18306A523
Person / Time
Site:	Brunswick
Issue date:	11/02/2018
From:	Donahue J Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RA-18-0178
Download: ML18306A523 (119)

Text

Joseph Donahue Vice President Nuclear Engineering 526 South Church Street, EC-07H Charlotte, NC 28202 980-373-1758 Joseph.Donahue@duke-energy.com 10 CFR 50.90 November 2, 2018 Serial: RA-18-0178 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Renewed Facility Operating License Nos. DPR-71 and DPR-62 Docket Nos. 50-325 and 50-324

Subject:

Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors

References:

1. Duke Energy letter, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors, dated January 10, 2018 (ADAMS Accession No. ML18010A344).

2. NRC letter, Requests for Additional Information Related to License Amendment Request to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors, dated October 9, 2018 (ADAMS Accession No. ML18282A149).

Ladies and Gentlemen:

By letter dated January 10, 2018 (Reference 1), Duke Energy Progress, LLC (Duke Energy) submitted a license amendment request (LAR) for Brunswick Steam Electric Plant (BSEP), Unit Nos. 1 and 2. The proposed amendment would modify the licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power reactors.

By letter dated October 9, 2018 (Reference 2), the Nuclear Regulatory Commission (NRC) staff requested additional information from Duke Energy that is needed to complete the LAR review.

The enclosure to this letter provides Duke Energys response to the NRC RAI. Attachment 1 contains a PRA implementation item which must be completed prior to implementation of 10 CFR 50.69 at BSEP. Attachment 2 contains proposed markups of the BSEP Renewed Facility Operating License for both Units 1 and 2. Attachment 3 contains a supplement to Reference 1 with updated BSEP high winds PRA core damage frequency (CDF) and large early release frequency (LERF) values.

U.S. Nuclear Regulatory Commission Page2 Serial RA-18-0178 The conclusions of the original No Significant Hazards Consideration and Environmental Consideration in the original LAR are unaffected by this RAI response.

There are no regulatory commitments contained in this letter.

In accordance with 10 CFR 50.91, Duke Energy is notifying the State of North Carolina of this LAR by transmitting a copy of this letter and enclosure to the designated State Official.

Should you have any questions concerning this letter and its enclosure, or require additional information, please contact Art Zaremba at (980) 373-2062.

I declare under penalty of perjury that the foregoing is true and correct. Executed on November 2, 2018.

Sincerely,

~~ u~

Vice President - Nuclear Engineering JLV

Enclosure:

Response to NRC Request for Additional Information cc: Ms. C. Haney, NRC Regional Administrator, Region II Mr. D. J. Galvin, NRC Project Manager, BNP Mr. G. Smith , NRC Sr. Resident Inspector, BNP Mr. W . L. Cox, Il l, Section Chief, N.C. DHSR (Electronic Copy Only)

Chair - North Carolina Utilities Commission (Electronic Copy Only)

Serial: RA-18-0178 Brunswick Steam Electric Plant, Units 1 and 2 Docket Nos. 50-325 and 50-324 / Renewed License Nos. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Enclosure Response to NRC Request for Additional Information

U.S. Nuclear Regulatory Commission Page 2 of 108 Serial RA-18-0178 Enclosure NRC Request for Additional Information By letter dated January 10, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18010A344), Duke Energy Progress, LLC, (Duke Energy, the licensee), submitted a license amendment request (LAR) for Brunswick Steam Electric Plant (BSEP), Units 1 and 2. The proposed amendment would modify the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR),

Section 50.69, Risk-informed categorization and treatment of structures, systems, and components for nuclear power plants, and provide the ability to use probabilistic risk assessment (PRA) models, namely the internal events PRA, internal flooding PRA (IFPRA),

internal fire PRA (FPRA), high winds PRA (HW PRA), and external flooding PRA (XF PRA) for the proposed 10 CFR 50.69 categorization process.

Regulatory Guide (RG) 1.201, Revision 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance, May 2006 (ADAMS Accession No. ML061090627), endorses, with regulatory positions and clarifications, the Nuclear Energy Institute (NEI) guidance document NEI 00-04, Revision 0, 10 CFR 50.69 SSC [Structure, System, and Component] Categorization Guideline, July 2005 (ADAMS accession No. ML052910035), as one acceptable method for use in complying with the requirements in 10 CFR 50.69. Both RG 1.201 and NEI 00-04 cite RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, February 2004 (ADAMS Accession No. ML040630078), which endorses industry consensus PRA standards, as the basis against which peer reviews evaluate the technical acceptability of a PRA. Revision 2 of RG 1.200 issued March 2009 is available at ADAMS Accession No. ML090410014.

Section 3.1.1 of the LAR states that Duke Energy will implement the risk categorization process of 10 CFR 50.69 in accordance with NEI 00-04, Revision 0, as endorsed by RG 1.201.

However, the licensees LAR does not contain enough information for the U.S. Nuclear Regulatory Commission (NRC) staff to determine if the licensee has implemented the guidance appropriately in NEI 00-04, as endorsed by RG 1.201, as a means to demonstrate compliance with all of the requirements in 10 CFR 50.69, including technical adequacy of the PRA models.

The NRC staff requests additional information (RAI) for the following areas in order to complete its assessment.

U.S. Nuclear Regulatory Commission Page 3 of 108 Serial RA-18-0178 Enclosure PRA RAI 1 - Open/Partially Open Findings in the Process of Being Resolved:

Section 4.2 of RG 1.200 states, in part, that the LAR should include:

A discussion of the resolution of the peer review facts and observations (F&Os) that are applicable to the parts of the PRA required for the application. This discussion should take the following forms:

• A discussion of how the PRA model has been changed, and

• A justification in the form of a sensitivity study that demonstrates the accident sequences or contributors significant to the application decision were not adversely impacted (remained the same) by the particular issue. of the LAR, Disposition and Resolution of Open Peer Review Finding and Self-Assessment Open Items, provides F&Os and self-assessment findings that are still open or partially resolved following the August 2017 F&O closure review. Also, F&O descriptions and their dispositions were previously provided to the NRC in the LAR dated December 21, 2015 (ADAMS Accession No. ML16004A249) to adopt Technical Specification Task Force (TSTF)-

425, Relocate Surveillance Frequencies to Licensee Control - Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b (ADAMS Accession No. ML12285A428) to adopt National Fire Protection Association Standard 805. For a number of F&O dispositions, there is insufficient information for NRC staff to conclude that the F&O is sufficiently resolved for this application.

a. Internal events F&O 1-19 pertaining to component failure data. This F&O description states that the component failure data values documented in BNP-PSA-049 were developed during a previous PRA update and that some values may need to be updated to be consistent with changes in the Level 1 PRA data. The licensees disposition states that [o]nly 4 events were found and all of them had either a [Fussell-Vesely (FV)] in the x10-3 range or a [Risk Achievement Worth (RAW)] of 1. Because of the small number of events that could have a need to be updated but were not, the relatively low value of FV for three of the retained events, and the relatively low RAW value on the remaining event, the effect on 50.69 applications is negligible. The response does not clarify how it was determined what events might need to be updated, only that there were four events identified. Furthermore, the SSC will be low safety significant (LSS) if the RAW<2 AND the FV<0.005, but the conclusion that updates were not needed seems to be based on the argument the RAW OR the FV is low.

1. Clarify how the check was performed to determine if any data needed to be updated including how the conclusion was reached that only 4 events were found.

2. Provide the RAW and FV of the four events, and some indication of the change in the failure likelihood expected from a data update. Based on the data provided, indicate the expected changes to the RAW and FV values.

3. Alternatively, propose a mechanism that ensures F&O 1-19 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should

U.S. Nuclear Regulatory Commission Page 4 of 108 Serial RA-18-0178 Enclosure also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

Duke Energy Response to PRA RAI 1.a.:

Importance measure reports were generated from the Unit 1 and Unit 2 LERF cutsets. Basic events representing component failures in the LERF model were identified. Basic events that were quantified based on component failure rates were retained. This left the following four events.

Unit Event Description Probability FV RAW 1 CZN1PHE-NO- INDUCED INTERFACING 2.16E-04 4.61E-03 22.3 ILOCA SYSTEM LOCA HSS 1 SPN1VBV-CO-SRV- SRV DISCHARGE 0.1 5.60E-03 1.05

- VACUUM BREAKERS HSS FAIL OPEN 2 CZN2PHE-NO- INDUCED INTERFACING 2.16E-04 4.51E-03 21.9 ILOCA SYSTEM LOCA HSS 2 SPN2VBV-CO-SRV- SRV DISCHARGE 0.1 5.45E-03 1.05

- VACUUM BREAKERS HSS FAIL OPEN Expected change in failure probabilities and importance values given a data update.

Unit Event Updated Data Source Updated Updated Probability FV RAW 1 CZN1PHE-NO- 6.28E-05 Calculation of 8.78E-04 22.4 ILOCA undeveloped event HSS probability updated to use latest generic value for check valve fails to close from NUREG 6928, 2015 data update.

(See Table C.6.7-2, Note 2 of BNP-PSA-049 for applicable equation.)

1 SPN1VBV-CO- 0.1 NUREG-1150 value 5.62E-03 1.05 SRV-- retained due to HSS uncertainty in the number of times the SRV tailpipe vacuum breakers would cycle during modeled accidents.

U.S. Nuclear Regulatory Commission Page 5 of 108 Serial RA-18-0178 Enclosure 2 CZN2PHE-NO- 6.28E-05 Same as for CZN1PHE- 8.59E-04 21.9 ILOCA NO-ILOCA. HSS 2 SPN2VBV-CO- 0.1 Same as for SPN1VBV- 5.47E-03 1.05 SRV-- CO-SRV--. HSS Thus, after updating the component failure rate data, there is no change in the categorization results.

b. Internal events F&O 3-6 pertaining to human reliability analysis (HRA). This F&O description notes a specific issue related to the HRA calculation for event OPER-DCDG, specifically, no execution failure probabilities were assigned to the tasks of starting and connecting the diesel generator (DG). Additionally, the calculation may not have considered all of the necessary breaker manipulations. The licensees resolution states that the standard is met and this is an opportunity for enhancement to the documentation and does not affect the core damage frequency (CDF) or the risk metrics. However, the licensees resolution did not directly address this specific issue, which does not appear to be just a documentation issue. Explain how the finding concerning OPER-DCDG was resolved and clarify if the model of record (MOR) has been updated to incorporate this resolution.

Duke Energy Response to PRA RAI 1.b.:

The plant no longer relies on the SAMA DG to supply power to the battery chargers. Basic event OPER-DCDG has been deleted from the internal events model.

c. Internal flooding F&O IFSN-A8 pertaining to the effects of expansion joint failures. The F&O description notes that no propagation from gaskets or expansion joints was modeled in the IFPRA. The licensees disposition states that the circulating expansion joints are not risk significant to the BSEP IFPRA risk as circulating water piping does not contribute a significant amount to CDF/large early release frequency (LERF) and circulating water expansion joint ruptures represent a small portion of the total rupture frequency for IFPRA.

Although this modeling exclusion may have a small impact on the total risk, its inclusion could potentially increase the risk importance values for certain system components above the threshold criteria for determining high safety significance (HSS).

1. Justify that the circulating expansion joint modeling exclusion above does not impact the results of the 10 CFR 50.69 categorization process.

2. Alternatively, propose a mechanism that ensures F&O IFSN-A8 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

U.S. Nuclear Regulatory Commission Page 6 of 108 Serial RA-18-0178 Enclosure Duke Energy Response to PRA RAI 1.c.:

The lack of expansion joint modeling will not impact the importance values generated for components. The expansion joints are located in pits in the Turbine Building. If an expansion joint were to rupture, the level in the corresponding pit would rapidly increase. Level sensors in these pits would then trip the CWIPs, which would cause a plant trip. Floor drains within these pits are sealed. Plant design features would prevent gravity flow of water into the Turbine Building once the plant and the pumps trip. Based on this the rupture of the expansion joints would be a self-extinguishing event that is contained within the condenser pits. As there is no additional consequence from the expansion joint rupture, this event is already represented by the internal events model and additional consideration in the IFPRA is not needed.

In addition the probability of flooding from expansion joint failure and subsequent failure of the level switches to trip the CW pumps has been evaluated and found to be a sufficiently low probability of occurrence that it can be screened out per the criteria of IE-C6. Each unit has twelve circulating water expansion joints. This represents a probability of 1.46E-04 (from EPRI TR 3002000079) per year risk of rupture. Assuming a conservative failure probability of 0.01 for the hardware failure of the level switches and an additional 0.1 for the failure of the operators to isolate the flood or trip the unit in a timely manner, the initiating event probability for this scenario is 1.46E-07. This initiating event would not impact safety systems or mitigating systems within the Auxiliary Building. Flooding would be contained to only the Turbine Building.

As no mitigating systems would be impacted by the flood, BNP would have the entire complement of mitigating systems (two or more) for initiating event or accident mitigation. This initiating event probability meets the criteria for exclusion from the IFPRA model per supporting requirement IE-C6 part b of the AMSE/ANS PRA Standard and therefore does not need to be further considered.

U.S. Nuclear Regulatory Commission Page 7 of 108 Serial RA-18-0178 Enclosure

d. Internal events F&O QU-C2-1 pertaining to human reliability analysis. The F&O description indicates that some joint human failure events (JHFEs) may be assigned a floor value of 1E-6, and suggested that these cutsets be evaluated to determine the appropriateness of this value. In contrast, the reported disposition states in examining the top 95% cutsets, there were some cutsets with 5 and 6 human error probabilities (HEP) events that were not explicitly analyzed for dependencies. It is not clear whether not explicitly analyzed means the floor value was assigned, or there was no justification of a result that was less than a floor value.

For performing HRA dependency analysis, NUREG-1921, EPRI [Electric Power Research Institute]/NRC-RES Fire Human Reliability Analysis Guidelines - Final Report, July 2012 (ADAMS Accession No. ML12216A104), discusses the need to consider a minimum value for the joint probability of multiple HFEs, and refers to NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), April 2005 (ADAMS Accession No. ML051160213) (Table 2-1), which recommends joint human error probability (JHEP) values should not be below 1E-5. Table 4-3 of EPRI Technical Report 1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, October 2010, provides a lower limiting value of 1E-6 for sequences with a very low level of dependence.

Therefore, the available guidance provides for assigning joint HEPs that are less than a minimum value but only through assigning proper levels of dependency. Cutsets with JHEP values less than the minimum value should be individually reviewed for timing, cues, etc. to check the dependency between all the operator actions in the cutset.

Consistent with the guidance, please confirm that, for JHEP values below 1E-5 in the FPRA models, and for JHEP values below 1E-6 in the internal events PRA, the justification for these values have been documented.

Duke Energy Response to PRA RAI 1.d.:

The probability associated with JHFEs is determined by examining the context of the cutsets in which they occur. This is done in each case by laying out a time line for the sequence of events of interest, and by qualitatively considering the factors that imply dependence or independence for the combined events. For cases in which there are more than two events, this entails considering the level of dependence between the first two events, and then the conditional level of dependence for successive events given failure of the preceding events.

In the Fire PRA, there are 35 JHEP values below 1E-5; 25 are set at the floor value of 1E-6 and the other 10 range in value between 1E-6 and 1E-5. For JHEP values below 1E-5, the justification for these values have been documented. The degree of dependence is evaluated by considering:

• whether the same actions are performed

• relative timing between actions

• similarity of cues

• whether the accident sequence includes an intervening success.

In the internal events PRA, there are no JHEP values below the floor of 1E-6.

U.S. Nuclear Regulatory Commission Page 8 of 108 Serial RA-18-0178 Enclosure

e. Internal flooding F&O IFEV-A5 pertaining to internal flood pipe break frequencies. The F&O description states that a new methodology was applied to use pipe length, and flood and major flood frequency based on diameter and flow rate and that the analysis only applied major flood frequencies to large pipe, omitting flood frequency from large pipe which is the dominant frequency. In addition, the description notes that the break frequencies used in the calculation are applied incorrectly in the analysis. The licensees disposition states that since the flooding frequency data in the calculation and the EPRI data have different pipe size breakpoints, the pipe size intervals were adjusted to match. The corresponding frequencies were then adjusted by the ratio of new EPRI flood and major flood frequency to existing major flood frequency. The appropriate multiplier was then applied to each scenario based on pipe size and fluid system type. The licensee disposition does not address the use of a new method or the incorrect application of the break frequencies.

The ASME/ANS RA-Sa-2009 Standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences.

Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard. Provide the following:

1. A description of the proposed methodology and basis for determining the internal flood scenario initiating event frequencies. Include in this discussion the reference(s) for the methodology. If the methodology is modified from that described in the reference(s),

include a summary of how the information and values in the reference is modified into the values used in the PRA.

2. A discussion about how the new method is expected to affect the repair and replacement categorization methodology (passive categorization) summarized in the LAR.

3. A discussion on whether the methodology used constitutes a PRA upgrade as defined in the PRA Standard (i.e., ANSME/ANS RA-Sa-2009), as endorsed by RG 1.200. If the new method is expected to affect the passive categorization methodology and the use of the methodology is considered a PRA upgrade, then propose a mechanism to ensure that a focused-scope peer review of the upgrade and the disposition of any resulting F&Os to meet Capability Category II will be completed prior to implementing the 10 CFR 50.69 categorization process.

Duke Energy Response to PRA RAI 1.e.:

The updated pipe rupture frequencies are not based on a new methodology. The original frequencies were from an older revision of the EPRI Pipe Rupture Frequencies technical report.

These were updated to the (at the time) newest revision of the EPRI pipe rupture frequencies (TR 3002000079). They were updated by taking the ratio of the old and new EPRI frequencies.

This ratio was then applied to the original BNP IFPRA rupture frequencies for a given scenario.

This does not represent a change in methodology, scope, or capability or impact the significant accident sequences or the significant accident progression sequences as defined in Appendix 1-A of the ASME/ANS PRA Standard as it is a generic data update from an updated version of the original source.

U.S. Nuclear Regulatory Commission Page 9 of 108 Serial RA-18-0178 Enclosure Implementation of this method will not affect the passive categorization methodology summarized in the LAR. The passive categorization methodology assumes postulated pressure boundary failures have a failure probability of 1.0, thus the pipe rupture frequency is not used in the analysis.

f. Fire F&O 1-34 pertaining to fire barrier failure probabilities. The F&O description notes that a screening value for rated barrier probability of 1E-2 was applied in the PRA and that this value may not be bounding depending on the features of the barrier. The licensees disposition states that the 0.1 barrier failure probability was inappropriately applied for certain fire compartment combinations where the partitioning element was open and that it is expected to have no more than a minimal impact on the 50.69 application. Although this incorrect modeling may have a small impact on the total risk, it could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS. Provide the following:

1. A justification that use of the incorrect fire barrier failure probability exclusion cited above does not impact the results of the 10 CFR 50.69 categorization process.

2. Alternatively, propose a mechanism that ensures F&O 1-34 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve this issue.

Duke Energy Response to PRA RAI 1.f.:

F&O 1-34 has been resolved in the BNP Fire model. To correct this issue, the appropriate fire barrier failure probabilities have been applied. Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The results of this review have been documented and are available for NRC audit.

g. Internal fire F&O 4-1 pertaining to fire severity factors. The licensees disposition states that the treatment of motor control centers (MCCs) is not in accordance with FAQ 14-0009, Treatment of Well Sealed MCC Electrical Panels Greater than 440V, October 2014 (ADAMS Accession No. ML15118A810), and that in lieu of an accepted generic method, BSEP used the analysis method piloted at HNP [Harris Nuclear Plant], but that the impact on the 50.69 application is expected to be small. However, though this modeling may have a small impact on the total risk, its inclusion could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS.

1. Justify that the modeling of MCCs cited above as opposed to using the accepted FAQ 14-0009 modeling does not impact the results of the 10 CFR 50.69 categorization process.

2. Alternatively, propose a mechanism that ensures F&O 4-1 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should

U.S. Nuclear Regulatory Commission Page 10 of 108 Serial RA-18-0178 Enclosure also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 1.g.:

F&O 4-1 has been resolved in the BNP Fire model. To correct this issue, the cabinet breaching factor was updated to 0.23 to comply with FAQ-14-0009. Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The results of this review have been documented and are available for NRC audit.

h. Internal fire F&O 6-4 pertaining to fire barrier failure for multi-compartment analysis. The F&O description describes issues with calculating failure probability of passive fire barriers in the multi-compartment analysis. The disposition is incomplete and, as a result, the NRC staff is unable to assess the disposition to this F&O and the licensees conclusion that is has no more than a minimal impact.

1. Clarify the disposition of this F&O.

2. If the disposition does not update the FPRA to resolve the F&O and meet Capability Category II for Supporting Requirement FSS-G4, provide justification that the resolution does not impact the results of the 10 CFR 50.69 categorization process. [The NRC staff notes that a small impact on the total risk could potentially increase the risk importance values for certain system components above the threshold criteria for determining HSS.]

3. Alternatively, propose a mechanism that ensures F&O 6-4 will be resolved prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also provide an explicit description of changes that will be made to the PRA model or documentation to resolve the issue.

Duke Energy Response to PRA RAI 1.h.:

F&O 6-4 has been resolved in the BNP Fire model. As described in the LAR, the finding was that the fire barrier failure rates used in the BNP Fire model are those prescribed in NUREG-6850, however, the worst-case value for failure probability of the barrier was used. To correct this issue, the summed fire barrier failure probabilities are applied, rather than the worst case (as was previously in the model). Additionally, this resolved finding was reviewed and closed in October 2018 for the BSEP Internal Fire model using the process documented in Appendix X to NEI 05-04, NEI 07-12 and NEI 12-13, "Close-out of Facts and Observations" (F&Os) as accepted by NRC in the letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The results of this review have been documented and are available for NRC audit.

PRA RAI 2 - Qualitative Function Categorization:

Table 3-1 of the LAR indicates that the evaluation of the seven qualitative criteria defined in Section 9.2 of NEI 00-04 is performed at the function level and prior to the Integrated Decision-making Panel (IDP). The LAR states that NEI 00-04 only requires the seven qualitative criteria

U.S. Nuclear Regulatory Commission Page 11 of 108 Serial RA-18-0178 Enclosure to be completed for components/functions categorized as LSS. Table 3-1 of the LAR contains the entry Allowable at the intersection of the IDP change HSS to LSS column and Qualitative Criteria row, which appears to contradict the premise that the seven criteria are only applied to LSS functions. The guidance in NEI 00-04 states that the IDP should consider the impact of loss of function/SSC against the remaining capability to perform the basic safety functions. Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS including a clarification of the Allowed entry in LAR Table 3-1and confirm that a negative answer to any of the seven questions would result in the function/SSC to be categorized as HSS.

Duke Energy Response to PRA RAI 2:

The assessments of the qualitative considerations are agreed upon by the Integrated Decision-making Panel (IDP) in accordance with NEI 00-04 Section 9.2. It is generally expected that a 50.69 categorization team will provide preliminary assessments of the seven considerations for the IDPs consideration, however this is not a requirement and the final assessments of the seven considerations are the direct responsibility of the IDP.

In cases where the 50.69 categorization team provides a preliminary assessment of the seven qualitative considerations to the IDP, the seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) that consideration.

If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS.

Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e. all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

PRA RAI 3 - Passive Component Categorization Process:

Section 3.1.2 of the LAR states that passive components and the passive function of active components will be evaluated using the method for risk-informed repair/replacement activities consistent with the safety evaluation issued by the Office of Nuclear Reactor Regulation, Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10-Year In-service Inspection Intervals, for Arkansas Nuclear One, Unit 2 (ANO-2), dated April 22, 2009 (ADAMS Accession No. ML090930246).

The LAR further states that this methodology will be applied to determine the safety significance of Class 1 SSCs.

U.S. Nuclear Regulatory Commission Page 12 of 108 Serial RA-18-0178 Enclosure This methodology has only been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequences of pressure boundary failure for Class 1 SSCs may be different from Class 2 and Class 3 SSCs and, therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

The LAR does not justify how the ANO-2 methodology can be applied to Class 1 SSCs and how sufficient defense-in-depth and safety margins are maintained. A technical justification for Class 1 SSCs should address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: (1) justification of the appropriateness of the numerical criteria for conditional core damage probability (CCDP) and conditional large early release probability (CLERP), used to assign High, Medium, and Low safety significance to these loss-of-coolant initiating events; (2) identification and justification of the adequacy of the additional qualitative considerations to assign Medium safety significance (based on the CCDP and CLERP) to High safety significance; (3) justification for crediting operator actions for success and failure of pressure boundary; (4) guidelines and justification for selecting the appropriate break size (e.g., double-ended guillotine break or smaller break); and (5) include supporting examples of types of Class 1 SSCs that would be assigned low safety significance, etc.

As mentioned in the March 13, 2018, meeting summary for the February 20, 2018, Risk-Informed Steering Committee (RISC) meeting (ADAMS Accession No. ML18072A301), the NRC staff understands that the industry is planning to limit the scope to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle Electric Generating Plant, Units 1 and 2, license amendment dated December 17, 2014 (ADAMS Accession No. ML14237A034).

Provide the requested technical justification or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 equipment.

Duke Energy Response to PRA RAI 3:

The passive categorization process is intended to apply the same risk-informed process accepted by the NRC in the ANO2-R&R-004 for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N-660 and N-662 as published in Regulatory Guide 1.147, Revision 15. Both code cases employ a similar risk-informed safety classification of SSCs in order to change the repair/ replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned high safety-significant, HSS, for passive categorization which will result in HSS for its risk-informed safety classification. This classification cannot be changed by the IDP.

U.S. Nuclear Regulatory Commission Page 13 of 108 Serial RA-18-0178 Enclosure PRA RAI 4 - Identifying Key Assumptions and Uncertainties that could impact the Application:

Section 3.2.7 of the LAR states that the detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009 (Revision 0) (ADAMS Accession No. ML090970525), and Section 3.1.1 of EPRI Technical Report (TR)-1016737. The NRC staff notes that one of these sources has been superseded by a revision (Revision 1 of NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, March 2017 (ADAMS Accession No. ML17062A466), which references the updated EPRI guidance TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (2012)). of the LAR, Disposition of Key Assumptions/Sources of Uncertainty, contains nine assumptions/uncertainties from five PRA models, whereas industry guidance documents such as NUREG-1855, Revision 1, and EPRI TR-1026511 address a large number of potential assumptions and uncertainties. For example, one fire modeling assumption/uncertainty (page

56) in the LAR is provided as a source of uncertainty, compared to the 2012 EPRI document, which identifies 71 potential sources of uncertainty. There appear to be no uncertainties or assumptions associated with LERF and internal flooding, and one source that relates to both high winds and external flooding.

The LAR continues, [t]he list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

The NRC staff notes that Stage F of NUREG-1855 (Revision 1) provides guidance on how to identify key sources of uncertainty relevant to the application.

Provide the following:

a. A summary of the process used to determine the nine sources of uncertainties and assumptions presented in Attachment 6 of the LAR. Include in this discussion an explanation of how the process is in accordance with NUREG-1855, Revision 1, or other NRC-accepted method. Also, include in the discussion a detailed description of how the final set of nine uncertainties and assumptions were developed from the initial comprehensive list of PRA model(s) uncertainties and assumptions.

Duke Energy Response to PRA RAI 4.a.:

Step E-1 (section 7.2) of NUREG 1855, Revision 1 provides guidance for identifying and characterizing those sources of model uncertainty and related assumptions in the PRA required for the application.

Substep E-1.1 of the NUREG recommends using the detailed guidance and a generic list of sources of model uncertainty and related assumptions in EPRI 1016737 for the internal event hazard group (including LERF), and using the examples of sources of model uncertainty for the

U.S. Nuclear Regulatory Commission Page 14 of 108 Serial RA-18-0178 Enclosure internal fires, seismic, Low Power Shutdown and Level 2 hazard groups in EPRI 1026511. For BNP, this process was performed by reviewing PRA documentation for generic issues identified in Table A.1 of EPRI 1016737, as well as identifying plant-specific assumptions and uncertainties, and is therefore consistent with step E-1.1 of the NUREG. EPRI 1026511 was not explicitly used to identify generic uncertainties in models other than the internal events model. However, of the models addressed by EPRI 1026511, only the BNP fire PRA is being used to support the current application. See the response to RAI 17 for treatment of uncertainties/assumptions related to the external flood and high winds PRA models.

Substep E-1.2 of NUREG 1855, Revision 1 involves identifying those sources of model uncertainty and related assumptions in the base PRA that are relevant to an application. Those that are irrelevant can be screened from further discussion. However, since this application uses the internal events, internal flood, and fire PRA models for both CDF and LERF, all model uncertainties and related assumptions identified for these models are considered relevant. The original process screened some based on other factors, which is not consistent with the latest version of the NUREG.

Substep E-1.3 of NUREG 1855, Revision 1 involves characterizing the identified sources of model uncertainty and related assumptions. This characterization involves understanding how the identified sources of model uncertainty and related assumptions can affect the PRA. For the BNP uncertainty analysis, this was performed for all identified uncertainties/assumptions.

Substep E-1.4 is a qualitative screening process that involves identifying and validating whether consensus models have been used in the PRA to evaluate identified model uncertainties. As stated in NUREG 1855, Rev. 1, the use of a consensus model eliminates the need to explore an alternative hypothesis. For the BNP uncertainty analysis, some uncertainties/assumptions were screened based on their use of a consensus method, however, others were screened based on additional criteria, which again is not entirely consistent with the NUREG.

Once all relevant uncertainties/assumptions are identified in Step E-1, Step E-2 (section 7.3) of NUREG 1855, Rev. 1 provides guidance for identifying those sources of model uncertainty and related assumptions that are key to the application. The input to this step is the list of the relevant sources of model uncertainty identified in Step E-1. These sources of model uncertainty and related assumptions are then quantitatively assessed to identify those with the potential to impact the results of the PRA such that the applications acceptance guidelines are challenged. This assessment is made by performing sensitivity analyses to determine the importance of the source of model uncertainty or related assumption to the acceptance criteria or guidelines. In the BNP uncertainty analysis, this step was performed qualitatively to arrive at the list of uncertainties, not quantitatively, and therefore is not entirely consistent with the NUREG.

For those uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria), Stage F (section 8) of NUREG 1855, Rev. 1, provides guidance on justifying the strategy used to address the key uncertainties that contribute to risk metric calculations that challenge application-specific acceptance guidelines. This portion of the NUREG was not addressed in the original BNP uncertainty analysis.

U.S. Nuclear Regulatory Commission Page 15 of 108 Serial RA-18-0178 Enclosure

b. If the process of identifying key sources of uncertainty or assumptions for these PRA models was not done in accordance with NUREG-1855, provide the results of an updated assessment of key sources of uncertainty or assumptions.

Duke Energy Response to PRA RAI 4.b.:

The process for identifying sources of uncertainty and assumptions is described, and compared to the process outlined in NUREG-1855 rev. 1, in the response to item a. This comparison shows that the initial BNP identification of sources of model uncertainties and related assumptions was consistent with Substep E-1.1 of the NUREG, with the exception that generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were not explicitly reviewed.

However, the process to assess the identified uncertainties/assumptions was not entirely consistent with all portions the latest revision of the NUREG. As such, an updated assessment was performed, as described below.

Since the ultimate goal in assessing model uncertainty is to determine whether (and the degree to which) the risk metric results challenge or exceed the quantitative acceptance guidelines for the application, due to sources of model uncertainty and related assumptions, the first step in the updated evaluation was to identify the risk metrics used as acceptance guidelines for the 10 CFR 50.69 categorization process. For 10 CFR 50.69 categorization, the acceptance guidelines are actually threshold values for Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) for each SSC being categorized, above which the SSC is categorized as high safety significant (HSS), and below which the SSC is categorized as low safety significant (LSS). As described in Step E-2 of the NUREG, each relevant uncertainty/assumption requires some sort of sensitivity analysis, and each sensitivity performed to evaluate an uncertainty/assumption involves some change to the PRA results. Since any change to the PRA results has the potential to change the F-V and RAW importance measures for all components (SSC), every relevant uncertainty/assumption has the potential to challenge the acceptance guidelines. That is, since RAW and F-V are relative importance measures, any change to any part of the model will generate a new set of cutsets and potentially impact the RAW and F-V for every SSC.

Thus, the only way to evaluate the impact of a sensitivity is to quantify the sensitivity case and compare the F-V and RAW values for all SSCs against the base case F-V and RAW values to determine if any exceed the HSS threshold in the sensitivity case that did not previously do so.

However, as stated in Stage F of NUREG-1855 rev. 1 (section 8.1), an appropriate method for dealing with uncertainties and related assumptions that challenge or exceed the acceptance guidelines is to use compensatory measures or performance monitoring requirements. Section 8.5 of the NUREG states that performance monitoring can be used to demonstrate that, following a change to the design of the plant or operational practices, there has been no degradation in specified aspects of plant performance that are expected to be affected by the change. This monitoring is an effective strategy when no predictive model has been developed for plant performance in response to a change. Since no predictive model of the increase in unreliability following alternative treatment of LSS SSCs exists, this option is appropriate for 10CFR 50.69. In fact, the example of a performance monitoring approach to address key uncertainties/assumptions given in section 8.5 is the factor of increase sensitivity combined with the performance monitoring process described for 10CFR 50.69 in NEI 00-04. The NUREG states:

U.S. Nuclear Regulatory Commission Page 16 of 108 Serial RA-18-0178 Enclosure One example of such an instance is the impact of the relaxation of special treatment requirements (in accordance with 10 CFR 50.69) on equipment unreliability. No consensus approach to model this cause-effect relationship has been developed.

Therefore, the approach adopted in NEI 00-04 as endorsed in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, [NRC, 2006a] is to:

• Assume a multiplicative factor on the SSC unreliability that represents the effect of the relaxation of special treatment requirements.

• Demonstrate that this degradation in unreliability would have a small impact on risk.

Following acceptance of an application which calls for implementation of a performance monitoring program, such a program would have to be established to demonstrate that the assumed factor of degradation is not exceeded.

The use of the sensitivity study required by section 8.1 of NEI 00-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. The impact of any key uncertainty or assumption sensitivity would be to potentially cause an SSC to be categorized as HSS when the base PRA analysis showed it to be LSS. The potential impact of categorizing an SSC as LSS rather than HSS is that the SSC could have alternative treatments applied to it and as such, the possibility exists that the reliability of SSC could be reduced (i.e., the specified aspect of plant performance that is expected to be affected by the change is the reliability of the SSC). Per section 8.1 of NEI 00-04, a sensitivity is performed which assumes the unreliability of all LSS components is increased by a factor of 3 to 5. Since, as discussed in NEI 00-04, no significant decrease in reliability is expected, this is very conservative. Additionally, since the failure probability of all LSS SSCs are increased at the same time in the sensitivity, this approach addresses all uncertainties/assumptions which could potentially impact the LSS/HSS categorization. The LSS sensitivity then must be shown to demonstrate that even assuming this factor increase, the quantitative guidelines of Reg. Guide 1.174 are not exceeded. Thus, the LSS sensitivity demonstrates that the potential impact of all uncertainties/assumptions is acceptable.

Additionally, a performance monitoring program must be established as part of the 10 CFR 50.69 process (per NEI 00-04 section 12) which will monitor the reliability of all LSS SSCs to ensure that the factor of increase assumed in the sensitivity is not exceeded. This ensures the validity of the sensitivity study following implementation.

It is noted that uncertainties/assumptions which are related to SSCs being excluded from the PRA model, either because they are not believed to be required for accident mitigation or because they perform a backup function to other equipment but were conservatively not credited in the model, may not be adequately addressed by the above sensitivity and performance monitoring program. If an SSC is not in the PRA model, but actually performs (or could perform) an accident mitigation function, and that SSC is categorized as LSS (based on non-PRA criteria) the factor increase sensitivity would not appropriately address the uncertainty associated with this assumption/uncertainty. This is because if there are no failure events in the PRA model for the SSC, the LSS sensitivity study has no events to which to apply the factor of increase. If, contrary to the assumption, the SSC is actually required for accident mitigation and had been included in the model, increasing its failure rate by the factor of increase could have an impact on the sensitivity results with respect to the RG 1.174 limits.

U.S. Nuclear Regulatory Commission Page 17 of 108 Serial RA-18-0178 Enclosure Based on the above discussion, an updated assessment of sources of uncertainty and assumptions was performed. All uncertainties and assumptions identified in the original BNP process consistent with Substep E-1.1 of NUREG-1855 rev. 1 (i.e., all identified internal events, internal flood, fire, high wind and external flood uncertainties/assumptions), and the generic sources of uncertainties for the fire PRA identified in EPRI 1026511 were reviewed to identify any that are not adequately addressed by the factor increase sensitivity study required by Section 8.1 of NEI 00-04 and the performance monitoring program required by Section 12 of NEI 00-04. The table below provides details of these uncertainties and their disposition for the 10 CFR 50.69 categorization process. Due to the large number of uncertainties/assumptions that are adequately addressed by the factor increase sensitivity study and performance monitoring program, these are not listed.

U.S. Nuclear Regulatory Commission Page 18 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 1 The potential for the test BNP-PSA-062, In the BNP PRA, the probability of return line to the CST to be High Pressure an MOV failing to close is 6.25E-left open following testing of Coolant Injection 04/demand. Assuming a CCF the HPCI systems and System factor of 0.1, the probability of both failure of MOVs E41-F008 Notebook, MOVs failing to close on a signal is and E41-F011 to close upon Section 5.1 6.25E-05/demand. A conservative actuation is considered of screening value of 8E-03 was very low probability and is applied for pre-initiator errors with not modeled. some level of follow-up (e.g., an independent verification, post-maintenance test, etc.). Thus, the likelihood of failure of the HPCI system due to flow diversion is approximately 5E-07. This failure is equivalent to a failure of the HPCI pump. The probability of failure of the HPCI pump is approximately 4E-02. Thus, this failure mode of the HPCI pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 19 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 2 While the HPCI system is in BNP-PSA-062, Since these two AOVs have had standby, the drain valves High Pressure their air operators removed, the E41-F028 and E41-F029 Coolant Injection spurious closure probability is that are maintained open. Their System of a manual valve. The probability air operators have been Notebook, of a manual valve transferring replaced with manual latch Section 5.7 closed is 8.42E-08/hr. Since the handles to preclude position of these valves is checked spurious operation. The every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, it is conservatively drain valves are normally assumed that the exposure time is open to prevent condensate 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e., assume one shift buildup in drain pot A fails to identify the mis-aligned while the HPCI system is in valve). The failure probability with a standby. If this drain line is 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> exposure is then 2E-06.

isolated for a significant Since filling of the drain pot is a time prior to the HPCI slow process (likely to be weeks actuation signal, a water based on low steam leakage into slug could be sent to the the turbine), operators would have turbine upon system a significant amount of time to actuation. The drain pot address the annunciator. Thus, the level is annunciated in the probability of them failing to do so control room and the valves prior putting water into the HPCI positions are checked once pump casing is very low. Even each shift in the control assuming a very conservative room. Therefore, for this failure probability of 1.0E-02 for the drain line to create a operator action, the overall problem for the startup of probability of this failure mode is the HPCI system: 1) the 2E-08. This failure is equivalent to normally open drain line a failure of the HPCI pump. The would have to be manually probability of failure of the HPCI isolated, 2) an operator pump is approximately 4E-02.

would have to fail to Thus, this failure mode of the HPCI respond to the annunciation pump is more than 2 orders of of high drain pot level or magnitude lower than the failure have a failure of the level probability of the pump itself, and it instrumentation, and 3) a was excluded. This is a consensus shift would have to fail to method per supporting requirement check the drain line valve SY-A15 of ASME/ANS RA-Sa-positions. Therefore, the 2009, such that this uncertainty effect of drain line isolation, does not need to be addressed or the loss of instrument air, further.

on the initiation and operation of the HPCI system is insignificant and not modeled.

U.S. Nuclear Regulatory Commission Page 20 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 3 Flow diversion through the BNP-PSA-062, In the BNP PRA, the probability of a RWCU system discharge Reactor Core check valve failing to close is line is not considered. The Isolation Cooling 2.38E-04/demand. This failure is failure of check valve G31- System equivalent to a failure of the RCIC F039 to close would be Notebook, pump. The probability of failure of required for diversion to Section 5.1 the RCIC pump is approximately occur and would only be 3.8E-02. Thus, even ignoring the possible if the RWCU fact that a failure within the RWCU system is failed. system would have to occur to cause a flow diversion, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 21 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 4 The potential for the test BNP-PSA-062, In the BNP PRA, the probability of return line to the CST to be High Pressure an MOV failing to close is 6.25E-left open following testing of Coolant Injection 04/demand. Assuming a CCF the RCIC systems and System factor of 0.1, the probability of both MOVs E41-F0228 and E41- Notebook, MOVs failing to close on a signal is F011 failing to close upon Section 5.1 6.25E-05/demand. A conservative actuation is considered of screening value of 8E-03 was very low probability and is applied for pre-initiator errors with not modeled. some level of follow-up (e.g., an independent verification, post-maintenance test, etc.). Thus, the likelihood of failure of the RCIC system due to flow diversion is approximately 5E-07. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 22 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 5 The effect of RCIC drain BNP-PSA-062, The probability of an AOV valve line isolation or the loss of Reactor Core transferring closed is 1.31E-07/hr.

instrument air, on the Isolation Cooling Since the position of these valves is initiation and operation of System checked every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, it is the RCIC system is Notebook, conservatively assumed that the insignificant and not Section 5.7 exposure time is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e.,

modeled. For the RCIC assume one shift fails to identify the drain line to create a mis-aligned valve). The failure problem for the startup of probability with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> exposure the RCIC system: 1) the is then 3.1E-06. Since failure of normally open drain line either of these two valves will would have to be isolated, isolate the drain line, this probability

2) an operator would have is doubled to 6.2E-06. Since filling to fail to respond to the of the drain pot is a slow process annunciation of high drain (likely to be weeks based on low pot level or have a failure of steam leakage into the turbine),

the level instrumentation, operators would have a significant and 3) a shift would have to amount of time to address the fail to check the drain line annunciator. Thus, the probability valve positions. of them failing to do so prior putting water into the RCIC pump casing is very low. Even assuming a very conservative failure probability of 1.0E-02 for the operator action, the overall probability of this failure mode is 6.2E-08. This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 23 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 6 The spurious group 5 BNP-PSA-062, The probability of a spurious failure isolation due to a spurious Reactor Core of a manual switch (i.e., switch failure of the manual switch Isolation Cooling transferring position) is 2.30E-06/hr.

combined with a concurrent System The failure probability with a 24 LL#2 signal is excluded Notebook, hour exposure time is then 5.5E-05.

from the model. Section 5.1 This failure is equivalent to a failure of the RCIC pump. The probability of failure of the RCIC pump is approximately 3.8E-02. Thus, this failure mode of the RCIC pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

7 A rupture of the recirculation BNP-PSA-062, Rupture of the recirculation suction suction line was considered Residual Heat line has a probability of but excluded from further Removal System approximately 4.7E-06 (1 - X-modeling. This would Notebook, RCRLOOPA)* %1A. Failure of require the additional failure Section 5.7 B32-F031 or B32-F032 to close has to close upon RHR initiation a probability of 1.25E-03.

of motor-operated valves Therefore, this failure mode has a B32-F031 or B32-F032. probability of 5.9E-09. This failure is equivalent to a failure of one RHR pump. The probability of failure of an RHR pump is approximately 8.0E-04. Thus, this failure mode of an RHR pump is more than 2 orders of magnitude lower than the failure probability of the pump itself, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 24 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 8 The use of high-pressure BNP-PSA-062, Although the PRA model will not FWH inlet valves FW-V118 Condensate and generate importance measures for or FW-V119 or bypass Feedwater these valves, if the system valve FW-V120 is not Systems containing the valves is credited in the CDS/FWS Notebook, categorized, appropriate surrogate fault tree model for makeup Section 5.1 PRA events will be used to flow control. If CDS/FWS generate importance measures for makeup flow control is lost these valves, or the valves will be using the SULCV, flow added to the model.

control could be achieved using the high-pressure Any impact of the simplified FWH inlet valves or the modeling on acceptance criteria for bypass valve. However, categorization of other components these valves are very large, is addressed by the 10CFR 50.69 making flow control gross factor of 3 sensitivity and and more difficult.

performance monitoring.

9 The use of the CDS pumps BNP-PSA-062, Although the PRA model will not and CDS booster pumps Condensate and generate importance measures for following the recovery of Feedwater the CDS pumps and CDS booster offsite power requires all Systems pumps, if the condensate system is pumps to be restarted and Notebook, categorized, appropriate surrogate this recovery action is not Section 5.1 PRA events will be used to included in the CDS/FWS generate importance measures for fault tree model. The these components (since they are recovery action is implicitly modeled), or the system considered during the will be added to the model.

assessment of sequence-specific recovery actions Any impact of the simplified (OPER-MANCOND-60 &

modeling on acceptance criteria for OPER-MANCOND-120 are categorization of other components included in the human is addressed by the 10CFR 50.69 reliability analysis).

factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 25 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 10 There are potential BNP-PSA-062, The probability of a manual valve divergence paths through Standby Liquid transferring position is 8.42E-08 per the primary SLC line to the Control System hour. Conservatively assuming SLC tank, which is isolated Notebook, both valves could transfer open any by two manual valves, and Section 5.1 time during the year without being the test line to the tank, detected, the probability of both which is also isolated by two valves transferring open is 5.4E-07.

manual valves. These paths Since common cause failures are are not modeled as typically only applied to active potential SLC divergence failure modes, no common cause is paths. included. This failure is equivalent to a failure of both SLC pumps.

The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E-05 .

Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 26 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 11 The line from the SLC pump BNP-PSA-062, The probability of a manual valve discharge drain line is Standby Liquid transferring position is 8.42E-08 per double isolated by two Control System hour. Conservatively assuming manual valves. This line is Notebook, both valves could transfer open any not modeled as a Section 5.1 time during the year without being divergence path. detected, the probability of both valves transferring open is 5.4E-07.

Since common cause failures are typically only applied to active failure modes, no common cause is included. This failure is equivalent to a failure of both SLC pumps.

The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E-05 .

Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

12 The SLC pump suction BNP-PSA-062, Although the PRA model will not drain line which is normally Standby Liquid generate importance measures for isolated by manual valve Control System valve C41-F015, if the SLC system C41-F015 is not modeled as Notebook, is categorized, an appropriate a divergence path. Section 5.1 surrogate PRA event will be used to generate importance measures for this valve, or the valve will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 27 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 13 Potential divergence paths BNP-PSA-062, The probability of a manual valve through the check valve test Standby Liquid transferring position is 8.42E-08 per line connection downstream Control System hour. Conservatively assuming of check valve C41-F006 is Notebook, both valves could transfer open any isolated by two manual Section 5.1 time during the year without being valves and capped. The line detected, the probability of both downstream of the valves transferring open is 5.4E-07.

explosive valves is isolated Since common cause failures are by valve C41-V5001 and typically only applied to active capped. These paths are failure modes, no common cause is not modeled as potential included. A very conservative value divergence paths. of 0.1 is then assumed for failure of the threaded cap. Thus, the probability of this failure mode is 5.4E-08. This failure is conservatively assumed to be equivalent to a failure of both SLC pumps. The probability of failure of the common cause failure of the SLC pumps is approximately 5.6E-

05. Thus, this failure mode of the SLC pumps is more than 2 orders of magnitude lower than the failure probability of the pumps themselves, and it was excluded.

This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 28 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 14 Actuation of SRVs B, E, and BNP-PSA-062, Although the PRA model will not G from the remote panel is Safety Relief generate importance measures for not modeled. This is a Valve System these valves, if the SRV system is remote local action and will Notebook, categorized, appropriate surrogate be assessed, if necessary, Section 5.1 PRA events will be used to during the recovery generate importance measures for assessment in the context these valves, or the valves will be of the accident sequence. added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 29 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 15 The MSIV AC-powered BNP-PSA-062, Although the PRA model will not solenoids are normally Main Steam generate importance measures for supplied power from 120V System the alternate power supply AC RPS bus 1(2)A or 1(2)B, Notebook, components, if the system through RPS MMG 1(2)A or Section 5.1 containing these component is 1(2)B, respectively. The categorized, appropriate surrogate RPS MMGs receive power PRA events will be used to from 480V AC MCC 1(2)CA generate importance measures for or 1(2)CB. An alternate these components, or the power source is available to components will be added to the supply power to the 120V model.

AC RPS buses. Power can be manually aligned to the Any impact of the simplified 480V AC power distribution modeling on acceptance criteria for panels 1E5(2E7) or categorization of other components 1E6(2E8). However, only is addressed by the 10CFR 50.69 one RPS bus can receive factor of 3 sensitivity and power from this source at performance monitoring.

any one time. The current MSIV model does not consider this alternate power supply. This alternate power source may be considered as a possible recovery action during the accident sequence review process.

U.S. Nuclear Regulatory Commission Page 30 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 16 Consideration was made to BNP-PSA-062, Since the level switches are model turbine building Circulating Water credited for preventing significant flooding level switches System turbine building floods, and no which trip the CW pumps. Notebook, importance measures will be The logic requires two Section 5.1 generated by the PRA, if the separate level switches to system containing these switches fail to cause the CW pumps (circulating water system) is to trip; these switches are categorized, the switches will be not modeled. categorized as high safety significant (HSS), or the components will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

17 There are four pairs of BNP-PSA-062, Although the PRA model will not solenoid valves in the RPT/ARI System generate importance measures for Alternate Rod Insertion Notebook, the valves that are not modeled, if (ARI) system. Any single Section 5.1 the ARI system is categorized, pair will depressurize the appropriate surrogate PRA events scram header and insert will be used to generate importance control rods; the model measures for the other valves since reflects this. To simplify the they are implicitly modeled (i.e.,

model, only one pair of they support the function), or the solenoid valves is valves will be added to the model.

considered, effectively meaning any single valve Any impact of the simplified failure will result in common modeling on acceptance criteria for cause failure of the categorization of other components remaining valves.

is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 31 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 18 Each TCS valve is modeled BNP-PSA-062, Although the PRA model will not as a hydraulic valve and the Turbine Control generate importance measures for sub-components of the System the subcomponents, if the TCS valve are not explicitly Notebook, system is categorized, an modeled, but are Section 5.1 appropriate surrogate PRA event considered integral to the will be used for the subcomponents valve. since they are implicitly modeled (i.e., they support the function of the valve).

19 Plugging of pressure BNP-PSA-062, Although no calculation has been reducers located after the Turbine Control performed, the likelihood of turbine bypass valves is not System plugging of the pressure reducers, modeled. Notebook, which are essentially pipe Section 5.1 expanders in a 10 steam pipe to an 18 pipe, during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is considered to be at least two orders of magnitude below the failure rate of the turbine bypass valves opening (1.2E-03).

Therefore, this failure mode has been excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

U.S. Nuclear Regulatory Commission Page 32 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 20 A group 1 containment BNP-PSA-062, Although the PRA model will not isolation signal can be Instrumentation generate importance measures for generated from a number of and Control the components which generate different signals; only the Circuitry System other signals, if the system is reactor vessel low water Notebook, categorized, appropriate surrogate level signal (LL#3) is Section 5.1 PRA events will be used for the modeled. Not modeling other components since they are other signals are considered implicitly modeled (i.e., they support insignificant. This the function).

simplification is conservative since other Any impact of the simplified signals could also provide modeling on acceptance criteria for an isolation signal, however categorization of other components the LL#3 signal is chosen is addressed by the 10CFR 50.69 since it should be actuated factor of 3 sensitivity and for every accident sequence performance monitoring.

that progresses to core damage.

21 The undervoltage relays in BNP-PSA-062, Although the PRA model will not the ECCS are considered Instrumentation generate importance measures for as a single relay for each and Control all of the sub-relays which generate individual emergency bus Circuitry System undervoltage signals, if the system and are assumed to be Notebook, is categorized, appropriate totally codependent for a Section 5.1 surrogate PRA events will be used specific emergency bus. for the sub-relays since they are implicitly modeled (i.e., they support the function).

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 33 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 22 The electric motor-driven BNP-PSA-062, Although the PRA model will not fuel oil pump which is a Emergency Diesel generate importance measures for standby pump that is started Generator System the electric pump, if the system is if the engine-driven pump Notebook, categorized, an appropriate fails is not included in the Section 5.1 surrogate PRA event will be used model. Data collection rules for the pump.

associated with the diesel generator boundary Any impact of the simplified supports the inclusion of the modeling on acceptance criteria for engine-driven pump into the categorization of other components EDG failure.

is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

23 The electric motor-driven BNP-PSA-062, Although the PRA model will not lube oil pump which is only Emergency Diesel generate importance measures for needed to raise lube oil Generator System the electric pump, if the system is pressure if the engine- Notebook, categorized, an appropriate driven pump fails to run is Section 5.7 surrogate PRA event will be used not included in the model. for the pump.

Since the engine-driven pump is included in the Any impact of the simplified EDG failure rate, a failure is modeling on acceptance criteria for considered a failure of the categorization of other components EDG as modeled.

is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

24 The electric motor-driven BNP-PSA-062, Although the PRA model will not auxiliary jacket water pump Emergency Diesel generate importance measures for which is a standby pump Generator System the electric pump, if the system is initiated upon failure of the Notebook, categorized, an appropriate engine-driven pump is not Section 5.7 surrogate PRA event will be used included in the model. for the pump.

Since the engine-driven pump is included in the Any impact of the simplified EDG failure rate, a failure is modeling on acceptance criteria for considered a failure of the categorization of other components EDG as modeled.

is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 34 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 25 Failure of battery charger BNP-PSA-062, Although the PRA model will not bleeder resistor to DC Power generate importance measures for disconnect during loss of System the bleeder resistor, if the system is AC is included in the Notebook, categorized, an appropriate estimation of the Section 5.1 surrogate PRA event (e.g., the switchboard failure rate. AC switchboard) will be used for the bleeder resistor disconnect resistor since it is implicitly modeled prevents battery discharge. (i.e., it supports the function).

26 Use of distribution panel BNP-PSA-062, Although the PRA model will not 1A(B) as an alternative DC Power generate importance measures for power source to the 125V System the alternate power supply DC distribution panel 2A(B) Notebook, components, if the system or the reverse is not Section 5.7 containing these component is modeled. This reduces the categorized, appropriate surrogate complexity of the circular PRA events will be used to logic by avoiding logic loops generate importance measures for between panels and AC these components, or the power supplies beyond components will be added to the those defined due to the model.

normal alignment.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 35 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 27 The Brunswick model makes BNP-PSA-062, This analysis has been updated the assumption that the Heating, and confirms no HVAC is required.

Emergency Busses E1 Ventilation, and See response to PRA RAI 5.a.

through E8 located in the Air Conditioning Diesel Generator Building System Switchgear rooms do not Notebook, depend on the buildings Section 5.1 HVAC system to perform its primary function during a 24-hour mission time. Generic analysis concludes that the switchgear rooms in a diesel generator building will not experience high temperature related failures during a 24-hour mission time based on the HVAC analyses in NUREG/CR-4550, Volume 4, Sections 4.3 and 4.6.

U.S. Nuclear Regulatory Commission Page 36 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 28 Divergence of air pressure BNP-PSA-062, The probability of a check valve through the idled RNA Instrument Air failing to close is 2.38E-04/demand.

header is assumed to be and Nitrogen Assuming a CCF factor of 0.1, the probabilistically negligible. Systems probability of two check valves Divergence would require Notebook, failing to close is 2.38E-05/demand.

the failure to close of two or Section 5.1 Assuming a conservative value of more check valves in series 1.0E-02 for a leak in the RNA and would require an system large enough to fail the additional leak path. system (over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time), the likelihood of flow diversion is approximately 2.4E-07.

This failure is conservatively assumed to be equivalent to common cause failure of two air compressors. The common cause probability of failure of two is approximately 4E-05. Thus, this failure mode of the IA system is more than 2 orders of magnitude lower than the failure probability of the compressors, and it was excluded. This is a consensus method per supporting requirement SY-A15 of ASME/ANS RA-Sa-2009, such that this uncertainty does not need to be addressed further.

29 The opening of air BNP-PSA-062, Although the PRA model will not compressor cooling inlet Turbine Building generate importance measures for valves SV-5008 and SV- Closed Cooling these valves, if the system is 4384 is considered an Water System categorized, an appropriate integral part of the Notebook, surrogate PRA event (e.g., the compressor start logic and Section 5.7 compressor) will be used for the is not separately modeled in valves since they are implicitly TBCCW. These valves are modeled (i.e., they support the controlled by the function).

compressor start logic and the valves open on compressor start.

U.S. Nuclear Regulatory Commission Page 37 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 30 Penetrations with two BNP-PSA-049, The probability of a check valve unique isolation valves (i.e., PSA Model failing to close on demand is 2.38E-check valve and fail closed Sections 7-9 04, while the probability of an air air operated valve) may be Level 2 Analysis, operated valve failing to close is eliminated probabilistically. Attachment 2, 9.51E-04, such that the Since no common mode Section C.2.5 independent failure of both valves is failure applies to these 2.3E-07. Since failure of a valves, the probability of penetration has no impact on CDF, failure to isolate these including these valve failures would penetrations will be several have no impact on the CDF RAW orders of magnitude below and F-V values. Conservatively the probability of assuming BNP has an overall CDF penetrations where of 1.0E-04, and that failure of the common mode failures penetration is applicable to all of apply to the isolation valves. that CDF, the RAW value for the check valve would be 9.5E-08, while the RAW value of the AOV would 2.4E-08. The F-V values would obviously be negligible.

Thus, this assumption has no impact on 10CFR 50.69 categorization 31 Containment isolation BNP-PSA-049, Although the PRA model will not Signal failure probability not PSA Model generate importance measures for modeled in detail. The 1 E- Sections 7-9 the containment isolation signal 5/demand estimate is based Level 2 Analysis, components, if the system on judgment and considers Attachment 2, containing these components is the multiple signal failures Notes to Table categorized, appropriate surrogate that must occur. C.2.7.-2 PRA events will be used to generate importance measures for these components since they are implicitly modeled (i.e., they support the function), or the components will be added to the model.

Any impact of the simplified modeling on acceptance criteria for categorization of other components is addressed by the 10CFR 50.69 factor of 3 sensitivity and performance monitoring.

U.S. Nuclear Regulatory Commission Page 38 of 108 Serial RA-18-0178 Enclosure Uncertainties and Assumptions Not Addressed by 10CFR 50.69 Factor of 3 Sensitivity/Performance Monitoring Description of Assessment No. Assumption or Source of Source Uncertainty 32 If the H2/02 analyzer BNP-PSA-049, Although the PRA model will not annunciators fail to alarm, PSA Model generate importance measures for the operators must check Sections 7-9 the H2/02 analyzer annunciator local indication in the control Level 2 Analysis, components, if the system room to recognize the Attachment 2, containing these components is conditions for venting and Section C.5.5 categorized, appropriate surrogate this action is not quantified PRA events will be used to in the fault tree model. The generate importance measures for operator action for failing to these components since they are observe indication is implicitly modeled (i.e., they support considered subsumed by the operator action), or the the overall operator action components will be added to the for combustible gas venting model.

c. A description of the specific assumptions and sources of uncertainty key to this application for the entries in LAR Attachment 6 in enough detail that their impact on the application can be clearly understood and that a specific sensitivity could be defined to examine the risk significance of the issue. Include in this description for any new sources of uncertainty or assumptions identified in Part b.

Duke Energy Response to PRA RAI 4.c.:

The updated assessment of key sources of uncertainty and assumptions performed in response to RAI 4.b. supersedes the contents of Attachment 6 to the original LAR.

PRA RAI 5 - Key Assumptions and Uncertainties that could Impact the Application:

The licensees dispositions for key assumptions and modeling uncertainties are presented in of the LAR. Attachment 6 (page 56) of the LAR states that the GOTHIC analysis for switchgear HVAC requirements is not a bounding case and shows only one of eight HVAC fans needed for room cooling. However, in the disposition for this assumption/uncertainty, the licensee states that screening of HVAC for switchgear rooms needs to consider the level of detail in the GOTHIC analysis. The NRC staff is unclear if HVAC support has been screened from the model or the success criterion modeled is one of eight fans. Provide the following:

a. A clarification of the actual modeling of HVAC support of the switchgear rooms and specify the assumption/uncertainty related to this modeling choice.

Duke Energy Response to PRA RAI 5.a.:

A GOTHIC model of the Diesel Generator Building (DGB) switchgear rooms and the buildings HVAC system has been produced and analyzed. This is in addition to the other GOTHIC

U.S. Nuclear Regulatory Commission Page 39 of 108 Serial RA-18-0178 Enclosure analyses that have been used to understand the environmental conditions in the Diesel Generator Rooms and DGB Basement. The results demonstrate that switchgears E1 through E8 have the capability to operate throughout their modeled mission time without relying on the Diesel Generator Building HVAC system to function as designed. The Brunswick PRA model applies this independence between the switchgears and the DGB HVAC system. The system notebook documents this relationship and references the GOTHIC analysis as justification to support the modeling. Therefore, there is no longer an uncertainty in the analysis and modeling of the switchgears E1 through E8, nor are any sensitivity studies or actions required. In conclusion, this validated assumption does not impact the results of the 10 CFR 50.69 categorization process.

b. Justification that the specific assumption/uncertainty does not impact the results of the 10 CFR 50.69 categorization process.

Duke Energy Response to PRA RAI 5.b.:

The assumption that switchgears E1 through E8 do not depend on the DGB HVAC system is validated and documented by a GOTHIC analysis as discussed in response to RAI-5.a. This independence is currently built in Brunswicks PRA model and therefore will have no impact to the results of the 10 CFR 50.69 categorization process.

c. Alternatively, ensure that the assumption/uncertainty resolution is incorporated into the PRA prior to implementation of the 10 CFR 50.69 risk categorization process.

Duke Energy Response to PRA RAI 5.c.:

The assumption that switchgears E1 through E8 do not depend on the DGB HVAC system is validated and documented by a GOTHIC analysis as discussed in response to RAI-5.a. This independence is currently incorporated in Brunswicks PRA model and therefore no further action is needed.

PRA RAI 6 - Feedback and Adjustment Process:

Section 11.2, Following Initial Implementation, of NEI 00-04 discusses that a periodic update of the plant PRA may affect the results of the categorization process. If the results are affected, the licensee must make adjustments as necessary to either the categorization or treatment processes to maintain the validity of the processes. Specifically, NEI 00-04, Section 12.1 discusses cases for which, in some instances, an updated PRA model could result in new risk achievement worth (RAW) and Fussell Vesley (FV) importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization. Provide the following:

a. Explain how this periodic review will be administered. At minimum, discuss the following:

1. Participants involved in the review;

2. Sources of material identified to be reviewed;

3. Periodicity for when the review will be performed;

U.S. Nuclear Regulatory Commission Page 40 of 108 Serial RA-18-0178 Enclosure

4. Documentation of the review performed (e.g., corrective action program, engineering evaluation, etc.); and Duke Energy Response to PRA RAI 6.a.:

Consistent with NEI 00-04 Section 12, the periodic review will be performed by a system/strategic engineer, or equivalent, and a PRA engineer.

To assess the impact of plant changes on categorized SSCs, the following items are reviewed to ensure the continued validity of categorization:

• Plant modifications since the last review that could impact the SSC categorization

• Plant specific operating experience that could impact the SSC categorization

• The impact of the updated risk information (that is, PRA model or other analysis used in the categorization) on the categorization process results

• Importance measures used for screening in the categorization process. If a review of the importance measures indicates that the SSC should be reclassified, then both the relative and absolute values of the risk metrics will be considered by the IDP.

• An update of the risk sensitivity studies performed for the categorization

• Applicable industry operational experience for impact on existing categorizations

• Input from Regulatory Affairs and Operations regarding changes that may affect the bases for the categorization results.

The periodic review is completed at least once every other fuel cycle. The Periodic Review Process will be completed in accordance with Duke Energy procedures.

The periodic review is documented and will be presented to the Integrated Decision Making Panel (IDP) to make the final decision regarding any necessary recategorizations.

b. Provide the criteria to be used to determine if the change being reviewed has any impact to a modeled PRA hazard(s) and/or any SSC categorized by the 50.69 process.

Duke Energy Response to PRA RAI 6.b.:

NEI 00-04, section 12.1, provides the criteria for updating the categorization of SSCs based on updated PRA models. It notes that in some instances, an updated PRA model could result in new RAW and F-V importance measures that are sufficiently different from those in the original categorization so as to suggest a potential change in the categorization. That is, the new RAW and F-V values may have changed enough that they are now above the LSS/HSS threshold when they had previously been below (or vice versa). In these cases, the assessment of whether a change in categorization is appropriate should be based on the absolute value of the importance measures. This is done in order to not inadvertently assess an SSC as HSS when its relative importance (FV and/or RAW) has gone up, but only due to a decrease in overall CDF and/or LERF. Table 12-1 of NEI 00-04 lays out the cases where the SSC categorization should be updated based on both the relative and absolute importance measures. It should be noted that the table only allows downgrading an SSC from HSS to LSS if the relative importance

U.S. Nuclear Regulatory Commission Page 41 of 108 Serial RA-18-0178 Enclosure measures for the HSS SSC from the updated model indicate LSS, and the absolute importance measures from the from the updated model are lower than before.

PRA RAI 7 - SSCs Categorization Based on Other External Hazards:

Section 3.2.4 of the LAR states:

As part of the categorization assessment of other external hazard risk, an evaluation is performed to determine if there are components being categorized that participate in screened scenarios and whose failure would result in an unscreened scenario.

Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered HSS.

All remaining hazards were screened from applicability and considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

The last sentence implies that the assessment has been completed and concludes that all other external hazards will never need evaluation during categorization. The individual plant examination of external events (IPEEE) screening process did not include the additional step illustrated in Figure 5-6 in Section 5.4 of NEI 00-04. Figure 5-6 and its associated text states that an evaluation is performed to determine if there are components being categorized that participate in screened external event scenarios whose failure would result in an unscreened scenario.

Please clarify how the screening criteria in LAR Attachment 5, Progressive Screening Approach for Addressing External Hazards, satisfy the guidelines that HSS will be assigned to SSCs whose failure would cause a screened external event scenario to become unscreened.

Duke Energy Response to PRA RAI 7:

The screening criteria in Attachment 5 of the LAR were used to determine those external hazards listed in Attachment 4 of the LAR requiring a PRA model for this application and those screened from needing a PRA model. The LAR Attachment 5 denotes the screening criteria that determines screened scenarios versus un-screened scenarios.

Per NEI 00-04 the external hazard assessment is required for each SSC categorization. As such, each SSC being categorized will be assessed in accordance with NEI 00-04 Figure 5-6 for the external hazards listed in Attachment 4 of the LAR. If the failure of the SSC results in the screening criterion from Attachment 5 not being met, then the scenario would become unscreened and the SSC would become candidate High Safety Significant. NEI 00-04 Figure 5-6 is shown below for reference.

U.S. Nuclear Regulatory Commission Page 42 of 108 Serial RA-18-0178 Enclosure f igure

..... 5-6

()THER EX'J ERNAL HAZARDS Select Component ldentify Safety Significant Attributes of Component PRA RAI 8 -Addition of FLEX to the PRA Model:

In order to ensure efficiency in its reviews and prevent duplicate reviews of a licensee's PRA technical acceptability, the NRC staff may utilize PRA information from the licensee's previous risk-informed submittals. In the course of its review for this LAR, the staff utilized information from response to RAI 9 of the "Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Request for Risk-Informed Exigent License Amendment - Technical Specification 3.8.1 , AC Sources -

Operating , One-Time Extension of Emergency Diesel Generator Completion Times and Suspension of Surveillance Requirements," dated December 6, 2017 (ADAMS Accession No. ML17340A457). The licensee indicated in the RAI response that FLEX diesel generators and other FLEX equipment, with associated operator actions, were credited in some of the PRA models used in the LAR evaluation .

There are several challenges to incorporating these new strategies into PRA models that need to be addressed . The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, 'Crediting Mitigating Strategies in Risk-Informed Decision Making ,'

U.S. Nuclear Regulatory Commission Page 43 of 108 Serial RA-18-0178 Enclosure Guidance for Risk-Informed Changes to Plants Licensing Basis (ADAMS Accession No. ML17031A269), provides the NRCs staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision making in accordance with the guidance of RG 1.200.

Provide the following information in the context of both the internal and external hazard PRA models credited in the licensees 10 CFR 50.69 application:

a. A discussion detailing the extent of incorporation, i.e., summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application.

Duke Energy Response to PRA RAI 8.a.:

Internal Events:

FLEX Diesel Generators The FLEX diesel generators (FLEX-DGs) are utilized to supply power to 480 VAC emergency busses if other sources of station AC power are unavailable. In turn, the station 480 VAC emergency busses can supply power to the battery chargers to maintain the availability of instrumentation and control power.

The station has two FLEX-DGs. Aligning the FLEX-DGs requires manual, local action. The FLEX-DGs are permanently installed and their use does not require removing equipment from the FLEX Dome.

Prior to the installation of the FLEX-DGs, the SAMA diesels were modeled as supplying power to the battery chargers. The FLEX-DGs have replaced the SAMA diesels in performing that function. The modeling associated with the SAMA diesels had been peer reviewed. The FLEX-DGs have been modeled using the same methods as were used previously for the SAMA diesels.

FLEX Portable Pumps The FLEX portable pumps and their associated flow paths provide an injection path from the condensate storage tank to the reactor pressure vessel for core cooling.

There are two diesel-driven FLEX portable pumps, which are normally in storage in the FLEX Dome. All associated FLEX connection points are closed and secured. There is also a diesel-driven B.5.b pump capable of matching the performance of a FLEX portable pumps. (Both the two FLEX portable pumps and the B.5.b pump are modeled.)

FLEX Air Compressors The FLEX engine-driven air compressors provide pressurized air to supply the Backup Nitrogen bottles after they have depleted. They allow for operation of the safety relief valves and the hardened containment vent late in a sequence.

U.S. Nuclear Regulatory Commission Page 44 of 108 Serial RA-18-0178 Enclosure There is one FLEX air compressor per reactor unit. There is also an n+1 compressor, to be used for either unit in the event of compressor failure. The normal configuration of the FLEX air compressors is storage in the FLEX Dome. All associated FLEX connection points are closed and secured. (Both the n+1 and the unitized FLEX air compressors are modeled.)

Documentation of the FLEX equipment has been added to the existing internal events documentation as needed, as is done with any other modeled equipment. Since the scope of addition is internal events, no consideration of debris removal due to damage from external hazards is necessary.

External hazards:

FLEX equipment is not currently credited in the external hazard models.

b. A discussion detailing the methodology used to assess the failure probabilities of any modeled equipment credited in the licensees mitigating strategies (i.e., FLEX). The discussion should include a justification explaining the rational for parameter values, and whether the uncertainties associated with the parameter values are considered in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200.

Duke Energy Response to PRA RAI 8.b.:

Internal Events:

NUREG/CR-6928 generic parameter estimates for emergency diesel generators are used for the FLEX-DGs. The FLEX DG are simpler than the EDGs with less external dependencies, and are permanently installed like the EDGs. They are expected to be as reliable as the EDGs.

NUREG/CR-6928 generic parameter estimates for standby engine-driven pumps are also used for the FLEX pumps, and engine-driven air compressors parameter estimates are used for the FLEX air compressors. Generic values are used currently since plant-specific data is limited.

The parameter values include parameter uncertainty values. They are represented with beta or gamma distributions, with variance values calculated from the and parameters associated with the generic data.

External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

c. A discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include:

1. A summary of how the licensee evaluated the impact of the plant-specific HEPs and associated scenario-specific performance shaping factors listed in (a)-(j) of supporting requirement HR-G3 of the ASME/ANS RA-Sa-2009 PRA standard.

2. Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable during an event, and

U.S. Nuclear Regulatory Commission Page 45 of 108 Serial RA-18-0178 Enclosure if the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of the ASME/ANS RA-Sa-2009 PRA standard.

3. If the licensees procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical bases for probability of failure to initiate mitigating strategies.

Duke Energy Response to PRA RAI 8.c.:

Internal Events:

1. FLEX-related operator actions credited in the internal events model were evaluated per ASME/ANS RA-Sa-2009 PRA standard supporting criterion HR-G3. The EPRI HRA Calculator was used to quantify the events, explicitly addressing all performance shaping factors identified in HR-G3.

2. Pre-initiator human failures that would render FLEX equipment unavailable during an event have been included in the model. The pre-initiator human failure events were assigned screening values based on methods described in NUREG/CR-4772. Since the events are not risk significant at the screening probability values, detailed assessments were not performed. This peer-reviewed approach has been used with the other pre-initiator events included in the model and meets the requirements described in HLR-HR-D of the ASME/ANS RA-Sa-2009 PRA standard.

3. The emergency operating procedures provide clear instructions for when to take action using FLEX equipment and which FLEX procedures are to be used to take the necessary action.

External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

d. The ASME/ANS RA-Sa-2009 Standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences.

Section 1-5 of Part 1 of AMSE/ANS RA-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard.

1. Provide an evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences, OR

2. Propose a mechanism to ensure that a focused-scope peer review is performed on the model changes associated with incorporating mitigating strategies, and associated F&Os

U.S. Nuclear Regulatory Commission Page 46 of 108 Serial RA-18-0178 Enclosure are resolved to Capability Category II prior to implementation of the 10 CFR 50.69 categorization program.

Duke Energy Response to PRA RAI 8.d.:

Internal Events:

(1) Consideration of the Use of New Methodologies No new methodologies were used for incorporating FLEX equipment into the internal events model. As with the existing internal event operator actions, the same tool (EPRI HRA Calculator) and process was used to quantify the FLEX operator actions. Similarly, the existing data development process was used to quantify added FLEX random and common cause equipment failures, maintenance unavailabilities, and associated electrical or flow path failures. The BNP systems documentation was updated to include the added FLEX equipment.

(2) Consideration of Model Scope Change Impact on Significant Accident Sequences or Significant Accident Progression Sequences Sensitivity studies were performed to identify the significant CDF and LERF sequences given no credit for FLEX equipment. In comparison to the corresponding base case sequences, there were no unexpected changes. The contribution to CDF of the top SBO sequence (1.2% contribution to CDF, included in top 95% of sequences) was reduced (0.3%

contribution to CDF, no longer included in top 95% of sequences). This moved the sequence from the risk significant category to the non-risk significant category. However, this move from the very low end of the risk significant category to the non-risk significant category is not judged as warranting a peer review given that a decrease in SBO sequences would be expected given the increased diversity provided by the FLEX-DGs. For LERF, there are no risk significant SBO sequences in the case where FLEX is not credited, and there was no significant impact on the significant accident progression sequences.

The sensitivity discussed above is conservative in that it compared the significant sequence results to those given no credit for the FLEX equipment. As noted in the response to RAI 8.a, prior to the installation of the FLEX-DGs, the SAMA diesels were modeled as supplying power to the battery chargers - a function now provided by the FLEX-DGs. Since the same function is now being provided by FLEX-DGs, no significant change to the SBO sequence contributions would be expected.

(3) Consideration of the Model Capability Change Impact on Significant Accident Sequences or Significant Accident Progression Sequences The impacts on significant sequences is discussed in (2) above.

External hazards:

N/A - FLEX equipment is not currently credited in the external hazard models.

U.S. Nuclear Regulatory Commission Page 47 of 108 Serial RA-18-0178 Enclosure PRA RAI 9 - Proposed License Condition:

The guidance in NEI 00-04 allows licensees to implement different approaches, depending on the scope of their PRA (e.g., the approach if a seismic margins analyses is relied upon is different and more limiting than the approach if a seismic PRA is used). RG 1.201, Revision 1 states that as part of the NRCs review and approval of a licensees or applicants application requesting to implement 50.69, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods used in the licensees categorization approach.

Section 2.3 of the LAR proposed the following License Condition:

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 SSCs specified in the license amendment request dated January 10, 2018. Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

The proposed license condition does not explicitly address the PRA and non-PRA methods that were used. Provide a license condition that explicitly address the approaches, e.g.:

Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, external flooding, and high winds; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 1 and Unit 2 License Amendment No. [XXX]

dated [DATE].

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Note that if implementation items are identified, the license condition may need to be expanded to address them.

Duke Energy Response to PRA RAI 9:

Duke Energy proposes the following license condition, which is also reflected in the BSEP Operating License markup in Attachment 2 of this submittal.

U.S. Nuclear Regulatory Commission Page 48 of 108 Serial RA-18-0178 Enclosure Duke Energy is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 1 [Unit 2] License Amendment No. [XXX] dated

[DATE].

Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 2, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

PRA RAI 10 - External Hazards Peer-Review Process:

Section 10 CFR 50.69(c)(1)(i) requires that the PRA must be of sufficient quality and level of detail to support the categorization process and must be subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC.

According to Section 3.3 of the Enclosure to the LAR, the BSEP HW PRA and XF PRA models were subject to a full-scope peer review in February 2012 against RG 1.200, Revision 2.

Appendices B, C and D to RG 1.200, Revision 2, provide the NRC regulatory position on the peer review requirements in the peer review process in NEI 00-02, Probabilistic Risk Assessment Peer Review Process Guidance Revision 1, May 2006 (ADAMS Accession No. ML061510619), NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 2, November, 2008 (ADAMS Accession No. ML083430462) and NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Revision 1, June 2010 (ADAMS Accession No. ML102230070). Section 2.2, Industry Peer Review Program, in RG 1.200, Revision 2, states that when the staffs regulatory positions contained in the appendices are taken into account, use of a peer review can be used to demonstrate that the PRA [with regard to an at-power Level 1/LERF PRA for internal events (excluding external hazards)] is adequate to support a risk-informed application.

Therefore, RG 1.200, Revision 2, does not endorse any peer review guidance for external hazards. Section 2.2 of RG 1.200, Revision 2, further states that [a]n acceptable peer review approach is one that is performed according to an established process... and the peer reviewers technical expertise includes experience in performing (not just reviewing) the work in the element assigned for review.

U.S. Nuclear Regulatory Commission Page 49 of 108 Serial RA-18-0178 Enclosure NEI 12-13, External Hazards PRA Peer Review Process Guidelines (ADAMS Accession No. ML12240A027), provides guidance for conducting and documenting peer-reviews of external hazard PRAs. The staff issued a letter accepting the use of NEI 12-13, as modified by the staffs comments, in March 2018 (ADAMS Accession No. ML18025C025). Section 1.4 of NEI 12-13 states that the on-site External Hazards PRA Peer Review is a one-week, tiered review and that [i]t is necessary to perform on-site walkdowns during an External Hazards PRA Peer Review to confirm the relationships between SSCs and the potential effects of an external hazard. Section 2.2 of NEI 12-13, referring to the peer review team composition and qualifications, states that [t]he intent is to ensure that there is more than one peer reviewer with experience in each key External Hazards PRA process and experience should have involved explicit development of the PRA technical area being reviewed. The same section in NEI 12-13 also states that the peer review team should have at least two utility participants with specialized experience in the hazards being reviewed. Section 3.2 of NEI 12-13 describes the issues that should be identified by the review team as Unreviewed Analysis Methods (UAMs).

a. Provide details, including the source, for the peer review process and corresponding guidelines followed for the BSEP HW and XF PRA full-scope peer-reviews.

Duke Energy Response to PRA RAI 10.a.:

Details are provided first on the key process issues identified during a conference call between NRC and Duke Energy on July 3, 2018, held in preparation for the Brunswick 50.69 External Flooding and High Winds PRA Audit. Next, an overview of how the external hazard peer review processes compare with NEI 12-13 guidance is provided. Lastly, additional details on previous uses of this model and peer review are provided for consideration.

Overall, it is important to note the peer review process for the BSEP HW and XF PRAs was adapted from the internal events PRA peer review process outlined in NEI 05-04 and used for other PRAs contemporary with the review. The peer review was:

- Completed by highly competent reviewers

- Thorough in scope to examine the adequacy of the PRA

- Meets the intent of NEI 12-13, which was issued after the peer review was completed.

Process Issues Identified During NRC Call Duration of the Peer Review The size of the peer review team and duration of the review was determined by first considering the guidance in Section 1-6.2.4 of the ASME PRA Standard as endorsed in RG 1.200 Rev 2 suggesting that a full-scope peer review be conducted by a team with a minimum of five members, and shall be performed over a minimum period of one week. The standard goes on to state that if the review is focused on a particular PRA Element, such as a review of an upgrade of a PRA Element, then the peer review should be conducted by a team with a minimum of two members, performed over a time necessary to address the specific PRA Element.

Additionally, NEI 05-04 states that the number of members of the peer review team and their specific expertise and required level of qualification is a function of the number of PRA technical elements that are being reviewed. The NEI 05-04 guidance also notes that the amount of time

U.S. Nuclear Regulatory Commission Page 50 of 108 Serial RA-18-0178 Enclosure required, and the associated logistics, will depend on the scope of the review, the number of reviewers examining each technical element, and the availability of supporting documentation.

Since the Brunswick peer review addressed only two elements (high wind and external flood),

the review was conducted by a team of three members with one day on-site. The reviewers performed pre-work ahead of the on-site review portion to assess the various supporting requirements for their applicable technical areas. The peer reviewers completed a thorough review of the PRAs diving into the requirements for each supporting requirement to assess the completeness and quality of the PRAs. Appendix C of the Peer Review report provides detail about the documents reviewed and the basis for assessment of each SR, indicating the level of detail reviewed by the team. Based on the assessment for each of the supporting requirements, assessments for each high level requirement are also documented as part of the Peer Review report in Table 3-2.

On-Site Walkdowns NEI 12-13 states on-site walkdowns are needed during an external hazard peer review to confirm the relationships between SSCs and the potential effects of an external hazard. The PRA standard Section 8-3.3.4 and Section 7-3.3.4 for the respective hazards, states the peer review team shall review the plant walkdown but does not require that the review team perform a walkdown themselves. Per Reg. Guide 1.200, Tables A-7 and A-8, the NRC staff has no objection with the Standard peer review requirements in Section 7-3 and Section 8-3 as written.

Additionally, NEI 05-04 does not require plant walkdowns, even for internal flooding PRA peer reviews. The BNP XF and HW peer review team reviewed the walkdown data for the hazards.

The assessment of HW SR WFR-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. The assessment of XF SR XFFR-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings.

Thus, the peer review team adequately assessed the relationship between SSCs and the potential effects of the hazard(s).

Team Composition - Specifically, Utility Participation & Qualifications NEI 12-13 suggests the peer review team include two utility personnel knowledgeable in the hazard(s) being assessed. Per the guidance, the inclusion of utility personnel is to facilitate the exchange of ideas and techniques for effective use of External Hazards PRA methodologies.

The reviewers for the BSEP HW and XF PRA models have diverse experiences working on a number of PRAs across multiple utilities. Their experiences as well as their expertise in PRA provide the intent of multiple utility participants on the review team.

At the time of the peer review, and currently, there was/is a scarcity of utility personnel with the specialized experience in the hazards being reviewed. Instead the peer review team included one of the pioneering experts of external hazard analysis, who was/is a key member of the ASME standard writing committees, and whose work is referenced throughout the standard. He was the lead reviewer for the hazards and fragility analyses, while the lead reviewers for the plant response analyses were PRA experts with >20 yrs experience.

Although this exception was not documented, the composition of the review team did meet the intent to ensure there is more than one peer reviewer with experience in each key External Hazards PRA process as stated in NEI 12-13.

U.S. Nuclear Regulatory Commission Page 51 of 108 Serial RA-18-0178 Enclosure As to the qualifications of the reviewers, there are three main areas of concern: plant response, hazard development, and fragility. The staff requested additional information on the reviewers experience in performing these activities. The following describes the team members experiences in performing hazard development, fragility, and plant response analysis prior to the peer review in question:

Dr. M.K. Ravindra - Lead Reviewer for Wind Hazard, Wind Fragility, Flood Hazard, and Flood Fragility

• Experiences applicable to Flood Hazard (Prior to 2012):

o Fragility:

Co-investigator in a project Load and resistance Factor Design of Steel Buildings o Hazard Development and Fragility:

Participated in the development of ASCE standard "Minimum Design Loads for Buildings and Other Structures", ASCE A7-05 Principal Investigator External Event Analysis of Vogtle Nuclear Power Plant, Consultant on Other External Event IPEEE of Trillo and Asco Nuclear Power Plants Peer Reviewer, External Event Analysis of Calvert Cliffs Nuclear Power Plant Project Manager, External Event Analysis of Vandellos II, Spain Task Leader, "External Event Analyses of Indian Point 2 as Part of IPEEE" Lead Reviewer on Wind, Tornado design and External Event PRA for COL of STP 3& 4 Consultant to Development of IPEEE Procedures Principal Investigator, External Event Scoping studies for the New production Reactors Member of ANS/NRC Technical Writing Group developing Procedures Guide on PRA of Nuclear Power Plants (author of chapters on Analysis of External Events and Seismic Risk Analysis)

• Experiences applicable to Wind Hazard (Prior to 2012)::

o Hazard Development and Fragility:

Participated in the development of ASCE standard "Minimum Design Loads for Buildings and Other Structures", ASCE A7-05 Principal Investigator External Event Analysis of Vogtle Nuclear Power Plant, Consultant on Other External Event IPEEE of Trillo and Asco Nuclear Power Plants Peer Reviewer, External Event Analysis of Calvert Cliffs Nuclear Power Plant Project Manager, External Event Analysis of Vandellos II, Spain Task Leader, "External Event Analyses of Indian Point 2 as Part of IPEEE" Consultant to Development of IPEEE Procedures Project Manager, "Seismic and Wind Fragility and Risk Quantification of Advanced Test Reactor"

U.S. Nuclear Regulatory Commission Page 52 of 108 Serial RA-18-0178 Enclosure Principal Investigator, External Event Scoping studies for the New production Reactors Project Manager, "Evaluation of Seismic and Tornado Design Criteria for Modular HTGR" Member of ANS/NRC Technical Writing Group developing Procedures Guide on PRA of Nuclear Power Plants (author of chapters on Analysis of External Events and Seismic Risk Analysis)

Published Work - High Wind IPEEE of Indian Point Unit 2 Published Work - State-of-the-Art and Current Research Activities in Extreme Winds Relating to Design and Evaluation of Nuclear Power Plants, in The Tornado: Its Structure, Prediction, and Hazards, Geophysical Monograph, 79, American Geophysical Union Published Work - Evaluation of Seismic and Wind Design Criteria for Modular HTGR in Proceedings of Fifth International Conference on Applications of Statistics and Probability in Structures and Soils Engineering o Fragility:

Co-investigator in a project Load and resistance Factor Design of Steel Buildings Published Work - "Turbine Missile Risk Analysis", January 1984 in Proceedings ASCE Specialty Conference on Probabilistic Mechanics and Structural Reliability, Berkeley, California.

Published Work - "Probabilistic Limit Design of Concrete Structures",

October 1976.

Published Work - "Wind and Snow Load Factors for Use in LRFD" Published Work - Load Combinations for Natural and Man-made Hazards in Nuclear Structural Design presented at ANS Topical Meeting on Thermal Reactor Safety Diane Jones - Lead for External Flood Plant Response; Reviewer for Wind Fragility, Flood Hazard and Wind Plant Response

• High Wind and External Flood Hazard and Fragility Experience (prior to 2012):

o Developed the analysis of extreme winds/tornadoes for the mPower small modular reactor design. Included a hurricane, tornado, and straight-line wind hazard analysis for a location on the Gulf Coast in the central US, as well as wind fragility, plant response, and quantification. A screening analysis for external flooding was also conducted.

o Updated the bounding analysis of external hazards for Plant Vogtle, including update of the tornado and missile hazard, and the extreme flood hazard.

o Developed the Kewaunee tornado missile (TORMIS) analysis.

o Developed external hazard analysis for NPP Borssele low power and shutdown PRA

• Plant Response Experience (Prior to 2012)::

o Development, update and quantification of plant response (event tree and fault tree) models for a combined 30 plants over more than 25 years Jeff Leary - Lead for Wind Plant Response; Reviewer for Wind Hazard Analysis, External Flood Fragility, and External Flood Plant Response. Experience prior to 2012:

U.S. Nuclear Regulatory Commission Page 53 of 108 Serial RA-18-0178 Enclosure

• Development, update and quantification of plant response (event tree and fault tree) models for a combined 30 plants over more than 25 years

• Developed fast-solving top logic fault trees for several at-power, shutdown and Level II (LERF) PRA/risk monitor models

• Developed or updated seven full Level 2 PRA models

• Integrated internal and external events models to utilize the same fault trees and databases for event tree and risk monitor models

• Updated internal flooding analysis and incorporated it into the PRA at two sites Unreviewed Analysis Method (UAM)

NEI 12-13 states that an issue identified by the review team can also be classified as an Unreviewed Analysis Method (UAM), which is further clarified in the staffs comments. The peer review noted that the hurricane and tornado hazard analyses used state-of-the-art methodology and up-to-date databases of occurrences, as well as the accepted TORMIS and fragility methodologies. Thus, no UAMs were identified.

Overview Information The BSEP HW and XF PRA peer review was completed prior to the issuance of NEI 12-13.

The peer review process adapted the internal events PRA peer review process outlined in NEI 05-04 used for other PRAs contemporary with the review. NEI 05-04 guidance states that the review team will focus on reviewing, for the technical elements to be reviewed, the host utilitys self-assessment of the applicable elements against the corresponding scope in RG 1.200 Appendix B, and the degree to which the PRA meets the applicable requirements in the ASME/ANS PRA Standard SRs. Therefore, the key aspect of a peer review are the criteria against which the PRA is assessed. For the BSEP HW and XF PRA peer review, the criteria were obtained from the ASME/ANS PRA Standard RA-Sa-2009. As noted in the peer review report, Standard RA-Sa-2009 as clarified and endorsed by RG 1.200 Rev 2 presents an acceptable approach for assessing PRA technical quality. Specific elements of the process employed are described herein.

The review team members began prior to the onsite visit by reviewing the PRA material provided in advance by the utility (Progress Energy at the time), in accordance with NEI 12-13 Section 2.1 Step 1.

Consistent with NEI 12-13 Section 2.1 Step 2, based on the scope of the review, the peer review team was identified. The PRA Peer Review team was composed of contractor personnel knowledgeable in PRA issues and experienced in the performance and application of PRAs.

The PRA Peer Review Team also included peers who are knowledgeable in PRAs for plants similar to the plant being reviewed. The size of the peer review team was determined by first considering the guidance in Section 1-6.2.4 of the ASME PRA Standard suggesting that a full-scope peer review be conducted by a team with a minimum of five members, and shall be performed over a minimum period of one week. The standard goes on to state that if the review is focused on a particular PRA element, such as a review of an upgrade of a PRA Element, then the peer review should be conducted by a team with a minimum of two members, performed over a time necessary to address the specific PRA element.

U.S. Nuclear Regulatory Commission Page 54 of 108 Serial RA-18-0178 Enclosure Additionally, NEI 05-04 states that the number of members of the peer review team and their specific expertise and required level of qualification is a function of the number of PRA technical elements that are being reviewed. The NEI 05-04 guidance also notes that the amount of time required, and the associated logistics, will depend on the scope of the review, the number of reviewers examining each technical element, and the availability of supporting documentation.

Since the Brunswick peer review addressed only two elements (high wind and external flood),

the review was conducted by a team of three members over one day. The effort also included a review of material prior to the onsite visit and review and comment of the review report.

Consistent with the guidance in Section 1-6.2.2 of the ASME PRA Standard, the review team members were:

(1) knowledgeable of the requirements in this Standard for their area of review (2) experienced in performing the activities related to the PRA Elements for which the reviewer is assigned.

Per Sections 7-3.2 and 8-3.2 of the standard (pertaining to high winds and external floods), the peer review team members shall have combined experience in the areas of systems engineering, evaluation of the hazard for the relevant external event, and evaluation of how the external event could damage the nuclear plants structures, systems, or components, or a combination thereof (SSCs). All members of the Brunswick peer review team are experienced PRA personnel, each with a minimum of 20 years of experience in the field of PRA. The Technical Element Lead Reviewers in the Brunswick peer review were assigned to elements according to their level of knowledge and experience. The overall team expertise is sufficient to cover all of the PRA elements reviewed.

NEI 12-13 suggests the peer review team include two utility personnel knowledgeable in the hazard(s) being assessed. Per the guidance, the inclusion of utility personnel is to facilitate the exchange of ideas and techniques for effective use of External Hazards PRA methodologies.

The reviewers for the BSEP HW and XF PRA models have diverse experiences working on a number of PRAs across multiple utilities. Their experiences as well as their expertise in PRA provide the intent of multiple utility participants on the review team.

Additionally, at the time of the peer review there was a scarcity of utility personnel with the specialized experience in the hazards being reviewed. Instead the peer review team included one of the pioneering experts of external hazard analysis, who was/is a key member of the ASME standard writing committees, and whose work is referenced throughout the standard. He was the lead reviewer for the hazards and fragility analyses, while the lead reviewers for the plant response analyses were PRA experts with >20 yrs experience .

Although this exception was not documented, the composition of the review team did meet the intent to ensure there is more than one peer reviewer with experience in each key External Hazards PRA process as stated in NEI 12-13.

Section 6 of the ASME PRA Standard also provides guidance regarding review team member independence with respect to the PRA under review. Per Section 1-6.2.2 of the ASME PRA Standard, review team members shall have neither performed nor directly supervised any work

U.S. Nuclear Regulatory Commission Page 55 of 108 Serial RA-18-0178 Enclosure on the portions of the PRA being reviewed. The Brunswick peer review team did not include any members who had worked on various portions of the Brunswick high wind or external flood PRAs.

Consistent with NEI 12-13 Section 2.1 Step 3, the peer review team observed that the prerequisite activities were completed including a through and conscientious PRA development, recent PRA development and documentation, a self-assessment of the HW and XF PRA against the ASME standard. Prior to the onsite review portion, the review team was selected and team member responsibilities and the schedule were defined by the Review Team Lead.

The review team was provided the materials for review in advance of the on-site review period.

NEI 12-13 Steps 4 through 6 are administrative items leading up to the on-site review.

Interviews with utility personnel involved in this peer review indicate several discussions were held prior to the on-site review to resolve questions, provide materials, and address logistical issues.

Consistent with NEI 12-13 Step 7, during the onsite visit the host utility presented an overview of the PRA and then the review team performed a comprehensive and concentrated review of the PRA documentation, electronic models, and results against the ASME PRA Standard Supporting Requirements criteria. The review team members performed independent study of the PRA against the criteria and consulted with the utility PRA personnel and other review members in order to come to an understanding of the PRA capabilities with respect to the ASME PRA standard criteria.

Consistent with the guidance in NEI 12-13, checklists were utilized along with a supporting requirements (SR) assessment documentation database to provide a structure, which in combination with the review teams experience provides the basis for examining the SRs of the applicable technical elements. The PRA Peer Review process uses capability categories as defined by the PRA Standard to assess the relative technical merits and capabilities of each technical supporting requirement reviewed. Capability category assignments were made based on the judgment of the Peer Review Team after reviewing the PRA, and the associated documentation.

Reviewers were assigned specific areas of focus. Consistent with NEI 12-13 Section 2.1 Step 7 and Section 3.2, at the end of the review for each technical element, the team members conducted consensus discussions to assign Capability Categories to the SRs.

Initial determination of SR status was performed consistent with Section 3.2 of NEI 12-13 which states that determination of the status of an SR should be guided by the following approach from RG 1.200:

...[If] there are a few examples in which a specific requirement has not been met, it is not necessarily indicative that this requirement has not been met. If, the requirement has been met for the majority of the systems or parameter estimates, and the few examples can be put down to mistakes or oversights, the requirement would be considered to be met. If, however, there is a systematic failure to address the requirement (e.g., component boundaries have not been defined anywhere), then the requirement has not been complied with.

U.S. Nuclear Regulatory Commission Page 56 of 108 Serial RA-18-0178 Enclosure This same language from RG 1.200 is quoted in the Peer Review report as the basis for capability category assignments, such that the determination of the SR status performed by the peer review team is consistent with the guidance of NEI 12-13.

Section 3.3 of NEI 12-13 provides the criteria for assignment of capability categories. It states that section 2 of each part of the ASME/ANS PRA Standard presents the risk assessment SRs for each external hazard. These requirements are specified in terms of Capability Category requirements with increasing scope and level of detail, increasing plant-specificity, and increasing realism as SRs satisfy Capability Category I through Capability Category III. The SRs evaluated in the BNP XF and HW peer reviews are listed in Table 3-1 of the peer review report and are identical to those in the ASME standard. Additionally, the interpretation of supporting requirements in Table 3-1 of NEI 12-13 is the same as used by the peer review team, as documented in Table 1-3 of the peer review report. Thus, the assignment of capability categories performed by the peer review team is consistent with the guidance of NEI 12-13.

Also, as noted in the peer review assessment bases for SRs WPR-A4 and XFPR-A4, the high winds and external flooding PRA models were developed by modifying the internal events at-power PRA model according to the requirements in Part 2 of the ASME/ANS PRA Standard.

NEI 12-13 Section 2.1 Step 7c states on-site walkdowns are needed during an external hazard peer review to confirm the relationships between SSCs and the potential effects of an external hazard. The PRA standard Section 8-3.3.4 and Section 7-3.3.4 for the respective hazards, states the peer review team shall review the plant walkdown. Additionally, NEI 05-04 does not require plant walkdowns, even for internal flooding PRA peer reviews. The BNP XF and HW peer review team reviewed the walkdown data for the hazards. The assessment of HW SR WFR-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. The assessment of XF SR XFFR-A1 includes assessment of the walkdown data. This SR is met at capability category II/III with no findings. Thus, the peer review team adequately assessed the relationship between SSCs and the potential effects of the hazard(s).

NEI 12-13 Section 2.1 Step 7d provides guidance on sensitivity studies as needed to address the review teams questions. The PRA models and practitioners were available to the peer review team to provide these studies as needed for the review.

NEI 12-13 Section 2.1 Step 7e provides guidance for the peer review team to assess the maintenance and update process. The BNP HW and XF peer review team did not assess the maintenance and update process during the 2012 peer review. However, both the HW and XF models are based on the internal events model, which was peer reviewed in June 2010. The internal events PRA peer review did assess all MU SRs and found all to be met at capability categories 1-3.

NEI 12-13 Section 2.1 Step 8 describes the process for developing preliminary findings and results of the peer review. The process used in the BNP HW and XF peer review to apply capability categories, identify findings, and reach consensus are described above.

NEI 12-13 Section 2.1 Steps 9 through 14 describe the exit meeting through issuing the final report. The peer review was consistent with these steps as described in NEI 12-13.

U.S. Nuclear Regulatory Commission Page 57 of 108 Serial RA-18-0178 Enclosure Previous Model Use/Application:

There have been two recent BSEP license amendments crediting the HW and XF PRA models, including the peer review in question. Both safety evaluations note the HW and XF PRA peer reviews were completed in accordance with the standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2) and were found acceptable. Note: Determining the PRA peer reviews were completed in accordance with the latest version of the standard is not an application specific conclusion as the PRA either does or does not comply with the standard.

Specifically, the BSEP application to adopt Technical Specifications Task Force (TSTF) traveler TSTF-425 Revision 3 Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b credits use of the high winds and external flood PRA models for surveillance frequency control program (SFCP) evaluations. The NRCs safety evaluation (ML17096A129, May 24, 2017) states:

These models were peer reviewed in 2012 against the ASME PRA Standard ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2. The NRC staff reviewed the F&Os from the 2012 peer review submitted in Table 4 of Enclosure 2 to the LAR. The staff reviewed the summary of the findings, the licensee's resolution to the findings, and the licensee's assessment of the impact on this application. The NRC staff assessed these peer review F&Os to ensure that any deficiencies in meeting Capability Category II can be addressed for the SFCP per the NEI 04-10, Revision 1 methodology. For most F&Os the staff found the licensee's resolution submitted in the LAR acceptable for the application. For four F&Os the staff requested additional information, as discussed below.

Based on the licensee's assessments using the currently applicable PRA standard and revision of RG 1.200, the NRC staff concludes that the level of PRA quality, combined with the proposed evaluation and disposition of gaps, will be sufficient to support the evaluation of changes proposed to surveillance frequencies within the SFCP, and is consistent with Regulatory Position 2.3.1 of RG 1. 177.

Additionally, the BSEP application to extend the emergency diesel generator technical specification 3.8.1 completion time from 7 days to 14 days credits use of the High Winds and External Flood models as part of this risk-informed license action. The NRCs safety evaluation (ML13329A362, February 24, 2014) states:

The licensee assessed the risk from high winds and external flooding using a PRA model that was subjected to an industry peer review in 2012, using the ASME PRA Standard ASME/ANS RA-Sa-2009, as endorsed by the NRC in RG 1.200, Rev 2. The licensee resolved many of their industry peer review findings through additional analysis.

There were four findings from this peer review where the high winds and external flooding PRA model was found not to conform to capability category II of the standard for certain SRs. Three findings were related to documentation and were determined not to impact this application. One finding WPR-A3 identified included some of the structures, systems, or components (SSCs) that were not analyzed for fragility and was later dispositioned by the licensee. These SSCs were treated in a conservative manner (e.g.,

U.S. Nuclear Regulatory Commission Page 58 of 108 Serial RA-18-0178 Enclosure assumed to always fail during a high-winds event) and therefore this issue is not expected to impact the amendment request.

Based on consideration of the gaps to capability category II of the ASME PRA standard and their disposition for this application, the NRC staff finds that the quality of the BSEP High Winds and External Flooding PRA is sufficient to support the proposed license amendment.

b. Discuss how the peer review, including the corresponding process and guidelines discussed in response to part (a), was consistent with NEI 12-13, as modified and accepted by the NRC, and justify deviations from that guidance. Features of the external hazards PRA peer review that should be discussed include the process and extent of walkdowns performed by the peer-review team, the duration of the on-site peer-review for each external hazard PRA, composition and qualification of the peer-review team as cited above from NEI 12-13, and identification of UAMs.

Duke Energy Response to PRA RAI 10.b.:

The response to RAI 10.a. above provides the necessary justification to accept the External Hazard PRA (HW and XF) for the 10 CFR 50.69 application.

PRA RAI 11 - External Flooding Hazard Development - Storm Surge and Initiating Event Frequencies:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, the 2009 version of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard (ASME/ANS RA-Sa-2009). High level requirement (HLRs) in Part 8 of the 2009 ASME/ANS PRA Standard, related to the external flooding technical element, specifically HLR-XFHA-A, calls for the use of site-specific probabilistic analysis to develop the hazard frequency and for the propagation of uncertainties in the model and parameter values to develop a family of hazard curves.

a. Discuss how the initiating event frequencies used in the XF PRA were developed. The discussion should include a description of (1) method(s) used, (2) input parameter selection such as precipitation events intensity and duration, storm surge flooding, stillwater levels, wave runup, and other associated effects, (3) how data were selected for specific analysis including time periods and intensities, and (4) how parametric and modeling uncertainties were addressed to develop a family of hazard curves.

Duke Energy Response to PRA RAI 11.a.:

The BSEP External Flood model initiating event frequency is based on a point estimate from the BNP Individual Plant Examination for External Events (IPEEE), which corresponds to a 20 ft still water flood event and has an initiating event frequency of 7.4E-04/yr. To suppose use of this frequency, a simplistic calculation was completed taking into account the intensity of the hurricane, level of exposure, and likelihood of the hurricane hazard.

In support of other plant activities, an updated storm surge analysis was completed using detailed computational modeling. The detailed analysis confirmed the external flood model

U.S. Nuclear Regulatory Commission Page 59 of 108 Serial RA-18-0178 Enclosure initiating event frequency is a conservative estimate of the hazard frequency and no changes were made to the hazard frequency as a result of the detailed analysis. The detailed analysis is being incorporated into the PRA and will be peer reviewed as described in part b of this RAI.

The detailed analysis is described below.

(1) Method Used A storm surge analysis focused on estimating storm surge and wave induced flooding associated with hurricanes affecting the BNP site was performed by industry subject-matter experts. The study utilized a 500,000 year simulation of synthetic hurricanes occurring in the North Atlantic basin using the vendors peer-reviewed hurricane simulation model. The hurricane model is updated and reviewed every two years as required by the Florida Commission on Hurricane Loss Projection Methodology. The version used in this study was approved by the commission in 2010. This is the same hurricane model that was used to develop the hurricane wind hazard curves for the HW PRA (see response to RAI-13).

The vendors hurricane hazard model is described in detail in various academic literature available for audit. Using the simulated tracks, a hurricane wind speed hazard curve for the BNP site was developed, from which data were retained for 14,217 storms that produced gust wind speeds of 90 mph or greater at BNP. This reduced storm set was used to drive NOAAs SLOSH model (NOAA, 1992) using the fast-running SLOSH wind field model. The 100 hurricanes that produced the highest storm surge elevations at BNP were re-run through the SLOSH model with the vendors wind field model . From these 100 storm surge simulations, the 10 hurricanes producing the highest storm surge at the BNP site were provided to UNC-CH to conduct more detailed storm surge modeling.

The Renaissance Computing Institute (RENCI) and Institute of Marine Sciences (IMS) of UNC-CH conducted a set of storm surge and wind wave simulations for the 10 synthetic storms identified by the vendor. These simulations were conducted using the coupled storm surge and wave model ADCIRC/SWAN to predict the surge and wave response to the pre-determined hurricane storm tracks with the vendors hurricane wind field model . The ADCIRC/SWAN grid used in the recent FEMA flood insurance study was updated to include more accurate topographic detail in the BNP area. As such, the grid resolution used in the hydrodynamic surge-wave modeling performed by UNC-CH was much finer than that associated with the SLOSH model.

The result of this analysis is the estimated still water elevation levels (SWEL), including wave setup and static tidal height, and maximum significant wave heights at 14 locations around the BNP site for each of the 10 storms modeled. Results are produced for four different tide levels, including Mean Sea Level (MSL), Maximum High Water level (MHW), MHW minus 1 foot, and MHW plus 1 foot. Given that these 10 storms produce the highest level of storm surge at BNP over the 500,000 years simulated, the storm that produces the maximum surge is a single realization of the 500,000 year storm surge level (2E-06/yr) and the storm with the 10th highest storm surge is a single realization of the 50,000 year surge level (2E-5/yr). The resulting SWEL and maximum significant wave heights for the intake canal, Service Water Building, and Switchyard are presented in Table 1 and Table 2, respectively. Note that the plant grade is approximately 20 ft above MSL and dashes in the tables indicate there was no inundation at that location for the storm and associated tide level.

U.S. Nuclear Regulatory Commission Page 60 of 108 Serial RA-18-0178 Enclosure Table 1. Still Water Elevation Level above MSL for 10 Storms Modeled SWEL at Intake Canal SWEL at Service Water Building SWEL at Switchyard Rank Storm MHW+1 MHW MHW-1 MSL MHW+1 MHW MHW-1 MSL MHW+1 MHW MHW-1 MSL 1 trk04536_1 22.9 22.0 21.1 20.0 23.0 22.1 21.1 20.4 23.4 22.6 21.6 20.8 2 trk13867_2 21.9 21.0 20.0 19.1 21.9 21.0 - - 21.6 20.7 - -

3 trk11833_3 21.2 20.3 19.5 18.9 21.3 - - - 21.0 - - -

4 trk07223_4 21.0 20.1 19.3 18.2 21.0 - - - 20.5 - - -

5 trk06474_9 20.9 20.1 18.9 17.9 21.0 20.5 20.4 - 22.6 21.9 21.4 21.2 6 trk02401_10 20.3 19.3 18.4 17.5 20.5 20.4 - - 21.5 21.1 20.4 -

7 trk02352_7 19.9 19.1 17.9 16.9 - - - - - - - -

8 trk10785_5 19.7 19.0 17.7 16.8 - - - - - - - -

9 trk01974_6 19.2 18.1 16.9 15.8 - - - - - - - -

10 trk09613_8 19.0 17.9 16.8 15.9 - - - - - - - -

Table 2. Maximum Significant Wave Height for 10 Storms Modeled Max Significant Wave Height (ft) at Max Significant Wave Height (ft) at Max Significant Wave Height (ft) at Rank Storm Intake Canal Service Water Building Switchyard MHW+1 MHW MHW-1 MSL MHW+1 MHW MHW-1 MSL MHW+1 MHW MHW-1 MSL 1 trk04536_1 4.3 4.3 4.2 4.2 1.5 1.2 0.9 - 1.7 1.1 0.6 0.3 2 trk13867_2 4.4 4.3 4.3 4.2 1.4 1.1 - - 0.7 0.3 - -

3 trk11833_3 4.5 4.4 4.3 4.2 1.3 - - - 0.4 - - -

4 trk07223_4 4.7 4.6 4.5 4.5 0.9 - - - 0.3 - - -

5 trk06474_9 3.4 3.4 3.2 3.2 0.7 0.5 0.4 - 1.1 0.8 0.7 0.5 6 trk02401_10 3.6 3.6 3.5 3.5 0.6 0.5 - - 0.6 0.6 0.3 -

7 trk02352_7 4.0 3.9 3.9 3.9 - - - - - - - -

8 trk10785_5 5.4 5.3 5.3 5.2 - - - - - - - -

9 trk01974_6 4.3 4.3 4.2 4.1 - - - - - - - -

10 trk09613_8 4.5 4.5 4.4 4.4 - - - - - - - -

(2) Input Parameter Selection The method described above relates only to the storm surge hazard. This storm surge analysis produced estimates of storm surge induced still water elevation levels and maximum significant wave heights at 14 locations for 10 synthetic hurricanes. These 10 storms were selected from a 500,000 year hurricane simulation that were identified as having the greatest potential for producing maximum storm surge at BNP using the coarse SLOSH model. The SWEL estimates include the effects of wave setup and a static tidal height.

Wave runup is generally calculated using empirical methods that consider the slope of the beach or dune that the waves are running up onto. Given the flat nature of the BNP site, any calculation of wave runup would have negligible effect on the overall results of the storm surge analysis. As such, wave runup was not considered in the BNP storm surge analysis.

(3) How Data were Selected Data selected for use in the storm surge analysis were selected based on the best available information to perform a state-of-the-art hurricane storm surge analysis.

Data used to develop the 500,000 year synthetic hurricane storm set include the sources listed below.

U.S. Nuclear Regulatory Commission Page 61 of 108 Serial RA-18-0178 Enclosure

a. HURDAT - contains tropical cyclone positions, maximum wind speed, and central pressure (if available) every 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b. Aircraft measurements of pressures and wind speeds

c. Landfall data

d. Dropsonde data,

e. Sea surface temperatures

f. Tropopause temperatures

g. Wind shear The ADCIRC/SWAN modeling used the high-resolution ADCIRC grid developed for the FEMA-funded North Carolina Flood Insurance Study as the starting point for this projects grid. From the FEMA coastal flood hazard perspective, the BNP site is well above the 1% annual chance level of flooding, and hence was not included in detail in the original FEMA grid. Because of this, the FEMA grid was modified for this study based on available digital imagery, ortho-photographs, and LiDAR to improve the representation of the study area (lower Cape Fear River).

(4) How Parametric and Modeling Uncertainties were Addressed to Develop a Family of Hazard Curves The approach described in Items (1) to (3) led to the following estimates: the mean estimate of the 1E-05 annual exceedance probability hurricane-induced water level is 18.5 ft above National Geodetic Vertical Datum of 1929 (NGVD 29). The mean estimate of the 2E-06 annual exceedance probability water level is 20.3 ft above NGVD 29.

In the external flood probabilistic risk assessment (XF PRA), a point estimate from the BNP Individual Plant Examination for External Events (IPEEE) was used, which corresponds to a 20 ft still water flood event and has an initiating event frequency of 7.4E-04/yr. Comparing that point estimate to those of the ARA and UNC-CH study shows that it is appreciably conservative (i.e., the 20-ft water level of the storm surge is considered to occur with a much higher frequency in the XF PRA than estimated in the ARA and UNC-CH study). In light of that conservatism, the XF PRA did not develop a family of hazard curves.

b. It appeared from the audit discussions that the method presented to support the technical acceptability of the flood hazard development for this application has not been peer-reviewed. Discuss and provide the results of a focused-scope peer-review, including the resolution of finding level Facts and Observations (F&Os) not closed using a NRC approved process, for the development of the initiating event frequencies that will be used in the XFPRA.

Duke Energy Response to PRA RAI 11.b.:

Duke Energy will complete a focused scope peer review of the BNP External Flood PRA model hazard development prior to implementation of 10 CFR 50.69. Any findings from the focused scope peer review will be resolved and closed per an NRC approved process prior to implementing 10 CFR 50.69.

U.S. Nuclear Regulatory Commission Page 62 of 108 Serial RA-18-0178 Enclosure PRA RAI 12 - External Flooding Hazard Development - Local Intense Precipitation and Screening:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA-Sa-2009. Section 8-2 of the 2009 ASME/ANS PRA Standard indicates that certain flooding phenomena can be screened out using the screening methods in Part 6 of the cited PRA Standard. Part 6 of the 2009 ASME/ANS PRA Standard provides criteria for screening along with associated supporting requirements (SRs) and peer-review.

The summary of the staffs review of the licensees reevaluated flood-causing mechanisms, included in the letter dated March 16, 2017 (ADAMS Accession No. ML17072A364), stated that the reevaluated flood hazard results for the local intense precipitation (LIP), streams and rivers, failure of dams and onsite water control/storage structures, storm surge, and tsunami flood-causing mechanisms were not bounded by the current design basis. Such flooding mechanisms may lead to flooding in excess of plant grade such that water impinges upon plant structures.

Further, use of the licensees design basis to screen out certain flooding phenomena does not address the frequency of exposure to floods (including lower than the design basis flood) that may impinge upon SSCs and challenge plant safety, the impact of associated effects and the temporal characteristics of the event (e.g., the period of site inundation), and the risk associated with those floods.

a. In light of the above information, describe and justify the approach used for screening out any flooding mechanism from inclusion in the licensees XF PRA. The descriptions should include justification for any credit taken for permanent, passive, or active flood protection features.

Duke Energy Response to PRA RAI 12.a.:

The approach used in the external flooding probabilistic risk assessment (XF PRA) for screening out flooding mechanisms is summarized below. The local intense precipitation (LIP) flooding mechanism is addressed separately in the response to Part b of this RAI.

A flooding mechanism is screened out from the XF PRA for one of the following two reasons:

• The flooding mechanism is not applicable to the site. For example, extreme lake flooding is screened out because Brunswick Steam Electric Plant (BSEP) is not located in the vicinity of a lake.

• A demonstrably conservative deterministic analysis of the flooding mechanism finds that its flood elevation does not reach the nominal site grade elevation of the buildings that host the structures, systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The deterministic analysis used for screening out a flood mechanism is demonstrably conservative in that it fulfills the following criteria:

U.S. Nuclear Regulatory Commission Page 63 of 108 Serial RA-18-0178 Enclosure

• It accounts for the characteristics of the underlying flooding mechanism (including, as relevant, associated effects such as waves and runup) to ensure that there is no potential for the flood mechanism to impinge on credited SSCs.

• It relies on the site grade elevation, which is an inherently rugged feature of site topography, is permanent, passive, and not significantly affected by the flooding mechanism.

• It provides a margin between the conservatively determined flood elevation and the occurrence of cliff-edge effects.

Besides LIP (addressed in the response to Part b of this RAI), the letter dated March 16, 2017 (ADAMS Accession No. ML17072A364) identified the following flooding hazards as not bounded by the current design basis: 1) streams and rivers, 2) failure of dams and onsite water control/storage structures, 3) tsunami, and 4) storm surge. For the first three hazards, the BSEP design basis was not bounded because it did not include flood elevations. A subsequent demonstrably conservative analysis calculated these flood elevations and established, with sufficient margin, that they did not reach the nominal site grade elevation, allowing for their elimination in the XF PRA. This left the fourth hazard (i.e., storm surge) as requiring further evaluation in the XF PRA.

b. Describe, with justification, how LIP was considered in the licensees XF PRA. Include discussion of precipitation event intensity and duration (with source of information), any hydrologic and hydraulic modeling, and elevations of LIP induced flooding that supported the consideration.

Duke Energy Response to PRA RAI 12.b.:

The LIP flood causing mechanism was screened from inclusion in the XF PRA. The approach used to screen out flooding mechanisms is the same as described in RAI-12.a. response.

Particularly the portion described below:

• A demonstrably conservative deterministic analysis of the flooding mechanism finds that its flood elevation does not reach the nominal site grade elevation of the buildings that host the structures, systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The methodology of the demonstrably conservative hazard analysis can be found in the flood hazard reevaluation report (FHRR) as submitted to NRC on March 11, 2015 (ML15079A385).

This document contains the information necessary to address event intensity and duration, along with the hydrologic and hydraulic modeling. The resulting water surface elevations (WSEs) across the site can be found in the Interim Staff Guidance (ISG) document published after an NRC audit on the results (ML17072A364). Lastly, the analysis on the impacts from the revised hazard levels are provided in the Focused Evaluation (FE) (ML18270A372) submitted on September 27, 2018. The ISG reported that a LIP event would produce standing water above only two door thresholds in the Reactor Building (D-2 & D-3). In the FE, it was shown that leakage through the air lock door would be very minimal and floor drains or stairwells are present to route the water into the Reactor Building Basement sump area with ample volume to store the water prior to reaching any SSCs.

U.S. Nuclear Regulatory Commission Page 64 of 108 Serial RA-18-0178 Enclosure The FE describes the available physical margin (APM) from the in-leakage water collecting in the basement to the lowest SSC on a one-foot pedestal. Therefore, the APM is calculated to be 0.7 feet with a depth of water of 0.3 feet. These calculated values were justified as conservative based on the following assumptions:

1. Sump pumps are not credited in actively removing water. They are considered a defense-in-depth measure to remove in-leakage from the RB basement.

2. A WSE of 22 ft was assumed at both Doors D-2 and D-3, where the actual WSE were 20.79 ft and 21.07 ft, respectively. This conservative assumption for the WSE yields a conservative in-leakage rate of 30 gpm. The actual in-leakage is anticipated to be lower.

Given the above assumptions, inputs and calculation results, the LIP flood hazard was screened from inclusion in the XF PRA based on conservative deterministic analysis showing there are no impacts to SSCs from a LIP event.

c. Identify and describe any topographic changes to the site that can invalidate prior analyses (e.g., Individual Plant Examination for External Events) for screening or mitigation of external flooding hazards.

Duke Energy Response to PRA RAI 12.c.:

The demonstrably conservative deterministic analysis used to screen out flooding mechanisms accounted for site-specific topographical information to produce flooding elevations and was recently updated for the FE (ML18270A372). These flooding elevations were developed in concert with the NRC, audited and found appropriate for the BSEP site as noted in NRC Letter, Brunswick Steam Electric Plant, Units 1 and 2 - Interim Staff Response to Reevaluated Flood Hazards Submitted In Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation (CAC Nos. MF6104 and MF6105), dated March 16, 2017, ADAMS Accession Number ML17072A364.

PRA RAI 13 - High Winds Hazard Development:

Discuss the approach followed for the development of hazard curves for the extreme winds, tornadoes, and hurricanes used in the BSEP HW PRA. For each hazard, the discussion should include information on the (i) source(s) of data, (ii) the process used to develop the corresponding non-exceedance curves, (iii) consideration of uncertainties in parameter values, and (iv) the sources of model uncertainty and key assumptions.

Duke Energy Response to PRA RAI 13:

Four types of extreme winds can affect the BNP site in Southport, NC, including hurricanes, thunderstorms, extra-tropical storms, and tornadoes. Location-specific analyses of each of these wind hazards were performed with appropriate data sets from the National Weather Service (NWS), National Climatic Data Center (NCDC), National Severe Storm Prediction Center (NSSPC), and the National Hurricane Center (NHC). State-of-the-art methods were used to develop best-estimates of the high wind hazard that are not intended to be conservatively biased. Uncertainties in these estimates were used to estimate the 5th and 95th percentile confidence bounds around mean values. Figure 1 presents the individual mean wind hazard

U.S. Nuclear Regulatory Commission Page 65 of 108 Serial RA-18-0178 Enclosure curves by wind hazard type and an overall combined wind hazard curve developed for the BNP HWPRA.

Brnnis,wi'd Plaint Safety Envelope I.OE+4!0 ~ - - - - - - - - - - - ~

Thunde<storm Winds

- tturrk:aneWinds 1.0E-01 - Ematropi<al Storms

- Tornado

- Combined 1.0E-02

~

5

.i 1 .0E-03,

...E e

C:

"g

., l.0E-04 *

~

w

~

E l.0E-05 - ---- _...,_- 1tl--- - - - - - - i

~

l.0E 1 .0E-07 l.0E-08 -~ ~ --+-~ ~..._..~ ~ ~~ ........~~

50 100 150 200 250 300 Peak Gust Wind Speed (mph) at mm in Open Terrain Figure 1. Mean Wind Hazard Curves for Brunswick Plant Safety Envelope The sources of data, methods to develop the hazard curves, and uncertainties considered are specific to each wind hazard type and are summarized below:

1. Hurricane Winds:

i. Source of data: Data used include the sources listed below.

a. HURDAT- contains tropical cyclone positions, maximum wind speed , and central pressure (if available) every 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b. Aircraft measurements of pressures and wind speeds

c. Landfall data

d. Dropsonde data,

e. Sea surface temperatures

f. Tropopause temperatures

g. Wind shear ii. Process to develop non-exceedance curves: The hurricane hazard wind speed curve was developed using a combination of two hazard curves . These curves

U.S. Nuclear Regulatory Commission Page 66 of 108 Serial RA-18-0178 Enclosure are the results of a 10 million year hurricane simulation performed for the NRC (NUREG/CR-7005) and a second specific study developed using a 500,000 year simulation. The hurricane hazard model used in the study has formed the basis for the US national wind loading standard, ASCE 7, from 1998 through to the present. Details of this model are presented in various academic literature and are available for audit. This hurricane model is updated and reviewed every two years as required by the Florida Commission on Hurricane Loss Projection Methodology. The version used in this study was approved by the commission in 2010.

iii. Uncertainties in parameter values: Estimates of uncertainties were developed using the uncertainty estimates presented in Vickery, et al. (2009b). Uncertainties were considered for the following parameters:

Uncertainty Type Number Parameter Basis for Quantification Hurricane Occurrence Rate, RMW, Holland B, Propagation of component errors as Modeling 1 Central Pressure, Translation Speed given in Vickery et al. (2009b)

Judgment, chosen to double the variance 1 Inland Decay of the error from Vickery et al. (2009b) given above Random Derived from comparisons of modeled 2 Wind Field Model Error and observed wind speeds from historical hurricanes iv. Sources of model uncertainty and key assumptions: Sources of modeling uncertainty are discussed above. Key assumptions in the Hurricane Wind Hazard Analysis were identified based on research and development of hurricane wind field and occurrence models, sensitivity analyses, and engineering judgment.

The key assumptions include:

a. The historical information on hurricanes during the last 100 years is representative of the hurricane wind climate during the life of the plant.

b. The hurricane simulation model provides a good representation of the hurricane hazard at the BNP site.

2. Thunderstorm and Extra-Tropical Storm Winds:

i. Source of data. Gust wind speed data from Wilmington (NC) International Airport (KILM) during the period of 1972 through 2009 was used in the analysis. These data were obtained from the National Climatic Data Center (NCDC) and contain the daily maximum gust wind speed, associated wind direction, and a daily thunder indicator.

U.S. Nuclear Regulatory Commission Page 67 of 108 Serial RA-18-0178 Enclosure ii. Process to develop non-exceedance curves: The daily maximum wind speed data were separated into two data sets based on the thunder indicator.

Thunderstorm wind gusts were defined as the maximum gust wind speed recorded on a day when thunder was reported. All other daily maximum wind speeds were maintained in the extra-tropical storm dataset. Wind speed data were adjusted (increased) to account for local surface roughness effects around the KILM anemometer and to adjust 5-second block averaged gust data to an equivalent 3-second running average gust wind speed. The wind hazard curves for the thunderstorm and extra-tropical storm winds were developed using a Type I extreme value analysis.

iii. Uncertainties in parameter values: Figure 1 shows that winds associated with thunderstorms and extra-tropical storms have virtually no effect on the estimate of the combined wind speed for annual exceedance probabilities less than about 0.05 (return periods of about 20 years). As a result, uncertainties in the thunderstorm and extra-tropical storm hazard analyses were not addressed in this analysis.

iv. Sources of model uncertainty and key assumptions: Model uncertainties were not considered as discussed above. There are no key assumptions for the thunderstorm and extra-tropical storm hazard analyses because the analyses showed that these hazards had a negligible effect on the wind hazard (see Figure 1), hence the effect on the overall HW PRA will be negligible as well.

3. Tornado Winds:

i. Source of data: NCDC/NSSPC data for the years 1950-2009 were used for this analysis. These data have been screened to eliminate coding errors in the record fields. In addition, corrections have been introduced to account for reporting efficiency and time series, or other potential errors resulting from the indirect characteristics of the available data.

ii. Process to develop wind speed frequency curves: Analysis of the NCDC tornado data follows the approach developed and adopted for the TORMIS methodology and enhancements for tornado wind speed risk analysis using the TORRISK methodology. Figure 2 summarizes the overall approach for the BNP site-specific tornado hazard analysis. This analysis included the following steps:

a. A homogenous tornado sub-region around BNP was developed using statistical cluster analysis on a 15 degree by 15 degree lat-long grid centered on the BNP site. Tornadoes in the NCDC data set were mapped on the grid, as shown in Figure 3, and analyzed for key tornado risk variables - including occurrence rate, point strike probability, and path

U.S. Nuclear Regulatory Commission Page 68 of 108 Serial RA-18-0178 Enclosure direction - using the EML CLUSTER procedure in SAS (SAS Institute, 1992). One- and three-degree clustering sets were produced to aid in development of the final BNP subregion.

b. The final subregion selected is shown in Figure 4. This method addresses both broad regions and small areas around the plant site.

c. The BNP subregion data set was analyzed to produce tornado occurrence rate, intensity, path length, path width, and path direction.

Probability distributions were developed for each of these variables and their correlations, as appropriate.

d. The TORRISK computer code was then used to develop a family of tornado hazard curves and strike probabilities for a single point (for use with wind pressure fragilities), and for the BNP safety envelope (for use with wind missile fragilities).

iii. Uncertainties in parameter values: Several epistemic (modeling) and aleatory (random) uncertainties were considered. The following table summarizes the epistemic and aleatory parameters/models. These uncertainties were propagated in a two loop Monte Carlo simulation model using TORRISK to produce percentile curves and a derived mean wind speed frequency curve.

Uncertainty Number Parameter Basis for Quantification Type Considered statistical uncertainty in the Tornado Occurrence 1 number of reported tornadoes, based on Rate the number of years of record.

Developed frequency distributions from as-reported data, and updated distributions reflecting tornado classification errors from Tornado F/EF 2 observed damage. These frequency Epistemic Distribution distributions were weighted to reflect the uncertainties in the distribution of intensities.

Judgment based weights on F, F', and EF Tornado F/EF-Scale 3 damage scale wind speeds to reflect the Wind speeds uncertainties in tornadic wind speeds Tornado Occurrence Number of tornadoes in plant subregion 1

Rate and analysis of reporting trends by F-scale Number of tornadoes in each intensity Aleatory 2 Tornado Intensity scale; reporting trends; error analysis Variation of intensity Mapping of tornado damage for selected 3

along tornado path events

U.S. Nuclear Regulatory Commission Page 69 of 108 Serial RA-18-0178 Enclosure Uncertainty Number Parameter Basis for Quantification Type 4 Wind Speeds Tornado wind speeds given damage Analysis of lat-long positions of starting 5 Path Direction and ending point of tornado path Analysis of path length data conditional on 6 Path Length F-Scale Analysis of path width data conditional on 7 Path Width F-Scale and path length.

Quantification of Translation Speed, Rmax, inflow parameter, Boundary Layer height, Tornado Wind Field velocity profile, core slope parameters 8

Parameters developed in the Tornado Missile Risk Analysis products from EPRI (NP-769 and NP-2005).

iv. Sources of model uncertainty and key assumptions: Sources of modeling uncertainty are listed in item 3.iii above. The approach used to identify the key assumptions are based on research and analysis of the tornado database, structural response to tornado wind fields, modeling, sensitivity analyses, and engineering judgment. Some of the major assumptions in tornado hazard development include:

a. Wind speeds associated with tornado damage intensity scales, such as the F, F, and EF Scales.

b. Assumptions regarding tornado reporting efficiencies for different eras of the database and uncertainties in tornado occurrence rates.

c. The probability distribution of tornado intensities.

d. Tornado wind field parameters.

e. Items a, b, and c were modeled with epistemic uncertainties and then fully propagated to develop a derived mean tornado hazard curve and estimated percentiles.

f. The Item d parameters were modeled as random variables in the model with statistical ranges to reflect the natural variations observed in the data regarding tornado wind fields and damage swaths.

U.S. Nuclear Regulatory Commission Page 70 of 108 Serial RA-18-0178 Enclosure

1. lde11ti.fy S11bregio11

• H01nogeneous

• Sufficient

• Robm,t

1. A11a{l*::.e l,,tacro S11bregio11 Data 3. Use Micro Dntn Base

• Occurrence Rate

• Windfield Model

• Intensity

• Path length Intensity Variation

• Path Lengtl1

• F-Scale Wind Speeds

• Path Widt11

• Path Length Transfommtiom;

• Path Direction

• Path Width Transformations

4. :.lfodel nud Ann(l'::.e Uucertninriesl

• Occurrence Rate Uncertainties

• Annual Reporting T1*end

• F-Scale Classification Errors

• F-Scale Wind Speeds

• Random Uncertainties TORRISK TORJlflS' Si11111lariom /11p11ts Figure 2. Methodology for Tornado Wind Hazard Analysis

U.S. Nuclear Regulatory Commission Page 71 of 108 Serial RA-18-0178 Enclosure

~i-E-f;;-;.=ciQ-~~=""'j~- -,'t"':---+.'D'~~+ ---, I.,

Longitude fO f'2 F3 Figure 3. Tornado F-Scale Mapping Shown on 3 Degree Grid used for Cluster Analysis Longltudo Figure 4. Final BNP Subregion for Tornado Hazard Analysis

U.S. Nuclear Regulatory Commission Page 72 of 108 Serial RA-18-0178 Enclosure PRA RAI 14 - Wind Generated Missile Hazard Development:

Discuss the approach followed for the evaluation and development of wind-generated missile hazard for inclusion in the BSEP HW PRA. The discussion should include the approach used to (i) to identify and assess the number, type and location of potential missiles, and (ii) to determine the frequency of damage on individual SSCs from high-winds and tornado generated missiles. Justify any deviation(s) from using a plant-specific high wind missile analysis methodology for determining the frequency of damage resulting from missiles generated by high-winds and tornadoes on individual SSCs and demonstrate the impact of identified deviation(s) on this application.

Duke Energy Response to PRA RAI 14:

Approach to identify number, type, and location of potential missiles:

A detailed survey of the BNP site was conducted to develop an inventory of potential wind missiles following the TORMIS methodology. The process to document potential wind missiles located within 2,500 feet of the HW PRA SSCs included:

1. Dividing the plant and surrounding area into 31 relatively homogenous missile source zones as shown in Figure 1.

a. Missiles observed in each zone were counted and classified into the 22 potential missile types presented in Table 3.

b. The number of potential tree missiles in forested areas was estimated based on the treed area determined from aerial photos and tree density information from the US Department of Forestry for Brunswick County, NC.

c. Table 4 presents the number of missiles for each missile source zone and missile type. The survey resulted in a total of 114,327 potential zone-origin missiles.

2. Identifying 62 missile source structures that are likely to fail in extreme winds and tornadoes. The list of missiles source structures included in the analysis are shown in Table 5.

a. Inventories of buildings were surveyed and classified as potential missiles followed the same process used for missile zones

b. Total number of missiles from the failure of structures was estimated based on observed construction types and building dimensions.

c. Table 6 presents the number of missiles for each missile source structure and missile type. The survey resulted in a total of 121,668 potential structure-origin missiles.

3. Identifying nine Category I, reinforced concrete structures that provide missile shielding to the SSCs, including:

a. Unit 1 and 2 Turbine Buildings below the turbine operating floor,

b. Unit 1 and 2 Reactor Buildings,

c. Control Building,

d. Radwaste Building,

e. Diesel Generator Building

f. Off-gas Building, and

g. Service Water Building

U.S. Nuclear Regulatory Commission Page 73 of 108 Serial RA-18-0178 Enclosure Figure 5. BNP Missile Origin Zones used for Missile Fragility Analysis

U.S. Nuclear Regulatory Commission Page 74 of 108 Serial RA-18-0178 Enclosure Table 3. Tornado Missile Types and Characteristics used in BNP Missile Survey Penetration Length L Depth Width Area Final Sequential Weight per Missile Aero Set No. (feet) d b Unit Length Amin 2

Subset Aero Set (MTRANS) Missile Description (Typical) Material (in) (in) (lb/ft) (in ) Weight (lbs) 1* 1a 1 Rebar Steel 3.00 1.00 1.00 2.67 0.79 8.01 2 1c 1 Gas Cylinder Steel 5.00 10.02 10.02 38.64 9.45 193.20 3 1d 1 Drum, Tank Steel 5.00 19.98 19.98 23.55 311.60 117.75 4* 2b 2 Utility Pole Wood 35.00 13.50 13.50 32.06 143.10 1122.10 5 2c 2 Cable Reel Wood 1.76 42.21 42.21 140.70 126.60 247.63 6* 3b 3 3 Pipe Steel 10.00 3.50 3.50 7.58 2.20 75.80 7* 3c 3 6 Pipe Steel 15.03 6.63 6.63 18.90 5.60 284.07 8* 3d 3 12 Pipe Steel 15.00 12.75 12.75 49.60 14.60 744.00 9 5b 4 Metal Storage Bin Steel 6.00 38.40 36.00 112.50 40.50 675.00 10 8a 5 Concrete Masonry Unit Concrete 1.33 8.00 8.00 33.33 64.00 44.33 11* 9a 6 Wood Beam Wood 12.00 12.00 4.00 9.50 48.00 114.00 12 11a 7 Wood Plank Wood 10.00 12.00 1.20 3.30 12.00 33.00 13 12a 8 Metal Siding Steel 30.00 12.00 2.25 6.33 27.00 189.90 14 13a 9 7/8" Plywood Sheet Wood 8.00 48.00 1.00 25.00 24.00 200.00 15 14b 10 Wide Flange (W14x26) Steel 15.00 11.29 5.03 27.87 8.16 418.05 16 16a 11 Channel Section (6 x 13) Steel 18.00 5.11 3.83 11.88 3.49 213.84 17 18a 12 Small Equipment Steel 8.00 46.48 30.00 44.02 4.63 352.16 18 19a 13 Large Equipment Steel 12.00 67.07 36.00 88.67 15.70 1064.04 19 22a 14 Steel Grating Steel 6.00 43.31 1.00 12.37 2.22 74.22 20 22b 14 Large Steel Frame Steel 24.35 97.41 32.47 47.23 11.00 1150.05 21* 25a 15 Vehicle Steel 15.95 66.00 66.00 250.00 2574.00 3987.50 22 26a 16 Tree Wood 20.00 8.00 8.00 35.00 50.27 700.00

• Denotes membership in the 1975 NRC Missile Spectrum Table 4. Number of Zone Missiles by Missile Type and Zone Zone Number Subset Missile Description 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 Rebar 0 0 11 429 0 0 0 28 3750 1745 0 2893 1335 0 0 0 2 Gas Cylinder 0 0 135 146 0 0 0 0 37 63 0 0 77 0 0 0 3 Drum, Tank 0 0 2 17 4 6 0 3 9 13 0 97 5 0 0 0 4 Utility Pole 0 0 3 0 0 6 0 0 18 2 0 0 0 1 2 4 5 Cable Reel 0 0 3 15 0 0 0 16 42 190 0 52 16 0 0 0 6 3 Pipe 62 7 473 811 0 115 3476 3012 898 526 0 1708 554 890 5 10 7 6 Pipe 15 24 0 42 0 0 362 0 325 19 0 27 9 2 0 0 8 12 Pipe 0 0 15 16 8 33 5 4 130 46 0 38 35 53 10 100 9 Metal Storage Bin 0 0 8 60 0 0 0 6 1 9 0 59 17 0 1 0 10 Concrete Frag. (Concrete Block) 0 0 4 350 0 0 0 288 9834 645 0 573 0 0 0 0 11 Wood Beam 0 0 22 113 0 6 0 36 46 9 0 100 78 124 0 0 12 Wood Plank 0 0 169 624 0 0 0 1 5 1 0 94 120 186 0 0 13 Metal Siding 0 0 36 441 0 0 0 59 13 243 0 30 84 0 0 0 14 7/8" Plywood Sheet 0 0 35 212 0 2 0 16 131 175 0 204 70 0 0 0 15 Wide Flange (W14x26) 0 0 6 63 0 0 157 0 53 1 0 117 18 8 0 0 16 Channel Section (6 x 13) 0 0 0 65 0 2 16 35 155 56 0 27 79 0 0 12 17 Small Equipment 3 0 12 30 0 2 13 48 1 7 0 23 6 7 1 0 18 Large Equipment 4 0 12 24 2 2 76 35 1 7 0 4 3 2 0 0 19 Steel Grating 7 0 169 352 0 5 10 116 847 65 0 595 86 100 0 2 20 Large Steel Frame 0 0 3 25 0 5 92 0 66 27 0 44 3 0 0 0 21 Vehicle 83 308 8 20 0 0 0 14 34 17 0 71 29 5 1 0 22 Tree 0 309 0 0 0 0 0 0 260 0 1220 922 0 3182 7839 1644 Total Missiles 174 648 1126 3855 14 184 4207 3717 16656 3866 1220 7678 2624 4560 7859 1772 Zone Area (*10000 sf) 34.02 39.18 19.19 24.49 6.60 10.53 27.51 20.26 28.33 17.98 14.74 72.56 55.59 131.75 125.87 152.17 Missiles / 10000 sf 5 17 59 157 2 17 153 183 588 215 83 106 47 35 62 12 Zone Number Subset Missile Description 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Total 1 Rebar 0 0 2 44 95 4 0 0 0 0 0 0 71 797 0 11204 2 Gas Cylinder 0 0 0 0 6 0 0 0 0 0 0 0 63 32 7 566 3 Drum, Tank 0 0 0 0 13 1 0 0 0 0 0 0 10 21 0 201 4 Utility Pole 0 0 12 8 0 4 0 0 0 0 0 0 0 0 0 60 5 Cable Reel 0 0 1 0 18 0 0 0 0 0 0 0 7 8 0 368 6 3 Pipe 0 0 120 644 88 98 0 60 0 0 0 0 1049 1660 1 16267 7 6 Pipe 0 0 0 18 0 4 0 0 0 0 0 0 14 24 0 885 8 12 Pipe 0 0 0 0 3 0 0 0 0 0 0 0 16 18 0 530 9 Metal Storage Bin 0 0 1 6 43 10 0 0 0 0 0 0 17 36 5 279 10 Concrete Frag. (Concrete Block) 0 0 0 42 0 0 0 0 0 0 0 0 337 49 0 12122 11 Wood Beam 0 0 0 14 10 0 0 0 0 0 0 0 3 189 4 754 12 Wood Plank 0 0 3 0 107 0 0 0 0 0 0 0 20 753 21 2104 13 Metal Siding 0 0 24 0 734 100 0 0 0 0 0 0 141 142 0 2047 14 7/8" Plywood Sheet 0 0 3 0 100 3 0 0 0 0 0 0 74 254 7 1286 15 Wide Flange (W14x26) 0 0 3 0 88 24 0 0 0 0 0 0 29 20 0 587 16 Channel Section (6 x 13) 0 0 5 25 148 72 0 0 0 0 0 0 193 182 0 1072 17 Small Equipment 0 0 12 0 18 29 0 0 0 0 0 0 22 27 0 261 18 Large Equipment 0 0 9 0 0 3 0 0 0 0 0 0 26 68 0 278 19 Steel Grating 0 0 37 239 18 50 0 0 0 0 0 0 461 407 3 3569 20 Large Steel Frame 0 0 0 0 6 36 0 0 0 0 0 0 6 30 2 345 21 Vehicle 0 0 0 281 0 6 0 0 0 0 0 0 17 22 16 932 22 Tree 5731 8242 7283 223 5837 497 5741 136 2241 3355 3947 0 0 0 0 58610 TOTAL 5731 8242 7515 1544 7332 941 5741 196 2241 3355 3947 0 2576 4739 66 114327 Zone Area (*10000 sf) 81.80 113.64 107.38 45.75 108.20 32.89 77.31 125.94 135.68 50.75 49.26 42.94 24.77 19.26 14.22 1810.54 Missiles / 10000 sf 70 73 70 34 68 29 74 2 17 66 80 0 104 246 5 63

U.S. Nuclear Regulatory Commission Page 75 of 108 Serial RA-18-0178 Enclosure Table 5. List of Missile Source Structures Included in BNP Missile Fragility Analysis Missile Source Zone Missile Source Zone Structure Description Structure Description Structure Number Location Structure Number Location 100 TAC 1 131 Clean Trash Monitoring 12 101 Central Access Building 1 132 New Plant Garage 13 102 Doc Control Bldg 1 133 Warehouse 6 13 103 Training Center 22 134 Warehouse 7 13 104 Contractor Building 1 3 135 Warehouse 10 13 105 Contractor Building 2 3 136 Receiving Building 13 106 Clean Maintenance Shop 3 137 Aux Boiler 29 107 Metal Building 3 138 Contaminated Storage Building 29 108 Fire House 3 139 Mini Storage 29 109 Security Office 4 140 RMCSB Bldg 30 110 Administration Building 4 141 Diesel Fire Pump Building 30 111 Maintenance Bldg Part 1 4 142 Control Building Roof Top N/A 112 Maintenance Bldg Part 2 4 143 Lower Reactor Building Roof Unit 2 N/A 113 Scrub Storage Building 4 144 Lower Reactor Building Roof Unit 1 N/A 114 Paint and Used Oil Building 4 145 Turbine Building Units 1&2 - 3rd Floor N/A 115 Clean Tool Warehouse 4 146 TB North Siding N/A 116 Service Building 4 147 TB West Siding N/A 117 Clean Maintenance Shop 4 148 TB East Siding N/A 118 Material Issue 4 149 TB South Siding N/A 119 TeleCom Bldg 6 150 TB Roof N/A 120 Garage 8 151 Reactor Unit 2 Roof N/A 121 Diesel Repair Shop 8 152 Reactor Unit 2 North Wall Siding N/A 122 Insulation Fab Shop 8 153 Reactor Unit 2 South Wall Siding N/A 123 Maintenance&Equipment 8 154 Reactor Unit 2 West Wall Siding N/A 124 Laydown Buidling 10 155 Reactor Unit 2 East Wall Siding N/A 125 Chemical Storage 10 156 Reactor Unit 1 - 5thFloor N/A 126 Mechanical Fab Shop 10 157 Reactor Unit 1 Roof N/A 127 Oil Storage 12 158 Reactor Unit 1 North Wall Siding N/A 128 Chemical Storage 12 159 Reactor Unit 1 South Wall Siding N/A 129 Sand Blast Storage 12 160 Reactor Unit 1 West Wall Siding N/A 130 Paint Office 12 161 Reactor Unit 1 East Wall Siding N/A

U.S. Nuclear Regulatory Commission Page 76 of 108 Serial RA-18-0178 Enclosure Table 6. Number of Structure Origin Missiles by Structure and Missile Type Missile Source Structure Number Subset Missile Description 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 1 Rebar 6192 215 516 1565 91 63 179 6 0 344 275 460 1699 38 31 432 619 243 2 Gas Cylinder 0 0 0 0 12 0 8 0 37 0 0 8 29 2 21 12 0 28 3 Drum, Tank 0 0 0 0 14 0 8 1 0 0 0 23 86 7 44 1 0 52 4 Utility Pole 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 5 Cable Reel 0 0 0 0 2 0 1 1 0 0 0 31 115 10 0 0 0 32 6 3 Pipe 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 7 6 Pipe 0 0 0 0 41 0 10 0 0 0 0 0 0 0 5 0 0 36 8 12 Pipe 0 0 0 0 5 0 4 0 0 0 0 0 0 0 2 0 0 12 9 Metal Storage Bin 432 15 36 109 2 0 27 2 4 24 19 78 288 17 14 1022 43 60 10 Concrete Masonry Unit 0 0 0 0 14 0 174 0 0 0 8100 0 0 0 4 246 0 28 11 Wood Beam 1728 60 144 437 18 13 48 1 0 96 77 109 403 5 6 60 173 44 12 Wood Plank 7776 270 648 1966 90 64 212 7 0 432 346 569 2102 46 30 360 778 279 13 Metal Siding 3014 273 476 1291 549 274 362 45 165 363 83 629 1538 151 163 1376 601 635 14 7/8" Plywood Sheet 864 30 72 218 7 0 25 6 0 48 38 179 662 41 7 8 86 137 15 Wide Flange (W14x26) 667 52 87 249 56 24 44 5 15 67 19 111 272 17 18 134 110 93 16 Channel Section (6 x 13) 720 50 120 294 112 49 76 9 31 80 32 78 192 36 33 150 144 191 17 Small Equipment 216 10 24 66 44 3 15 1 2 16 10 39 134 10 11 21 29 72 18 Large Equipment 72 5 12 29 34 1 12 0 1 8 3 4 10 0 3 4 14 16 19 Steel Grating 0 0 0 0 60 0 35 1 1 0 0 31 115 10 50 22 0 143 20 Large Steel Frame 0 0 0 0 9 0 1 0 9 0 0 8 29 2 11 25 0 12 21 Vehicle 0 0 0 0 0 0 0 0 4 0 0 0 0 0 3 0 0 0 22 Tree 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Total Missiles 21681 980 2135 6224 1160 491 1241 85 269 1478 9002 2357 7674 392 456 3873 2597 2113 Missile Source Structure Number Subset Missile Description 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 1 Rebar 16 33 14 70 70 82 16 10 146 8 26 29 17 64 48 2168 280 35 2 Gas Cylinder 1 6 1 12 12 5 1 1 7 1 2 2 0 4 3 5 6 0 3 Drum, Tank 3 8 3 17 17 15 3 2 4 2 5 5 0 12 9 452 24 95 4 Utility Pole 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 5 Cable Reel 4 0 3 0 0 20 4 3 0 2 6 7 0 16 12 1 59 0 6 3 Pipe 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 13 0 0 7 6 Pipe 0 10 0 22 22 0 0 0 0 0 0 0 0 0 0 12 0 0 8 12 Pipe 0 3 0 7 7 0 0 0 0 0 0 0 0 0 0 4 12 0 9 Metal Storage Bin 7 1 6 2 2 36 7 4 3 4 11 13 1 28 21 26 1 0 10 Concrete Masonry Unit 0 8 0 17 17 0 1890 1688 0 0 0 3038 0 0 0 455 0 0 11 Wood Beam 2 8 2 17 17 10 5 1 36 1 3 4 23 8 6 78 40 5 12 Wood Plank 19 36 16 77 77 97 31 12 163 10 30 34 117 76 57 510 240 30 13 Metal Siding 104 91 86 216 216 325 7 69 480 71 190 184 37 394 303 1418 1428 243 14 7/8" Plywood Sheet 17 0 15 0 0 87 49 11 0 9 27 31 28 68 51 743 221 40 15 Wide Flange (W14x26) 12 17 14 38 38 36 0 2 68 7 18 5 1 34 27 112 108 28 16 Channel Section (6 x 13) 22 30 9 67 67 77 0 6 48 13 34 16 0 70 53 252 252 53 17 Small Equipment 4 11 3 24 24 20 4 3 12 2 6 7 1 16 12 29 114 4 18 Large Equipment 0 5 0 10 10 0 0 0 4 0 0 0 0 0 0 26 20 1 19 Steel Grating 4 32 3 67 67 20 4 3 0 2 6 7 0 16 12 700 2500 31 20 Large Steel Frame 1 1 1 2 2 5 1 1 0 1 2 2 0 4 3 167 260 26 21 Vehicle 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 1 2 0 22 Tree 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Total Missiles 216 300 176 665 665 835 2022 1816 971 133 366 3384 225 810 621 7172 5567 591 Missile Source Structure Number Subset Missile Description 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 1 Rebar 157 0 14 61 410 45 79 2 2 186 0 0 0 0 0 0 0 0 2 Gas Cylinder 2 2 1 11 26 3 0 0 0 18 0 0 0 0 0 0 0 0 3 Drum, Tank 4 0 3 15 185 8 3 0 0 56 0 0 0 0 0 0 0 0 4 Utility Pole 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 5 Cable Reel 0 0 4 0 102 11 0 0 0 84 0 0 0 0 0 0 0 0 6 3 Pipe 0 336 0 0 0 0 411 6 6 3175 0 0 0 0 0 0 0 0 7 6 Pipe 0 0 0 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 12 Pipe 0 0 0 6 0 0 0 8 8 0 0 0 0 0 0 0 0 0 9 Metal Storage Bin 4 2 6 2 419 70 3 1 1 233 0 0 0 0 0 0 0 0 10 Concrete Masonry Unit 0 0 0 15 1025 0 4 0 0 0 0 0 0 0 0 0 0 0 11 Wood Beam 35 0 2 15 51 6 0 0 0 0 0 0 0 0 0 0 0 0 12 Wood Plank 166 0 17 67 486 53 0 1 1 0 0 0 0 0 0 0 0 0 13 Metal Siding 508 262 92 217 1178 193 0 11 11 0 2581 564 564 1398 1584 482 632 632 14 7/8" Plywood Sheet 225 0 15 0 495 48 13 1 1 158 0 0 0 0 0 0 0 0 15 Wide Flange (W14x26) 44 24 11 29 128 22 0 8 8 0 0 0 0 0 0 0 0 0 16 Channel Section (6 x 13) 92 51 20 58 307 45 62 10 10 0 0 0 0 0 0 0 0 0 17 Small Equipment 7 17 4 21 132 11 1 8 8 252 0 0 0 0 0 0 0 0 18 Large Equipment 9 4 0 8 0 0 4 3 3 158 0 0 0 0 0 0 0 0 19 Steel Grating 9 4 4 59 147 11 175 2 2 3362 0 0 0 0 0 0 0 0 20 Large Steel Frame 5 0 1 2 26 3 1 0 0 9 0 0 0 0 0 0 0 0 21 Vehicle 12 0 0 7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 22 Tree 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Total Missiles 1280 702 194 612 5117 529 756 61 61 7691 2581 564 564 1398 1584 482 632 632 Missile Source Structure Number Subset Missile Description 154 155 156 157 158 159 160 161 TOTAL 1 Rebar 0 0 40 0 0 0 0 0 17096 2 Gas Cylinder 0 0 11 0 0 0 0 0 300 3 Drum, Tank 0 0 1 0 0 0 0 0 1187 4 Utility Pole 0 0 0 0 0 0 0 0 0 5 Cable Reel 0 0 0 0 0 0 0 0 530 6 3 Pipe 0 0 398 0 0 0 0 0 4345 7 6 Pipe 0 0 0 0 0 0 0 0 177 8 12 Pipe 0 0 0 0 0 0 0 0 78 9 Metal Storage Bin 0 0 22 0 0 0 0 0 3128 10 Concrete Masonry Unit 0 0 0 0 0 0 0 0 16723 11 Wood Beam 0 0 0 0 0 0 0 0 3797 12 Wood Plank 0 0 0 0 0 0 0 0 18398 13 Metal Siding 632 632 235 482 632 632 632 632 33268 14 7/8" Plywood Sheet 0 0 14 0 0 0 0 0 4795 15 Wide Flange (W14x26) 0 0 14 0 0 0 0 0 2893 16 Channel Section (6 x 13) 0 0 216 0 0 0 0 0 4337 17 Small Equipment 0 0 78 0 0 0 0 0 1558 18 Large Equipment 0 0 14 0 0 0 0 0 507 19 Steel Grating 0 0 166 0 0 0 0 0 7883 20 Large Steel Frame 0 0 2 0 0 0 0 0 634 21 Vehicle 0 0 0 0 0 0 0 0 33 22 Tree 0 0 0 0 0 0 0 0 1 Total Missiles 632 632 1211 482 632 632 632 632 121668

U.S. Nuclear Regulatory Commission Page 77 of 108 Serial RA-18-0178 Enclosure Approach to determine wind missile damage to individual SSCs:

A simplified method for missile fragility analysis was developed that used plant specific data inputs into a multivariate model derived from previous TORMIS analysis of other plants.

Missile hit and damage data from two previous TORMIS analyses of nuclear power plants was used to develop a multivariate statistical model to estimate wind missile hit and damage for the BNP SSCs. This model was developed from a statistical analysis of existing TORMIS inputs and results and was focused on identifying the site-specific parameters that best explain missile hit and damage probability at any given nuclear power plant. The data analyzed included 117 SSCs at five different tornado intensities (EF scale levels) for a total of 585 observations.

The statistical analysis resulted in identifying a simple logistic model that estimated tornado missile impact probability from four site-specific parameters which include:

1. Exposed Target Area (AT). This is defined as the sum of the surface area in square feet for all target surfaces exposed to wind missiles. For example, a hypothetical 1 foot cube target sitting on the ground in the open would have an exposed area of 5 ft2 (bottom of cube not exposed). If the same cube backs up to a concrete wall (i.e. the wall protects one side of the cube) the exposed area would be 4 ft2, and so on.

2. Missiles within 300 feet of target, considering quadratic blockage (Mq300). This is a simplified way to consider missile proximity and blockage from intervening structures in the calculation of missile population. Mq300 is determined with the following equation:

300 =

(1 + )2

=1 Where Mi is the number of missiles associated with missile source i, n is the total number of missile sources (zones and structures) whose centroid is within 300 feet of the subject target, and Bi is a number between 0 and 3 representing missile blockage provided by intervening structures. Blockage between each missile source and a given target (Bi) is considered to be 0 if missiles from missile source i have a direct line of site to the target. Values of 1 to 3 are used to represent increasing blockage provided by intervening structures.

Note that the number of missiles between 300 to 750 feet from targets, and more than 700 feet from targets were considered in the statistical analysis, but were not ultimately selected as part of the best fit model. It is important to note, however, that the TORMIS results used to develop the statistical model do include missiles located more than 300 feet from the targets. As such, the results produced by the statistical model inherently include the risk contribution from these missiles despite not being included as separate fitting parameters in the model.

3. Wind Speed (Wi). The peak gust wind speed in mph at 10 m above grade

4. Target Centroid Height (Th). The height of the centroid of the target in feet.

The logistic form of the regression model provides for proper bounding of the conditional probabilities between 0 and 1. For this model, the overall r2 for all the data is 73% in the logistic fitting space and 64% in the conditional probability space. These values mean that about 60% of the variance in missile hit probability is explained by the model discussed above. The mean square error of the estimator is 2.19. This value is used to estimate the confidence in the model and estimate the 5th and 95th percentile missile fragilities.

U.S. Nuclear Regulatory Commission Page 78 of 108 Serial RA-18-0178 Enclosure A plot of the data vs. model prediction is given in Figure 2. Each point on the plot shows the TORMIS predicted value vs. the model predicted value for that target and EF Scale. The points for each of the two plants are shown in different colors. Obviously the model does not replicate TORM IS since all the data does not fall along the 1: 1 slope line (black dashed line). The vertical variation above and below the line suggest that the model predicted probabilities can easily be off by one order of magnitude, and even two orders of magnitude for very small conditional probabilities. However, the model is mean centered and captures the TORMIS data trend over 7 orders of magnitude reasonably well .

The statistical model tends to over predict for the smaller conditional probabilities. A power function fit to each of the plant data sets is also shown to compare their individual trend lines.

The trend lines are reasonably close, but are offset due to the many geometrical differences, plant layout, and simplified parameters used in the statistical model (y axis plotting position).

The resulting conditional tornado missile hit probabilities for the BNP SSCs are plotted in Figure 3 for each EF scale. These plots show that the conditional probabilities increase with increasing tornado intensity. They also show that the missile hit probabilities are much higher for the large tanks (targets 7-9), and lowest for the diesel generator exhaust valves (targets 3-6) , which are 54 ft above grade.

Stati$tioal Hit Prob-,,bility Mode Iv$ TORMIS Training Data from Two Plan ts 1.E+OO

. l 1.E-01 .

y - 0.3888x° 744 7

-~

ii R2 = 0.6323

.e

./l U-02 a.

J:

C 1.E-03

'ii C

0 V

1.E-04 ti

'ii

,t" l.E-05 1i 0

• Plant 1

E 1;

• Plant 2 1 .E-06

'i -- *-*1:lSlope "j

~ Power (Plant 1) 1 .E-07 - Power(Plant 2) 1.E-08 1.E-08 1.E--07 1.E--06 1.E--05 1.E--04 1.E-03 1.E--02 1.E--01 1.E+00 TORMIS Predicted Cond it ional Hit Probability Figure 6. Data Used to Develop Statistical Model

U.S. Nuclear Regulatory Commission Page 79 of 108 Serial RA-18-0178 Enclosure Mean Conditional Probability of Missile Hit by Tornado Intensity 1.E+00 Conditional Probability of Missile Hit 1.E-01 EF5 EF4 EF3 EF2 EF1 1.E-02 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Target Number Figure 7. Estimated Mean Conditional Tornado Missile Hit Probabilities by EF Scale Damage Given Missile Hit. Missile hit may not always damage an SSC (result in loss of function). The BNP target list includes several targets with some inherent degree of resistance to missile impact. For example, missile impacts that do not perforate the CST are not expected to produce damage (i.e. produce loss of water inventory or otherwise prevent suction from tank).

For such targets, we have separately analyzed data from previous TORMIS analyses to develop a conditional probability perforation function for steel-plated targets. This analysis was limited to perforation given missile hit and was done on TORMIS outputs, after aggregation over all EF scales. Hence, the conditional perforation probability is applied to the final missile hit probability (produced after aggregation over all wind speeds from the wind hazard curve).

A logistic regression model was used to fit the steel perforation data for various thicknesses of steel from previous TORMIS analyses that are shown in Figure 4.

U.S. Nuclear Regulatory Commission Page 80 of 108 Serial RA-18-0178 Enclosure Missile Impact c:oo liooal Damage Probab"lity vs St eellln get Plate Tlliidlli'!SS

r 1.Et C*O 1.E- 01.

~ 1.E-02

~

~

@ 1.E- C'3 B I 1.E-04 Co t *

.A

...1::'

-0 1.E-~

• +

0 1.E*CS u

1.E-07 c, O.~ 1.~ 2 Figure 8. TORMIS Steel Plate Perforation Probability Data Site Specific Data. The statistical missile hit and damage models require site-specific data consistent with the TORMIS analyses on which the statistical models are based. In addition to the missile data, the site walkdown also characterized the dimensions and locations of each SSC. The total number of missiles within 300 feet of each SSC, considering quadratic blockage, was determined based on SSC location with respect to the missile sources and intervening blockage.

This analysis includes significant plant specific inputs (e.g. missile inventory, orientation , target inventory, etc.). Although a simplified fragility methodology is employed, this analysis provides results very similar to a fully plant-specific analysis. It is recognized that this is an area of uncertainty for the model. However, this uncertainty is addressed in RAI 17 and the discussion below.

Impact of identified deviations on this application:

The simplified missile fragility analysis is discussed in RAI 17 as an assumption from the BSEP HW model. This assumption cannot be quantitatively shown to not have a potential impact to the application acceptance criteria, as such , this assumption is considered "key" per NUREG-1855 Rev 1. Consistent with the discussion in RAI 17, use of the sensitivity study required by section 8.1 of NEI 00-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. See RAI 17 for a detailed discussion of this approach.

As such , the sensitivity study and performance monitoring adequately address the potential impact to the application acceptance criteria for uncertainties like the simplified missile fragility analysis in the BSEP HW model.

U.S. Nuclear Regulatory Commission Page 81 of 108 Serial RA-18-0178 Enclosure PRA RAI 15 - External Flood PRA Walkdowns:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA-Sa-2009. Several SRs in Parts 7 (e.g. SR WFR-A1 and WPR-A10) and 8 (e.g. SR XFFR-A1, XFPR-A10, and XFPR-B1) of the 2009 ASME/ANS PRA Standard discuss the use of walkdowns in the development of the HW and XF PRAs.

Discuss the walkdowns performed to support the XF PRA including (i) composition of the walkdown team, (ii) approach taken to perform the walkdown citing any relevant guidance that was followed, (iii) whether any areas that could be impacted were not included in the walkdown based on flood protection features or barriers, and (iv) the salient results of the walkdown and their incorporation into the XF PRA.

Duke Energy Response to PRA RAI 15:

Walkdowns were performed for the BSEP XF PRA. These walkdowns are documented in a BSEP PRA calculation. The general purpose of the walkdown was to collect data on:

• Flooding sources

• Impact of dependencies

• Critical flooding depths that when reached would fail PRA equipment

• Mitigating systems and their dewatering capabilities

• Water propagation and flow paths

• Critical water levels for ingress into buildings The walkdown was performed by a Civil/Structural System Engineer from the BNP Plant Staff and a PRA Engineer from the Corporate Staff. The buildings chosen for the walkdown were buildings that had the potential for vulnerabilities that could fail PRA equipment due to external flooding. Areas of the plant that were included in the walkdowns are the reactor building, Diesel Generator Building/Fuel Oil Tank Chamber (FOTC), service water building, water treatment building, turbine building, control building, radwaste building (includes SAMA DGs), circulating water intake structure, and the switchyard. No areas were excluded from the walkdown based on flood protection features or barriers. Items specifically called out to be observed during the walkdowns were:

• Access doors (personal and equipment)

• Roll-up doors

• Ventilation (exposed louvres/ exhausts)

• Drains

• Sumps/sump pumps

• Curbs

• Sills

• MCCs (location/how high off the floor/enclosed?), electrical buses, transformers, electrical cabinets, and electrically operated large motors.

• Equipment at 20 ft elevation and lower

• Potential for water load on roofs

U.S. Nuclear Regulatory Commission Page 82 of 108 Serial RA-18-0178 Enclosure

• Potential for failure of structure or components due to large debris related to external flooding The detailed results of the walkdowns are documented in the walkdown note sheets contained in a BSEP PRA calculation. The walkdown results were used to support the following XF PRA tasks:

1. External Flood Fragility Analysis: This task involves determining the flood conditions that can result in failure of safety and non-safety equipment modeled in the PRA.

2. External Flood Screening: External flood screening was done based on information gained during the walkdowns.

3. External Flood Human Reliability Actions: The determination of operator action feasibility was based on walkdown observations that identified vulnerabilities associated with the ability to execute a HRA due to a 20 ft or a 23 ft still water level flood.

PRA RAI 16 - Sufficient External Flooding Data Points to Capture Spectrum of Plant

Response

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA-Sa-2009. SR XFPR-B1 of the 2009 ASME/ANS PRA Standard calls for the assessment of accident sequences that are initiated by external flooding. Accident sequences in XF PRA models that are initiated by external flooding can vary depending on the flood elevation and the corresponding impact of SSCs and actions.

Describe how sufficient data points for the external flooding hazard were determined to capture the plant response at different flooding elevations.

Duke Energy Response to PRA RAI 16:

The external flood probabilistic risk assessment (XF PRA) mainly relies on information gathered from walkdowns to determine the elevations at which flood damage could impinge on structures, systems, and components (SSCs) relied upon to bring the plant to safe and stable conditions.

The elevation of 20 ft above National Geodetic Vertical Datum of 1929 (NGVD 29), which is the finished floor elevation of the reactor building, is selected as the key elevation beyond which external flooding impacts on core damage frequency (CDF) and large early release frequency (LERF) become significant. In particular:

• For external flooding events below 20 ft elevation, the potential for SSCs credited in the XF PRA to be damaged by water is minimal, given the fact that safety-related buildings (i.e., Reactor Building Unit 1, Reactor Building Unit 2, Diesel Generator Building, Service Water Intake Structure, and Control Building) are water proofed to an elevation of 22 ft elevation to provide external flood protection. Given the available design margin, leakage from seal penetrations in the rattle space to the Reactor Buildings is not expected to significantly impact the plant risk. The main risk impact comes from a loss of offsite power, caused by hurricane high winds, which is the concurrent hazard expected with the external flooding event. The loss-of-offsite power risk contribution in this situation is already accounted for in the internal events PRA and high-winds PRA.

U.S. Nuclear Regulatory Commission Page 83 of 108 Serial RA-18-0178 Enclosure

• For external flooding events at or above 20 ft elevation, the XF PRA models the flood-induced impacts on credited SSCs and operator actions to calculate the resulting CDF and LERF. To best represent the plant response, the modeling focuses on impacts between 20 ft and less than 23 ft elevation. 23 ft represents the elevation of the Diesel Generator Building, at which a flooding event has the potential to damage the diesel generators relied upon in the XF PRA to maintain the plant in safe and stable conditions.

It is the next key elevation at which the severity of flood-induced damage to SSCs credited in the XF PRA changes appreciably (cliff-edge effect).

• The mean estimate of the 1E-05 annual exceedance probability hurricane-induced water level is 18.5 ft (NGVD 29). The mean estimate of the 2E-06 annual exceedance probability water level is 20.3 ft (NGVD 29). This latter annual exceedance probability indicates that the CDF for a flood event at or above 20.3 ft is bounded by 2E-06/yr.

Taking into consideration that 1) failure of SSCs are not postulated until the water elevation reaches 20 ft, 2) the next elevation threshold at which a cliff-edge effect in the plant response (in this case, failure of diesel generators) is at an appreciably higher elevation (23 ft), and 3) the XF PRA conservatively does not credit sandbagging as a flood mitigation feature, it is estimated that the majority of plant risk in response to external flood events occurs at an elevation at and above 20 ft, but below 23ft.

Based on the foregoing discussion, sufficient data points are considered to adequately capture the plant response.

PRA RAI 17 - External Flood and High Winds Key Assumptions and Sources of Uncertainty:

Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, states [f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application. Further, Section 4.2, Licensee Submittal Documentation, of RG 1.200, Revision 2, states that [t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. RG 1.200, Revision 2, defines the terms key assumption and key source of uncertainty in Section 3.3.2.

Section 3.2.7 of the Enclosure to the LAR cites certain references for the process of identifying model uncertainties but does not elaborate on the implementation by the licensee. The same section further states that key BSEP PRA model specific assumptions and sources of uncertainty for this application have been identified and dispositioned in Attachment 6 of the Enclosure. Item 9 in Attachment 6 of the Enclosure to the LAR states that the disposition for the uncertainty associated with the initiating event frequency of external events at extreme ranges will be addressed as individual systems are categorized in this risk-informed application. The discussion for this item also states that the Initiating Events for the very rare events is believe[d] to be assigned a frequency higher than actual.

a. Describe the approach used to identify and characterize the key assumptions and key sources of uncertainty in the licensees HW and XF PRA models. The description should

U.S. Nuclear Regulatory Commission Page 84 of 108 Serial RA-18-0178 Enclosure contain sufficient detail to identify: (i) whether assumptions and sources of uncertainty related to aspects of the hazard, fragility, and plant response analysis were evaluated to determine whether they were key, and (ii) the criteria for determining whether the modeling assumptions and sources of uncertainty were considered key.

Duke Energy Response to PRA RAI 17.a.:

Assumptions and uncertainties related to the hazard, fragility, and plant response for the high winds PRA were identified based on vendor input and PRA documentation. The assumptions/uncertainties identified for the high winds model include:

1. Hurricane and Straight Wind Hazard Assumptions in the Hurricane Wind Hazard Analysis were identified based on research and development of hurricane wind field and occurrence models, sensitivity analyses, and engineering judgment. The assumptions identified and include:

a. The historical information on hurricanes during the last 100 years are representative of the hurricane wind climate during the life of the plant

b. The hurricane simulation model provides a good representation of the hurricane hazard at the BNP site

2. Tornado Wind Hazard:

Several assumptions are documented in the BSEP HW PRA documentation and industry literature related to tornado missile risk analysis. The approach used to identify these are based on research and analysis of the tornado database, structural response to tornado wind fields, modeling, sensitivity analyses, and engineering judgment. Some of the major assumptions in tornado hazard development therefore included:

a. Wind speed uncertainties associated with tornado damage intensity scales were estimated with a weighted distribution of the F, F, and EF Scales, which provide a wide range of uncertainties used to compute the derived mean windspeeds.

These uncertainties reflect the subjective approaches inherent in the F and EF damage scales and the assumed windspeeds associated with these scales.

b. The tornado reporting efficiency was developed using a backward averaging approach that resulted in a 30% increase in the number of reported tornadoes in the historical database for the Brunswick sub-region.

c. Tornado occurrences are assumed to be Poisson distributed and the uncertainties in the mean Poisson occurrence rate were estimated and propagated through the mode.

d. Uncertainties in the tornado wind field model are as described in EPRI Tornado Risk Analysis reports (NP-768, NP-769, NP-2005 and academic literature.

Tornadoes are simulated with a wide range of sizes (path widths and lengths) intensities (F, F, and EF wind speeds), radius to maximum winds, path directions, and other parameters that reflected the available databases.

Note that Items a, b, and c were modeled with epistemic uncertainties and then fully propagated to develop a derived mean tornado hazard curve and estimated percentiles.

U.S. Nuclear Regulatory Commission Page 85 of 108 Serial RA-18-0178 Enclosure The item d parameters were modeled as random variables in the model with statistical ranges to reflect the natural variations observed in the data regarding tornado wind fields and damage swaths.

3. Missile Fragility Analysis The assumptions of the TORMIS methodology are documented in EPRI Tornado Risk Analysis reports (NP-768, NP-769, NP-2005. The assumptions/uncertainties specific to the Brunswick analysis include:

a. A statistical model was developed for the Brunswick missile fragilities instead of using TORMIS directly. The statistical model was based on several TORMIS runs for other plants and used some site and target specific inputs from Brunswick. This approach is assumed to provide reasonable estimates of missile fragilities for Brunswick.

b. All potential missiles developed from the Brunswick plant survey are assumed to be minimally restrained.

c. All missile impacts, regardless of missile type or velocity, on the SAMA generators, fire water pumps, and traveling screens are assumed to damage these components and render them inoperable.

d. A steel thickness of 1/4 was assumed for perforation failure of Condensate Storage Tanks and the Fire Water Tank. This thickness is typical for the tops of such tanks, but tank walls are generally comprised of thicker steel at lower levels of the tank.

e. The previous TORMIS analyses used to develop the statistical missile model had a similar overall layout, distribution of missile types, and total number of missile to BNP. In addition, the methods followed to collect the site-specific information for all plants were the same. As a result, it was assumed that the missile risk data developed by the statistical model is applicable to BNP.

4. Plant Response Model The assumptions/uncertainties specific to the Brunswick analysis include:

a. All tornado missile hits to a PRA SSC are assumed to result in functional failure.

b. It is assumed that all tornado events and straight winds with F1 and greater peak gust winds at the BNP site will automatically induce a LOOP event.

c. Recoverable losses of offsite power due to high winds and tornados are addressed in the BNP Loss of Offsite Power Analysis. This study does not credit recovery of offsite power due to high winds and tornados.

d. High wind initiating events were determined on the basis of discrete intervals along the mean high wind hazard curve. Full integration of the high wind hazard curve with the fragility curves was not performed.

e. The hazard curves are based on a combination of high wind data and expert opinion.

f. The fragilities for some equipment were quantified on the assumption of mutual independence of the high wind impact. There may be some "state-of-knowledge" correlation issues that could impact this assumption.

g. A number of High Wind initiators are modeled as direct core damage which may be conservative.

h. An HRA multiplier approach was used to perform the BNP high winds human reliability analysis (HRA).

U.S. Nuclear Regulatory Commission Page 86 of 108 Serial RA-18-0178 Enclosure

i. Condensate Storage Tanks 1-CST and 2-CST are assumed to be at the 75% fill level or higher.

j. The RB Bridge Cranes are assumed to be idle, parked, and have parking locks engaged.

k. For most items, capacities are derived from the current design basis loading without credit for design margin (factor Fc3 is set to 1.0). This is a conservative assumption.

Higher factors may be justified but would require substantial research and analysis to obtain.

l. It is assumed that the operators will not perform any activities outside the protected buildings during the first 30 minutes after a tornado or straight-wind event and during the first 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of a hurricane event.

m. It is assumed that the operators will know the post-tornado plant condition within one hour of the tornado initiator.

n. Impacts on operator actions that directly involve establishing/maintaining vessel injection are assumed to be negligible for high winds initiators. These actions will take place immediately after the attempted plant shutdown and the operators attention will be focused on reactor power. The stress levels will be high already and will dominate in priority; therefore, these actions should not be impacted by the high wind event.

o. Actions that must be performed within 5 minutes and involve reactivity control and injection are of high priority. These actions are performed in the control room and practiced regularly in the simulator and therefore, it is assumed that these actions are not impacted by the high wind initiators.

p. Since containment is a Category 1 building, it is assumed that high wind initiators cannot cause any pipe break inside containment and thus, the loss of coolant accident initiators are excluded from review.

q. BNP equipment that resides in the turbine building are assumed protected from wind hazard to the same extent as the loss of offsite power fragility. Most of the equipment in the turbine building are lost with the loss of offsite power which is much more fragile than the turbine building. Therefore, for equipment inside turbine building no fragility is assessed.

r. It is assumed that Circulating Water Pumps are protected at least to the extent that their power source - offsite power - is protected

s. It is assumed that U1 and U2 Turbine Building components are protected at least to the extent that their power source - offsite power - is protected

t. It is assumed that Startup Transformers are protected at least to the extent that their power source - offsite power - is protected

u. It is assumed that Air compressors are protected at least to the extent that their power source - offsite power - is protected

v. Failure of a non-Class I building/structure due to high wind results in unavailability of all SSCs in that building/structure.

w. High winds of all speed categories result in turbine trip.

The assumptions/uncertainties identified for the BNP external flood model include:

1. Hazard Development The assumptions in this analysis were identified based on research and development of hurricane wind field and storm surge models, sensitivity analyses, and engineering judgment. The assumptions identified include:

U.S. Nuclear Regulatory Commission Page 87 of 108 Serial RA-18-0178 Enclosure

a. The historical information on hurricanes during the last 100 years are representative of the hurricane wind climate during the life of the plant

b. The hurricane simulation model provides a good representation of the hurricane hazard at the Brunswick NPP site

c. Approximately 20 years of data is sufficient to develop mean centered statistical models for the radius to maximum wind and the Holland b parameter

d. 500,000 years of storms were produced and hence a key assumption was that this number of years was sufficient for Duke Energys purpose in using this data.

e. The top 100 storm surges derived from SLOSH are the same as those that would be obtained if a far more resolved model was used instead of SLOSH

f. The ADCIRC-waves models provide mean centered estimates of the observed water levels

g. The coupled ADCIRC and wave models are able to adequately propagate surge and waves overland.

2. Plant Response Model The assumptions/uncertainties specific to the BNP analysis include:

a. Doors that do not have design in-leakage limits associated with them are identified and conservatively assumed to be ineffective at preventing flow of flood waters.

b. Doors that did have design in-leakage associated with them were assumed to have the in-leakage limits from section 3.4.1.1.1 of the BNP UFSAR.

c. The potential for flooding through storm proof louvres, HVAC ducts, blow out panels and roof hatches was assumed to have a relatively small contribution to flood sources compared to the contribution of personnel doorways, roll-up doors, and track doors.

d. The following ductbanks have no in-leakage limit associated with them and are therefore assumed to be negligible flood sources:

• Ductbanks (connect to manholes East of the Reactor Buildings Unit 1 and 2) that run through the basement of the DG Building (2 ft elevation).

• Ductbanks (connect to manholes North of the DG Building) that run through the basement of the SW Building (-13 ft elevation)

e. Equipment such as manual valves, check valves, safety valves, heat exchangers, and trainers/filters were assumed to be unaffected by flood damage. MOVs and AOVs where considered failed due to expected failure of its associated trains and components.

f. Unless otherwise noted, motor control centers throughout the plant were assumed to be mounted at least 4 in. above the floor as per UFSAR Section 3.4.2.1. If the flood water level is > 4 in. above the floor, those panels are assumed to be failed.

g. If water accumulates above 5 ft elevation in the DG Building basement, failure of all diesel generators is assumed, as the transformers located in the basement serve as excitation for the diesel generators.

h. The Fuel Oil Tank Chambers (FOTCs) could be breached during a 23 ft still water flood through two personnel doors at the FOTC sheet metal enclosures (at 23 ft elevation).

These exterior doors connect to stairs that connect to interior doors. Although there are no in-leakage limits associated with any of these doors, it is safe to assume that there will be a relatively low in-leakage rate through them.

U.S. Nuclear Regulatory Commission Page 88 of 108 Serial RA-18-0178 Enclosure

i. As the electric fire water pump is located at a critical height of 213 in the Waste Treatment Building (WTB), it is conservatively assumed that both 20 ft and 23 ft still water floods will fail this component.

j. As the diesel fire water pump is located at a critical height of 213 in the WTB, it is conservatively assumed that both 20 ft and 23 ft still water floods will fail this component.

k. Circulating water intake pumps (CWIPs) are powered by 4kV buses1(2)C/D. Therefore, the CWIPs will be lost with the loss of offsite power (LOOP) assumed for a 20ft still water flood. Moreover, the circulating pump motors are located above elevation 17.5 ft so that the level alarm will trip before the flood reaches the motors. Therefore, the circulating water pumps at the intake are failed for either flood scenario.

l. When considering an extreme coastal flooding event due to hurricanes, it is assumed that the switchyard will fail whenever the water level reaches 20 ft and above. When considering any other external flooding event, the critical height at which the switchyard is assumed lost is at 209.

m. Without offsite power, the plant would rely on onsite emergency AC power from the diesel generators. Coolant injection will be provided by the high pressure injection systems from the CST until depletion of the Condensate Storage Tank (CST). It is assumed that the operators will fail to isolate the hotwell makeup line from the CST to terminate loss of CST inventory (OPER-HWLVLCV is set to 1 in the model).

n. Due to the large degree of uncertainty related to the frequency and duration of the external flooding event associated with the 23ft still water flood, this event probability is set to 0 in the model, while the external flooding event associated with the 20ft still water flood is set to its nominal value. A sensitivity case including the 23ft still water flood is documented in calculation BNP PSA-094, PSA Model External Flooding Analysis.

Once the above uncertainties were identified, the process of determining which assumptions/uncertainties are key to the application was performed on an ad hoc basis, using engineering judgement. This approach was reviewed against the latest NRC guidance in NUREG-1855 rev. 1, and it was determined that it was not consistent with that NUREG. As such, an evaluation of these uncertainties/assumptions and their treatment with respect to the 10CFR 50.69 application was re-performed in accordance with the NUREG, as described in the response to RAI-17.b., below. This re-assessment, along with the results of the re-assessment for internal events, internal floods and fire discussed in RAI 04.b., replaces Attachment 6 of the Enclosure to the original LAR.

b. Discuss how each key assumption and key source of uncertainty identified above was dispositioned for this application. If available, provide sensitivity studies that will be used to support the disposition for this application or use a qualitative discussion to justify why different reasonable alternative assumptions would not affect this application.

Duke Energy Response to PRA RAI 17.b.:

The process for identifying sources of uncertainty and assumptions is described in the response to RAI 17.a. above. Based on this, the process to assess the identified uncertainties/assumptions to determine which are key to the application was not consistent with NUREG-1855 rev. 1. Additionally, for those uncertainties and related assumptions that are key to the application (i.e., it cannot be quantitatively shown that they do not have the potential to impact the acceptance criteria), Stage F (section 8) of NUREG 1855, Rev. 1, provides guidance on justifying the strategy used to address the key uncertainties that contribute to risk metric

U.S. Nuclear Regulatory Commission Page 89 of 108 Serial RA-18-0178 Enclosure calculations that challenge application-specific acceptance guidelines. This process was not originally performed in conformance with the latest revision of the NUREG. As such, an updated assessment was performed, as described below.

Since the ultimate goal in assessing model uncertainty is to determine whether (and the degree to which) the risk metric results challenge or exceed the quantitative acceptance guidelines for the application, due to sources of model uncertainty and related assumptions, the first step in the updated evaluation was to identify the risk metrics used as acceptance guidelines for the 10 CFR 50.69 categorization process. For 10 CFR 50.69 categorization, the acceptance guidelines are threshold values for Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) for each component (SSC) being categorized, above which the SSC is categorized as high safety significant (HSS), and below which the SSC is categorized as low safety significant (LSS). As described in Step E-2 of the NUREG, each relevant uncertainty/assumption requires some sort of sensitivity analysis, and each sensitivity performed to evaluate an uncertainty/assumption involves some change to the PRA results. Since any change to the PRA results has the potential to change the F-V and RAW importance measures for all SSCs, every relevant uncertainty/assumption has the potential to challenge the acceptance guidelines. That is, since RAW and F-V are relative importance measures, any change to any part of the model will generate a new set of cutsets and potentially impact the RAW and F-V for every SSC. Thus, the only way to evaluate the impact of a sensitivity is to quantify the sensitivity case and compare the F-V and RAW values for all SSCs against the base case F-V and RAW values to determine if any exceed the HSS threshold in the sensitivity case that did not previously do so.

However, as stated in Stage F of NUREG-1855 rev. 1 (section 8.1), an appropriate method for dealing with uncertainties and related assumptions that challenge or exceed the acceptance guidelines is to use compensatory measures or performance monitoring requirements. Section 8.5 of the NUREG states that performance monitoring can be used to demonstrate that, following a change to the design of the plant or operational practices, there has been no degradation in specified aspects of plant performance that are expected to be affected by the change. This monitoring is an effective strategy when no predictive model has been developed for plant performance in response to a change. Since no predictive model of the increase in unreliability following alternative treatment of LSS SSCs exists, this option is appropriate for 10CFR 50.69. In fact, the example of a performance monitoring approach to address key uncertainties/assumptions given in section 8.5 is the factor of increase sensitivity combined with the performance monitoring process required for 10CFR 50.69 in NEI 00-04. The NUREG states:

One example of such an instance is the impact of the relaxation of special treatment requirements (in accordance with 10 CFR 50.69) on equipment unreliability. No consensus approach to model this cause-effect relationship has been developed. Therefore, the approach adopted in NEI 00-04 as endorsed in Regulatory Guide 1.201, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance, [NRC, 2006a] is to:

• Assume a multiplicative factor on the SSC unreliability that represents the effect of the relaxation of special treatment requirements.

• Demonstrate that this degradation in unreliability would have a small impact on risk.

U.S. Nuclear Regulatory Commission Page 90 of 108 Serial RA-18-0178 Enclosure Following acceptance of an application which calls for implementation of a performance monitoring program, such a program would have to be established to demonstrate that the assumed factor of degradation is not exceeded.

The use of the sensitivity study required by section 8.1 of NEI 00-04 and performance monitoring of LSS SSCs as required by 10 CFR 50.69(e)(3) is appropriate to address key uncertainties and assumptions. The impact of any key uncertainty or assumption sensitivity would be to potentially cause an SSC to be categorized as HSS when the base PRA analysis showed it to be LSS. The potential impact of categorizing an SSC as LSS rather than HSS is that the SSC could have alternative treatments applied to it and as such, the possibility exists that the reliability of the SSC could be reduced (i.e., the specified aspect of plant performance that is expected to be affected by the change is the reliability of the SSC). Per section 8.1 of NEI 00-04, a sensitivity is performed which assumes the unreliability of all LSS components is increased by a factor of 3 to 5. Since, as discussed in NEI 00-04, no significant decrease in reliability is expected, this is very conservative. Additionally, since the failure probability of all LSS SSCs are increased at the same time in the sensitivity, this approach addresses all uncertainties/assumptions which could potentially impact the LSS/HSS categorization. The LSS sensitivity then must be shown to demonstrate that even assuming this factor increase, the quantitative guidelines of Reg. Guide 1.174 are not exceeded. Thus, the LSS sensitivity demonstrates that the potential impact of all uncertainties/assumptions is acceptable.

Additionally, a performance monitoring program must be established as part of the 10 CFR 50.69 process (per NEI 00-04 section 12) which will monitor the reliability of all LSS SSCs to ensure that the factor of increase assumed in the sensitivity is not exceeded. This ensures the validity of the sensitivity study following implementation.

It is noted that uncertainties/assumptions which are related to SSCs being excluded from the PRA model, either because they are not believed to be required for accident mitigation or because they perform a backup function to other equipment but were conservatively not credited in the model, may not be adequately addressed by the above sensitivity and performance monitoring program. If an SSC is not in the PRA model, but actually performs (or could perform) an accident mitigation function, and that SSC is categorized as LSS (based on non-PRA criteria) the factor increase sensitivity would not appropriately address the uncertainty associated with this assumption/uncertainty. This is because if there are no failure events in the PRA model for the SSC, the LSS sensitivity study has no events to which to apply the factor of increase. If, contrary to the assumption, the SSC is actually required for accident mitigation and had been included in the model, increasing its failure rate by the factor of increase could have an impact on the sensitivity results with respect to the RG 1.174 limits.

Based on the above discussion, the list of uncertainties and assumptions in item 17.a, above, was reviewed to identify any that are not adequately addressed by the factor increase sensitivity study required by Section 8.1 of NEI 00-04 and the performance monitoring program required by Section 12 of NEI 00-04. None of the above uncertainties/assumptions relate to exclusion of SSCs from the model, such that they are all adequately addressed by the factor increase sensitivity study and the performance monitoring program, and no additional sensitivities are required. Again, this re-assessment, along with the results of the re-assessment for internal events, internal floods and fire discussed in RAI 04.b., replaces Attachment 6 of the Enclosure to the original LAR.

U.S. Nuclear Regulatory Commission Page 91 of 108 Serial RA-18-0178 Enclosure

c. Provide clarification on the uncertainty associated with the initiating event frequency of external events at extreme ranges (Item 9 in Attachment 6 of the Enclosure) and describe how that uncertainty is dispositioned as individual systems are categorized for licensees HW and XF PRA models.

Duke Energy Response to PRA RAI 17.c.:

As discussed in the response to RAI 17.a. and RAI 17.b. above, Attachment 6 to the Enclosure to the original LAR is replaced by the above re-assessment.

d. Discuss why the licensee believes that the assigned frequencies are conservative (i.e.,

higher than actual as described by the LAR).

Duke Energy Response to PRA RAI 17.d.:

As discussed in the response to RAI 17.a. and RAI 17.b. above, Attachment 6 to the Enclosure to the original LAR is replaced by the above re-assessment.

PRA RAI 18 - External Flooding PRA Finding Level Facts and Observations:

Section 3.3 of the Enclosure to the LAR states that findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13, Close-out of Facts and Observations as accepted by the NRC by letter dated May 3, 2017 (ADAMS Accession No. ML17079A427). The licensee cites closure of findings for its internal events, internal flood, high winds, and fire PRA models.

a. Clarify whether the process cited above was applied to the licensees XF PRA and discuss the results therefrom.

Duke Energy Response to PRA RAI 18.a.:

To clarify, two of the four open external flood findings were reviewed by the closure team. The other two findings were not resolved sufficiently to warrant review by the closure team. The closure team had additional questions that the SMEs were not available to answer, thus none of the findings were closed. As such, each of the open findings was dispositioned for the 10 CFR 50.69 application. of the Enclosure to the LAR provides the open peer review findings and their disposition by the licensee for this application. The following requests for information apply to the XF PRA F&Os and their corresponding resolutions in above mentioned attachment:

b. Finding XFPR-A11-1, related to SR XFPR-A11, stated that there is no evaluation of the potential impact of external floods on system recoveries credited in the Level 1 PRA. The resolution discusses staging of personnel and re-evaluation of human reliability events and concludes that changes made are enough to support...the 50.69 application. The discussion does not include sufficient detail to determine how environmental conditions and flood protection failures were incorporated in the determination of HEPs and to support staffs review of the licensees conclusion. Water, due to in-leakage from various doors, is expected at various locations and manipulations of electrical equipment under such

U.S. Nuclear Regulatory Commission Page 92 of 108 Serial RA-18-0178 Enclosure conditions may prove dangerous or require guidance as well as availability of certain special equipment. Failure of credited flood protection features, such as sump pump(s), drain(s),

and floor door(s), could prevent operators from performing their actions. Such considerations are expected to have an impact on the internal events HEPs via either execution time or other relevant performance shaping factors (PSFs).

In light of the above, discuss changes made to the XF PRA to resolve XFPR-A11-1 including discussion on consideration and inclusion of (i) the impacts of environmental conditions such as the presence or accumulation of water on the staged and unstaged operator actions, (ii) the flood protection or mitigation features credited in the licensees XF PRA, and (iii) the failures of flood protection or mitigation features that could prevent operators from performing their actions or achieve the desired level of protection.

Duke Energy Response to PRA RAI 18.b.:

i. An evaluation of the impact of an external flood on system recoveries was performed as documented in Duke Energy calculation BNP-PSA-094, section 4.3. The criteria for screening were based on walkdown observations that identified vulnerabilities associated with executing an operator action due to a 20 ft or a 23 ft still water level flood. It was also taken into consideration that during extreme hurricane conditions, the stations Severe Weather procedure recommends pre-staging approximately three people in the Diesel Generator Building, two in the Service Water Building, and two Engineers in the Control Room if conditions warrant prior to hurricane arrival. The following changes were made to the HRA as a result of the analysis:

1. No credit was taken for crossconnecting the service water discharge headers since the discharge isolation valves are located in a pipe tunnel that would be submerged by the flood.

2. No credit was taken for realigning offsite power to equipment since for an external flood, offsite power is assumed to be lost and not recovered.

It is also noted that no credit is taken for the potential to recover offsite power following its loss due to an external flood since for external events, the repair of damaged switchyard or transmission system components does not generally occur quickly.

ii. Plant design features such as drains, gratings, stairwells, curbs, water-tight sills, pedestals, sumps, sump pumps, flood doors, penetration seals are all considered in determining the plants response to an external flood. See Dukes response to RAI 18.c for additional detail.

iii. In general, flood protection features are credited for performing as designed. This is considered a realistic approach given the passive design of many of the features and that plant maintenance programs are in place to keep the features functional. However, flood waters can render mitigation features or equipment unavailable, therefore external flood fragility was considered.

Example external flood fragility assumptions include:

• Doors that do not have design in-leakage limits associated with them are

U.S. Nuclear Regulatory Commission Page 93 of 108 Serial RA-18-0178 Enclosure conservatively assumed to be ineffective at preventing flow of flood waters.

• Doors with design in-leakage limits were assigned in-leakage limits as specified in the Brunswick Updated Final Safety Analysis Report.

• Rattle spaces are seismic isolation spaces located between the Turbine Buildings, Reactor Buildings, Control Building and Radwaste Building. These rattle spaces contain sump pumps that have been permanently installed which provide input to Storm Drain System piping. The purpose of these sump pumps is to reduce the water in-leakage through sleeves, piping, and building seals entering the Radwaste, Turbine, and Reactor Buildings through these rattle spaces. However, rattle space sump pumps are powered from normal 120 AC power (non-emergency power) and are therefore not credited for flood mitigation. Moreover, rattle spaces are expected to be flooded during external flooding events as water will back up into them once the basin water level has risen above 156.

• Unless otherwise noted, motor control centers throughout the plant were assumed to be mounted at least 4 in. above the floor as per the UFSAR Section 3.4.2.1. If the flood water level is > 4 in. above the floor, those panels are assumed to be failed.

c. Finding XFPR-A3-1, related to SRs XFPR-A3, -A5, -A8, and -A10, stated that assurance was needed that external flood-caused failures were modeled and that a systematic review of potential impacts of external flooding was performed. The resolution discusses documentation changes but does not provide information on the systematic review of the potential impacts of external flooding. External flood doors, internal drains, and sump pumps appear to be relied on to keep equipment from being inundated. It also is unclear whether random or flood induced failures of such features and components are considered in the licensees XF PRA. Exclusion of such random or flood induced failures of credited flood protection features and components could underestimate the risk of external flooding events.

Provide details of the systematic review performed including discussion on (i) the development of the list of SSCs or features required for external flood hazard mitigation, (ii) the selection of SSCs for inclusion in the XF PRA model, and (iii) the consideration of failures of flood protection features such as manually operated doors, water-tight doors, door seals, penetration seals, conduit seals, internal drainage systems, and sump pumps.

Include discussion on how the licensees resolution to the F&O addresses all the four SRs against which the finding is cited.

Duke Energy Response to PRA RAI 18.c.:

i. Duke Energy calculation BNP-PSA-094, section 3.2 evaluates the impact of two external flood events, the 20 ft and 23 ft floods, on plant SSCs. The evaluation considers flood propagation pathways and plant design features such as door, floor and wall penetrations, stairwells, hatches, drains, grating, curbs, pedestals, walls, sills, sumps, sump pumps, availability of power to sump pumps during flood, drain path backflow check valves, manual isolation valves, permanently installed plugs, equipment critical heights, and resistance of electrical equipment to falling water. Critical flood levels and propagation pathways were determined from information gained during the walkdown and from BNP-specific references. The analysis addresses the following buildings:

• Reactor Building

U.S. Nuclear Regulatory Commission Page 94 of 108 Serial RA-18-0178 Enclosure

• Turbine Building

• Diesel Generator Building/ Fuel Oil Tank Chambers Control Building

• Service Water Building

• Radwaste Building ii. BNP-PSA-094, section 4.2 documents additions to the model to reflect the equipment failure impacts due to external floods. The 20 flood fails the switchyard, the electric and diesel firewater pumps, and the circulating water pumps. The 23 flood also fails the emergency diesel generators.

iii. Design features such as drains, gratings, stairwells, curbs, water-tight sills, pedestals, sumps, sump pumps, flood doors, penetration seals are all considered in determining the plants response to an external flood. Credit for such features was based on whether or not the feature would be expected to mitigate the flood of interest. For example, for large floods that would exceed sump pump capacity, no credit was taken for the existence of the pump. Similarly, if essential power is not supplied to the pump, it would not be credited.

Duke administrative procedure AD-EG-BNP-1619, Rev. 0, standardizes the methods used to develop, administer, and implement the External Events Protection (EEP) Program at the Brunswick Nuclear Plant, including external floods.

External Events protection features (including external floods) are described in 0BNP-TR-019, Revision 7. This document describes the flood protection features and the Sump Pump and Check Valve Performance for External Flooding Events. Section 4.0 describes the inspection process and Section 5.0 describes the external flood attributes. Flood protection features include, concrete structures, steel structures, penetrations/seals, concrete plugs (exterior side only), Manhole Covers (exterior side only), Piping, Cable Vaults, Tunnels, Electrical Cable Conduit, Floor Hatches (exterior side only), Credited Non-Watertight Doors, and pumps.

The flood protection features implement passive (i.e., Flood Water Intrusion Barriers) and active (i.e., sump pumps and check valves) measures to mitigate external flood events.

Since the sump pumps are non-safety, they are not credited in the External Flood PRA.

For flood water intrusion, the items required to protect the equipment include intact walls, low leakage doors, below grade penetration seals, conduit seals, and other below grade seals. The station maintains a list of flood protection features associated with this category and the associated PMs.

Engineering Change 410845, Rev. 0, Attachment C, External Flood Protection Feature Sampling Plan, is used every refueling cycle to perform inspections of all passive flood protection features listed in Attachment 1 of 0BNP-TR-019. This excludes all manhole covers, active flood protection features (i.e. check valves, sump pumps, etc.) and temporary passive flood protection features (cliff edge barriers) which are inspected via different PMs.

Manhole penetration seals are evaluated BNP-178099-RP01, Rev. 0. All safety-related buildings (Reactor Building Unit 1, Reactor Building Unit 2, Diesel Generator Building, Service Water Intake Structure, and Control Building) were originally water proofed to 22-

U.S. Nuclear Regulatory Commission Page 95 of 108 Serial RA-18-0178 Enclosure foot MSL to provide external flood protection. Brunswick Nuclear Plant uses a system of underground manholes and duct banks to route electrical conduits to the wall penetrations in the buildings. In Class I safety related buildings, the manholes are classified as safety-related. The rattle space penetration seals are inspected part of EC287907, Rev. 3, and have been upgraded to an external flood level of 26.1 feet. Vendor Manual FP-82632, Rev. E, indicates that penetration seals used in the rattle space, are designed for a hydrostatic pressure of 40 feet of head, or 20 psig. This translates to an external flood level that exceeds 26.1 feet.

The resolution to Finding XFPR-A3-1 F&O addressed all four SRs against which the finding was written, as summarized below.

PRA Standard Supporting Action Taken to Address Finding XFPR-A3-1 Requirement Evaluations of the potential external flooding impact on operator actions and equipment were performed. Human XFPR-A3 error probabilities for actions that were determined to be not feasible were set to TRUE in the hazards flag file.

Operator stress would be considered high. However, the external flood evaluation is based on a flooding hazard due to a hurricane that would not occur without warning many hours XFPR-A5 before the event, and HRA actions can be taken following trained procedure actions. Therefore, external flood HRA stress multipliers were not used to increase the human error probabilities.

XFPR-A8 N/A; no screening of human failure events was performed.

External flood impact on operator action probabilities was evaluated. It was also taken into consideration that during extreme hurricane conditions, the stations Severe Weather XFPR-A10 procedure recommends staging approximately three people in the Diesel Generator Building, two in the Service Water Building, and two Engineers in the Control Room if conditions warrant prior to hurricane arrival.

d. Finding XFPR-A7-1, related to SR XFPR-A7, called for the performance of an analysis of external hazard caused dependencies and correlations. The resolution states that the external flooding analysis does not model dependencies and correlations of equipment failure other than the effects from inundation and that the analysis has equipment failure correlated due to submergence. The resolution also cites inspections performed on the trash racks for debris accumulation. The note accompanying SR XFPR-A7 in the 2009 ASME/ANS PRA Standard indicates that it is vital to capture spatial and environmental dependencies among external flood caused failures and further states that external floods can affect multiple SSCs or a combination of SSCs at the same time. Further, Section 8-1.3 of the 2009 ASME/ANS PRA Standard mentions the importance of considering rational probabilistic-based combinations of external flooding phenomena. The resolution does not provide sufficient information to determine whether dependencies have been appropriately considered and included in the XF PRA model.

U.S. Nuclear Regulatory Commission Page 96 of 108 Serial RA-18-0178 Enclosure

i. Provide details on and results from the approach used to identify, capture, or screen spatial and environmental dependencies that can affect multiple SSCs or a combination of SSCs in the XF PRA model.

ii. Discuss the approach used to consider probabilistic-based combinations of external flooding phenomena (e.g., wind driven LIP and wind driven storm surge) and their inclusion in the XF PRA model. Address any inconsistencies in modeling the failure of SSCs such as the Severe Accident Mitigation Alternatives (SAMA) diesel generator and the emergency diesel generator (EDG) exhaust between the licensees XF and HW PRA models that are related to such combination of phenomena.

Duke Energy Response to PRA RAI 18.d.:

i. Duke Energy calculation BNP-PSA-094, section 4.7, provides analysis of dependencies associated with external flooding events. This section considers:

• Water crossing the plant grade

• Interference with the Service Water Discharge due to water crossing the plant grade

• Intake structure clogging due to debris

• Storm Drain Collector Basin (SDCB) backflow.

For convenience, information from section 4.7 is repeated below.

4.7.1 Water Crossing Plant Grade Plant grade is approximately elevation 19.5 ft MSL. To ensure that operators are alerted to a rising water level in the intake canal, a level indicator was provided with the sensor installed in the Class I service water intake structure and the recording indicator in the control room. The level indicator will provide an alarm in the control room when the water in the intake canal reaches elevation 14.5 ft MSL. When the alarm annunciates in the control room, an evaluation will be made whether or not to shut down the plant. The evaluation will include determining whether the flood has crested and the expected duration and intensity of the hurricane.

4.7.2 Interference with SW discharge due to Water Crossing Plant Grade The SWS takes water from the intake canal and discharges it to the discharge canal. The TBCCW, RBCCW, and the SWS all discharge water to the same location in the discharge canal. At the time of high water (23 ft MSL), the site is virtually underwater. The top of the discharge canal at 18 ft MSL will be underwater. The SWS pumps would need to discharge to a height of 23 ft. The head of the SWS pumps is about 250 ft. Normal levels in the discharge canal are about 10 ft. The addition of 10-15 ft of head to the discharge of the SWS pumps would not be expected to have a significant change on the pump performance. Therefore, interference with SW discharge due to water traversing across the site is not a concern.

U.S. Nuclear Regulatory Commission Page 97 of 108 Serial RA-18-0178 Enclosure 4.7.3 Intake Structure Clogging due to Debris A major source of debris that affect intake structures are storm-generated debris, such as weeds, grass, and kelp that enter the intake structure because of high winds, high tides, wave action, or run-off from rivers and streams. Hurricanes or other significant rainfall events can dump large amounts of rain in the Cape Fear River basin which forces the salt wedge, which is normally located near Wilmington, downstream toward the intake canal.

This action forces the marine life in the area to move down with the salt wedge in large numbers.

However, the fact that the plant will not be at 100% power during severe weather conditions would minimize the amount of debris being sucked into the canal and subsequently to the intake structure as the circulating water pumps would not be at full power. Moreover, as part of storm preparation procedures, inspection is done on the trash racks at the intake and diversion structures for accumulation of trash/debris on the racks.

4.7.4 Storm Drain Collector Basin (SDCB) Backflow The Storm Drain Collector Basin (SDCB), located northwest of the Turbine Building, is a concrete structure designed to collect gravity drainage of underground piping. Drainage collection consists of an underground network of concrete and cast iron storm piping of various sizes, non-contaminated building floor drains, building roof and building rattle spaces drainage piping. The underground pipes are laid with approximately 1/8-inch slope per 1 linear foot run so that gravity supplies the motive force for drainage. Surface drainage, run-off after rains, and neutral nonradioactive wastes are collected by this system. Once the storm drainage has collected in the SDCB, pumps are provided to empty the contents of the basin into the stabilization pond via a monitoring station. During severe inclement weather however, the overflow from the SDCB is directed to the discharge canal, bypassing the stabilization pond through two in-line overflow valves. One valve is the overflow isolation valve and the other is the overflow control valve. An indication that the operation of these valves may be required is the need to prevent the basin level from reaching 15- 6. These valves may be manually opened to prevent water from backing up in the storm drainage header piping. However, in the event of a still water level flood of 20 ft or above, water will back up in the plant storm drains. When this occurs, an immediate influx into the plant radiologically controlled areas occurs though cable vaults, drains, manholes and rattles paces, adding to the demand on the radwaste processing system. Impact of water backflow into buildings was addressed in Section 3.2.

ii. Simultaneous consideration of high winds and external flooding was included in the analysis. High winds could produce a storm surge flood and could spatially impact offsite power, fire water system pumps and storage tank, the EDGs, and back-up DC power.

The modeling of the failure of SSCs such as the Severe Accident Mitigation Alternatives (SAMA) diesel generator and the emergency diesel generator (EDG) exhaust between the BNP XF and HW PRA models is consistent. The same fragility parameters are used for these components in the XF and HW analyses. However, in the XF model, the high wind drives a storm surge that leads to failure of these components by inundation. In the HW model, failure of the components is tied more directly to component fragility.

U.S. Nuclear Regulatory Commission Page 98 of 108 Serial RA-18-0178 Enclosure

e. Finding XFPR-C2-1, related to SR XFPR-C2, stated that the documentation of the specific adaptions to the internal events PRA to produce the XF PRA was not performed. Since the documentation was unavailable at the time of the peer review, it appears that the peer reviewers did not have information necessary to determine whether the adaption of the internal events model was performed appropriately. Provide details of and basis for the specific adaptions that were made to the internal events model to develop the XF PRA.

Duke Energy Response to PRA RAI 18.e.:

Duke Energy calculation BNP-PSA-094, section 4.2, documents additions to the model to reflect the equipment failure impacts due to external floods. The 20 flood fails the switchyard, the electric and diesel firewater pumps, and the circulating water pumps. The 23 flood also fails the emergency diesel generator. Tables 4.2.1 and 4.2.2 identify changes to the internal events model for external flood for Units 1 and 2, respectively. Table 4.2.1 is repeated below for convenience. Table 4.2.2 is analogous.

Table 4.2.1 - Additions to Internal Event Models Unit 1 Direct Gate Direct Gate Parent Gate Parent Gate Description Description ACP_TE_EXTFLOOD-L External ACP_TE_S Site Loss of Offsite Power Flood (23ft) CWS-G10- CW Pump A run failures Induced PMPA Loss of CWS-G10- CW Pump B run failures Offsite PMPB Power CWS-G10- CW Pump C run failures PMPC CWS-G10- CW Pump D run failures PMPD FPS-GEDP- Diesel Driven Fire Pump Train -

PUMP Pump Failures FPS-GMDP- Motor Driven Fire Pump Train -

PUMP Pump Failures SWS-+1FW- Firewater to RHR injection using SW RHR EDG-$1003 Failure of Emergency Diesel Generator 1 to Run EDG-$2003 Failure of Emergency Diesel Generator 1 to Run EDG-$3003 Failure of Emergency Diesel Generator 1 to Run EDG-$4003 Failure of Emergency Diesel Generator 1 to Run EDG-+1003 FAILURE OF EMERGENCY DIESEL GENERATOR 1 TO RUN EDG-+2003 FAILURE OF EMERGENCY DIESEL GENERATOR 2 TO RUN EDG-+3003 FAILURE OF EMERGENCY DIESEL GENERATOR 3 TO RUN

U.S. Nuclear Regulatory Commission Page 99 of 108 Serial RA-18-0178 Enclosure EDG-+4003 FAILURE OF EMERGENCY DIESEL GENERATOR 4 TO RUN EDG-G1003 FAILURE OF EMERGENCY DIESEL GENERATOR 1 TO RUN EDG-G2003 FAILURE OF EMERGENCY DIESEL GENERATOR 2 TO RUN EDG-G3003 FAILURE OF EMERGENCY DIESEL GENERATOR 3 TO RUN EDG-G4003 FAILURE OF EMERGENCY DIESEL GENERATOR 4 TO RUN ACP_TE_EXTFLOOD- Small ACP_TE_S Site Loss of Offsite Power S External CWS-G10- CW Pump A run failures Flood (20ft) PMPA Induced CWS-G10- CW Pump B run failures Loss of PMPB Offsite CWS-G10- CW Pump C run failures Power PMPC CWS-G10- CW Pump D run failures PMPD FPS-GEDP- Diesel Driven Fire Pump Train -

PUMP Pump Failures FPS-GMDP- Motor Driven Fire Pump Train -

PUMP Pump Failures SWS-+1FW- Firewater to RHR injection using SW RHR PRA RAI 19 - High Winds PRA Initiating Event Identification:

RG 1.200, Revision 2, endorses, with staff clarifications and qualifications, ASME/ANS RA-Sa-2009. SR WPR-A1 of the 2009 ASME/ANS PRA Standard calls for the inclusion of initiating events caused by high wind hazards that give rise to significant accident or accident progression sequences using a systematic process. The note accompanying the cited SR indicates the importance of thoroughly investigating site-specific wind-caused failure events including multiple-unit impacts and dependencies.

Describe the systematic process that was followed to determine the initiating events from the internal events model that would be included in the licensees HW PRA. Include discussion on consideration of SSC failures that can result in initiators, spatial and environmental dependencies, multiple-unit impacts, and feedback from plant walkdowns as well as the outcome of the process.

Duke Energy Response to PRA RAI 19:

The BNP internal events model initiating events were systematically reviewed for potential impact from the high wind hazards. Some internal event initiators cannot be induced by a high wind event. For example, since containment is a Category 1 building, it is assumed that high wind initiators cannot cause any pipe break inside containment. Thus, the loss of coolant accident initiators are not modeled for high winds.

U.S. Nuclear Regulatory Commission Page 100 of 108 Serial RA-18-0178 Enclosure Plant-specific high wind hazard curves were developed to quantify high wind initiating event frequencies for the BNP high wind PRA model. The high wind initiating event frequencies were determined on the basis of discrete intervals along the mean high wind hazard curve. An evaluation of high wind functional impacts was performed and the induced initiating events identified. For example, failure of the switchyard relay house was identified and modeled as a wind-induced loss of offsite power initiating event to both units.

During the determination of fragilities and initiating events both spatial and environmental dependencies and multi-unit impacts were considered. High wind walkdowns were performed to independently evaluate the findings of the high wind IPEEE and collect additional data. The walkdowns were utilized to support the PRA model inputs, high wind missile counts, and data utilized in the fragility analysis. Walkdown observations were later compared to plant design documentation. This provided a check of consistency between as-built conditions and the plant design basis documents. The walkdown team also searched for potential high wind interaction hazards.

PRA RAI 20 - Propagation of Changes in the Base Internal Events PRA to the High Winds and External Flooding PRAs:

According to Sections 7-1.2 and 8-1.2 of the 2009 ASME/ANS PRA Standard it is assumed that a full-scope internal-events at-power Level 1, and Level 2 LERF, PRAs exist and that those PRAs are used as the basis for the HW and XF PRA. Therefore, the acceptability of the internal events PRA model used as the foundation for the XF and HW PRAs is an important consideration. Section 3.3 of the Enclosure to the LAR states that the internal events findings were reviewed and closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13. However, the LAR does not provide information about the propagation of changes made to the internal events model for closing the finding level F&Os to the XF and HW PRAs.

a. Clarify whether changes made to the internal events model to resolve the corresponding finding level F&Os have been implemented in the XF and HW PRAs or justify not implementing the changes in the context on this application.

Duke Energy Response to PRA RAI 20.a.:

The changes made to the internal events model to resolve finding level F&Os are documented in Attachment 8, of BNP-PSA-068, BNP-PSA Model Peer Review F&O Resolutions. Modifications to the PRA models are performed in accordance with Duke procedures and processes. All model changes documented in Attachment 8 of BNP-PSA-068 were reviewed and it was determined that any finding level resolution implemented in the Internal Events model are captured in the PRA Tracking database in order to ensure implementation into other models as applicable. The PRA Tracking database is the tool used by Duke Energy PRA practitioners to maintain model configuration control. Those applicable Tracking Items are listed below.

A review of Appendix D (2010 F&O Responses) of BNP-PSA-068, BNP-PSA Model Peer Review F&O Resolutions, discovered no changes to the Internal Events model (other than the addition of FLEX) that would impact the External Flooding or High Winds PRA models.

U.S. Nuclear Regulatory Commission Page 101 of 108 Serial RA-18-0178 Enclosure PRA Tracker Item # B-18-0010 is written for the next model update of the External Flood and/or High Winds PRA to include addition of the FLEX equipment as done in the Internal Events Model. Not taking credit for FLEX is conservative and is not expected to have a negative risk impact on the model or an impact on the 50.69 LAR Submittal.

PRA Tracker Item # B-15-0030 has been written to incorporate model changes for HW PRA from Peer Review F&O resolutions into the BNP Model of Record. This item has been documented as LOW risk in the PRA Tracker database and there is negligible risk impact expected for this application. This action is not expected to have a significant risk impact on the model or an impact on the 50.69 LAR Submittal.

PRA Tracker Item # B-18-0014 has been written to incorporate data updates from the internal events PRA model into the HW and XF PRA models. This item has been documented as LOW risk in the PRA Tracker database and there is negligible risk impact expected for this application. Additionally, the Peer Review team stated that there is little risk increase expected from these data updates for the internal events. It is reasonable to project this assumption to have little impact on the risk increase of the HWs and/or XF PRA models. This action is not expected to have a significant risk impact on the PRA models or an impact on the 50.69 LAR Submittal. Expected to be bounded by the required 50.69 sensitivity exercises.

b. Clarify and address any human actions or SSC functions credited in the internal events model that may have been included in the XF PRA but are incompatible with assumptions in the XF PRA. Examples include credit for control rod drive (CRD) injection and sump pumps, both of which rely on offsite power.

Duke Energy Response to PRA RAI 20.b.:

External Flooding Human Reliability Analysis Table 4.3 and section 4.3 of Duke Energy calculation BNP-PSA-094, PSA Model External Flooding Analysis, discusses the internal events HRAs and those evaluated for the external flooding hazard as well as any applied credit. The criteria for screening were based on walkdown observations that identified vulnerabilities associated with not executing a HRA due to a 20 ft. or a 23 ft. still water level flood.

It was also taken into consideration that during extreme hurricane conditions it is recommended pre-staging approximately three people in the Diesel Generator building, two in the Service Water Building, and two Engineers in the Control Room prior to hurricane arrival. Although a recommendation, this action was actually put into practice in September 2018. The step remains a recommendation in order to allow flexibility in operations to dictate the need based on severity of circumstances.

Human reliability actions that were not feasible (OPER-SWDISCHX and OPER-RESOSP) were set to TRUE (guaranteed to fail) in the Flag File. There are no additional penalties applied through the performance shaping factors. All applicable HRA actions are assessed for feasibility under the given environmental conditions.

U.S. Nuclear Regulatory Commission Page 102 of 108 Serial RA-18-0178 Enclosure Assumptions of SSCs credited in the Internal Events The assumptions identified in the internal events, as captured in BNP-PSA-003, Revision 5, Ground Rules & Assumptions, were reviewed for applicability to the External Flooding PRA model. Any assumptions that were identified as cascading into the External Flood PRA are appropriately modeled or would be bound by any sensitivity analysis conducted in the normal 50.69 sensitivity process.

The noted power sources that are necessary and credited for mitigation in the External Flood model are appropriately powered from emergency sources (i.e. CRD injection pumps).

- The CRD pumps and ECCS room sump pumps are powered from emergency bus power and would then be available after the LOOP. CRD Pumps are powered from the Emergency Buses (E1 through E4; see BNP Electrical Power Distribution System drawing). ECCS room sump pumps are powered from 480V substations fed from the Emergency Buses (E1 through E4; see 0OP-50.1 and BNP Electrical Power Distribution System drawing).

- Per review of BNP-PSA-094, PSA Model External Flooding Analysis, the Fire Water Pumps are not credited in the External Flooding analysis. Table 3.3 of Duke Energy calculation BNP-PSA-094 provides a list of Plant SSCs that are vulnerable to the flooding hazard as well as a reason for their external flood fragility.

Passive components, such as buildings, doors, and penetrations, that were not explicitly listed in the Internal Events PRA were assessed directly for the external flooding hazard.

PRA RAI 21 - Inclusion of New Site-Specific Hazard and Plant Change Information in External Flooding and High Winds PRAs:

Section 3.2.6 of the Enclosure to the LAR describes the licensees PRA maintenance and update process and states that the process includes provisions for monitoring potential areas affecting the PRA models and for assessing the risk impact of unincorporated changes.

Further, the licensee states that the assessment of the impact of the changes will be performed no longer than once every two refueling outages. The licensees HW and XF PRAs use site-specific hazard information that can change during the implementation of the 10 CFR 50.69 program. The discussion of the licensees PRA maintenance and update process does not include information about the consideration and inclusion of changes to the site-specific hazard information (e.g., occurrence frequencies).

a. Discuss how new information about the high winds and external flooding hazard will be identified, evaluated, and incorporated in the licensees HW and XF PRAs that support this application during the implementation of the 10 CFR 50.69 program.

Duke Energy Response to PRA RAI 21.a.:

Model updates are performed periodically to ensure the models appropriately reflect the as-built, as-operated plant.

U.S. Nuclear Regulatory Commission Page 103 of 108 Serial RA-18-0178 Enclosure Duke Energys PRA Maintenance and Update process includes a step to consider changes in external events hazards when completing a model update. This process would consider both changes to the plant-specific hazard inputs (e.g. topographical changes that might impact flood runup) and changes to the generic hazard frequencies and hazard strength data. However, for the latter, significant changes are not expected as the hazard development included a significant dataset. Additionally, any new industry guidance on hazard development methodology will be considered as specifically required by the Duke Energy PRA Maintenance and Update procedures.

b. Discuss how plant changes will be evaluated for their impact on the licensees HW and XF PRAs that support this application and subsequently incorporated in those PRAs during the implementation of the 10 CFR 50.69 program. Discuss whether the appropriate modeling inputs for the plants changes (e.g., high wind fragility) will be evaluated for inclusion in the XF and HW PRAs.

Duke Energy Response to PRA RAI 21.b.:

Section 12 of NEI 00-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated.

Additionally, the Duke Energy PRA model update procedures require periodic model updates.

These procedures specifically address initiatives from industry insights with respect to changes in PRA technology that could change the PRA results, and changes in external event factors, as well as physical plant changes. Following a PRA model update, the procedures require that PRA applications, including 10 CFR 50.69 be reviewed to assess the impact of the model change on the application. This would address any plant changes as well as other modeling inputs.

PRA RAI 22 - Importance Measure Calculation and Categorization of Non-Aligned Components:

The categorization of SSCs using the licensees HW and XF PRA models is expected to be based on importance measures and corresponding numerical criteria as described in Sections 5.1 and 5.3 of NEI 00-04. 10 CFR 50.69(c) provides requirements for the categorization process including determination of SSC functional importance. 10 CFR 50.69(1)(ii) states that

[t]he functions to be identified and considered include design bases functions and functions credited for mitigation and prevention of severe accidents. The discussion on other external risks in Section 1.5 of NEI 00-04 includes an example of the inclusion of importance measures arising specifically from the impact of an external hazard in the categorization process. Further, the discussion of integral importance measures in the same section states that [e]ach risk contributor is initially evaluated separately.... Section 5.4 of NEI 00-04, while discussing the importance measure calculation for other external hazards, states that the risk importance process is slightly modified to consider the fact that plant components cannot initiate external events such as floods, tornadoes, and high winds and does not exclude the impact of the

U.S. Nuclear Regulatory Commission Page 104 of 108 Serial RA-18-0178 Enclosure external hazard from the importance measure development. Section 5.6 of NEI 00-04 discusses the integral assessment wherein the hazard specific importance measures are weighted by the individual hazard contribution to the plant risk.

a. Describe how the importance measures are determined from the HW and XF PRA models in the context of the binning approach employed those models. Describe and justify how the same basic events, which were discretized by binning during the development of the PRA, are then combined to develop representative importance measures. Further, discuss how they are compared to the numerical criteria, justify any impact on the categorization results, and describe how the approach is consistent with the guidance in NEI 00-04.

Duke Energy Response to PRA RAI 22.a.:

The BSEP external flooding model does not use a binning approach. It considers a component failed when the component becomes submerged or is impacted by spray, such that there are no binned basic events. Therefore, no combining of flood failure basic events is required.

Therefore, importance measures for all components in the external flood model will be determined from the random failure events for components in the model, just as they are for internal events, and the numerical criteria are applied the same way (i.e., sum of F-V, max of RAW, etc.) for the basic events that apply to each component.

The BSEP high winds model does use a binning approach to address the different probabilities of failure of some components due to the different initiating events. Therefore, there will be multiple basic events representing the wind-induced failure of those components which need to be combined to develop importance measures. The BNP high winds model is a single top model that quantifies all wind initiators and produces a single cutset file. To calculate the F-V value for any component, the F-V value for all basic events which represent the failure of that component, including both wind-induced failures and random failures, are simply added together. This is then the F-V value for the component for the high winds hazard. To calculate the RAW value for the component, all basic events which represent the failure of that component are failed (i.e., set to logical true) at the same time. The resulting risk metric (CDF or LERF) is then divided by the baseline risk metric. This is then the RAW value for the component for the high winds hazard. The F-V and RAW value for each component can then be directly compared to the numerical criteria in NEI 00-04.

b. In the context of the integral assessment described in Section 5.6 of NEI 00-04, it is understood that importance evaluations performed in accordance with the process in NEI 00-04 are determined on a component basis. However, it is not apparent from the LAR and the NEI 00-04 guidance how the integrated importance measures are calculated for certain components where corresponding basic events, which represent different failure modes for a component, in the HW and XF PRA models may not align with basic events in other PRA models. Examples of such basis events include those that are specific to the HW and XF PRA model, including implicitly modeled components, or basic events that represent a subcomponent modeled within the boundary of an internal events PRA component.

Provide details, with justification, of how the integrated importance measures will be calculated for HW and XF basic events that may not align directly with basic events in other PRA models. Include discussion on (i) any mapping that will be performed between HW and XF PRA basis events and those in other PRA models as well as cases where such

U.S. Nuclear Regulatory Commission Page 105 of 108 Serial RA-18-0178 Enclosure mapping would be performed, and (ii) treatment of implicitly modeled components in the HW and XF PRA models in the categorization process.

Duke Energy Response to PRA RAI 22.b.:

The integral assessment is performed on a component basis, not on a basic event basis, and therefore integrated importance measures are not calculated for HW and XF basic events. For all models, importance measures are first calculated for each component being categorized. As stated in NEI 00-04, the importance measures of basics events which represent different failure modes of the component within that model are combined to produce importance measures for that component for that model. This is done separately for all models, such that a F-V, RAW, and common cause RAW value are developed for each component for each model. The integral importance measures are then calculated for each component using the formulas in section 5.6 of NEI 00-04. As noted in those formulas, this is all done using component importance measures, not basic event importance measures.

If a component is credited in one hazard model, but not in all (or any) of the other models, for those models which do not credit the component, the F-V value would be 0 and the RAW value would be 1.0. These values are then used in the integral assessment formulas in section 5.6 of NEI 00-04. The CDF/LERF contribution from those models would be included in the denominator. If a component is explicitly modeled in one hazard model but is treated as being within the component boundary of another larger component (i.e., a sub-component) in other models, for the model where the sub-component is explicitly modeled, the importance measures of the sub-component would be combined with the importance measures of the larger component (i.e., add the F-V value and use the maximum RAW value) to determine the importance of the larger component. The larger component would then be used in the integral assessment. Note that in the categorization process, once a component becomes high safety significant for a function, all other components within that system which support that function also become high safety significance (HSS). If the larger component in this case becomes HSS, the sub-component also becomes HSS, such that a separate integral calculation for the sub-component is not required.

PRA RAI 23 - Categorization Sensitivity Studies for High Winds and External Flooding PRAs:

Section 5.4 of NEI 00-04 indicates that components can be identified as being safety significant following sensitivity studies. Section 5.4 also recommends the completion of several sensitivity studies, including any applicable sensitivity studies identified in the characterization of PRA acceptability.

a. Table 5-5 of NEI 00-04 identifies sensitivity studies for HW and XF PRAs and includes any applicable sensitivity studies identified in the characterization of PRA acceptability. Clarify whether the sensitivity analyses in Table 5-5 and those identified as part of PRA acceptability for HW and XF PRAs will be performed every time SSCs are categorized under 10 CFR 50.69.

U.S. Nuclear Regulatory Commission Page 106 of 108 Serial RA-18-0178 Enclosure Duke Energy Response to PRA RAI 23.a.:

Yes, the sensitivity analyses in Table 5-5 and those identified as part of PRA adequacy for HW and XF PRAS will be performed every time SSCs are categorized under 10 CFR 50.69.

b. The key assumptions and sources of uncertainties identified as part of the licensees LAR may change as HW and XF PRA model updates could affect the significance of those assumptions for this application or create new key assumptions or sources of uncertainties.

Describe how the licensees 10 CFR 50.69 program continues to evaluate assumptions and sources of uncertainty when the HW and XF PRA models are updated in the future and subsequently incorporates key assumptions and key sources of uncertainty in a sensitivity analysis that is performed consistent with the guidance in NEI 00-04.

Duke Energy Response to PRA RAI 23.b.:

Section 12 of NEI 00-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated. This would include any PRA model changes which result in new key assumptions and uncertainties, and an evaluation of any new sensitivities required.

Additionally, the Duke Energy PRA model update procedures require periodic model updates.

These procedures specifically address initiatives from industry insights with respect to changes in PRA technology that could change the PRA results, and changes in external event factors.

Following a PRA model update, the procedures require that PRA applications, including 10CFR 50.69 be reviewed to assess the impact of the model change on the application. This would address any new key assumptions and uncertainties, and an evaluation of any new sensitivities required.

PRA RAI 24 - Risk Sensitivity Study and Compliance with Requirements of 10 CFR 50.69(e):

The regulation 10 CFR 50.69(c)(1)(iv) requires that the categorization process includes evaluations that provide reasonable confidence that for SSCs categorized as RISC-3, any potential increase in CDF and LERF resulting from changes in treatment are small. The regulations 10 CFR 50.69(e)(2) and (3) require the licensee to monitor the performance of RISC-1 and RISC-2 SSCs and consider the data collected for RISC-3 SSCs and make adjustments to the categorization or treatment processes so that the categorization process and results are maintained valid.

Section 8 of NEI 00-04 provides guidance on how to conduct risk sensitivity studies during the categorization process for all the preliminary LSS SSCs to confirm that the categorization process results in acceptably small increases to CDF and LERF. An example is provided in the guidance to increase the unreliability of all preliminary LSS SSCs by a factor of 3 to 5, which

U.S. Nuclear Regulatory Commission Page 107 of 108 Serial RA-18-0178 Enclosure appears to address random failures. No explicit discussion of risk sensitivity studies for external hazard PRAs is provided in the guidance.

The categorization of SSCs using the external hazard PRAs is dominated by structural failure modes, which are dependent on the corresponding modeling inputs such as the dominant failure modes and fragility curves. These modeling inputs are derived using several parameters, including the SSC design, testing, and as-built installation, all of which can be impacted by alternative treatments.

Based on the preceding discussion,

a. Describe and justify how the required risk sensitivity study outlined in Section 8 of NEI 00-04 will be performed for categorization using the licensees HW and XF PRA models to meet the requirements of 10 CFR 50.69(c)(1)(iv) and 10 CFR 50.69(b)(2)(iv).

Duke Energy Response to PRA RAI 24.a.:

The BSEP external flooding model does not use a binning approach. It considers a component failed when the component becomes submerged or is impacted by spray, such that no binning approach is required (i.e., component fails with a probability of 1.0). The risk sensitivity study outlined in Section 8 of NEI 00-04 for the XF model will therefore be performed in the same manner as for internal events, by increasing the random failure probability of all LSS components by a factor of 3.

The BNP high winds model does use the binning approach which applies failure probabilities to components based on their capacity to withstand different wind initiators. However, the risk sensitivity study outlined in Section 8 of NEI 00-04 sensitivity will not increase the probability of the wind-induced failure events associated with the LSS components. This is based on the programs and processes in place at BNP which provide reasonable confidence that the wind capacities of LSS component will not be impacted by alternative treatments. Even though a component is categorized as LSS, it remains safety related, and therefore must continue to be able to meet its design function (i.e., to withstand a given wind event). As stated in 10CFR 50.69, for RISC-3 SSCs the licensee shall ensure, with reasonable confidence, that RISC-3 SSCs remain capable of performing their safety-related functions under design basis conditions, including environmental conditions and effects throughout their service life. Additionally, periodic inspection and testing activities must be conducted to determine that RISC-3 SSCs will remain capable of performing their safety-related functions under design basis conditions. Any identified degradation is corrected through the BNP Corrective Action Program. Thus, the monitoring and corrective action programs for SSCs ensures that potential degradation of the wind capacity would be detected and addressed before significantly impacting the high winds risk.

In addition to the monitoring program, Duke Energy has a rigorous configuration management program to maintain the configuration of SSCs in the plant. Whenever a change is made to an SSC, an appropriate design change process is utilized to ensure that design requirements remain unchanged as required by the 10 CFR 50.69 rule. Additionally, safety-related components are subject to periodic monitoring which will identify any degradation in the component.

U.S. Nuclear Regulatory Commission Page 108 of 108 Serial RA-18-0178 Enclosure In summary, based on the BNP 50.69 program procedures, and the supporting plant process and procedures, there is reasonable confidence that the high wind capacities of LSS components will not be impacted. Thus, inclusion of LSS components in a sensitivity study required by NEI section 8.0 is not warranted. As with other hazard models, this sensitivity will increase the random failure probability of all LSS components by a factor of 3.

b. Describe how it will be determined that the modeling inputs in the licensees HW and XF PRA models and those used for the risk sensitivity study continue to remain valid to ensure compliance with the requirements of 10 CFR 50.69(e).

Duke Energy Response to PRA RAI 24.b.:

Section 12 of NEI 00-04 describes the periodic update process for the 10CFR 50.69 categorization process. As stated in the NEI document, scheduled periodic reviews (e.g., once per two fuel cycles in a unit) should evaluate new insights resulting from available risk information including PRA models or other analysis used in the categorization. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process should be updated. Duke Energys PRA Maintenance and Update process includes a step to consider changes in external events hazards when completing a model update. Therefore, modeling inputs in the HW and XF PRA models are adequately evaluated to ensure they remain valid.

Serial: RA-18-0178 Brunswick Steam Electric Plan, Unit Nos. 1 and 2 Docket Nos. 50-325 and 50-324 / Renewed License Nos. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Attachment 1 Brunswick 50.69 PRA Implementation Items

U.S. Nuclear Regulatory Commission Page 1 of 1 Serial RA-18-0178 The table below identifies the items that are required to be completed prior to implementation of 10 CFR 50.69 at Brunswick Steam Electric Plant (BSEP), Unit Nos. 1 and 2. The issue identified below will be addressed and any associated changes made, focused scope peer reviews performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2),

and findings resolved and reflected in the PRA of record prior to implementation of 10 CFR 50.69.

Brunswick 50.69 PRA Implementation Items Description U Resolution U

i. The BSEP external flood (XF) model Duke Energy will complete a focused hazard is being updated with more scope peer review of the BSEP External detailed analytical modeling as Flood PRA model hazard development prior to implementation of 10 CFR 50.69.

described in response to RAI 11 in Duke Any findings from the focused scope peer Energy letter dated November 2, 2018. review will be resolved and closed per an The additional details need a focused NRC approved process prior to scope peer review. implementing 10 CFR 50.69.

Serial: RA-18-0178 Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Docket Nos. 50-325 and 50-324 / Renewed License Nos. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Attachment 2 Markup of Proposed Renewed Facility Operating License

Amendment AddWonalCondWons Implementation Number Date 282 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 282, designated Amendment No. 282.

NLOs will be briefed, each shift, regarding cross-tying 480 V E7 bus to the 480 V E8 bus per 0AOP-36.1, Loss of Any 4kV OR 480V Bus.

282 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 282, designated Amendment No. 282.

NLOs will be briefed, each shift, regarding starting and tying the SUPP-DG to 4160 V emergency bus E4 per plant procedure 0EOP-01-SBO-08, Supplemental DG Alignment.

282 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 282, designated Amendment No. 282.

NLOs will be briefed, each shift, regarding load shed procedures and alignment of the FLEX diesel generators.

282 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 282, a Amendment No. 282.

continuous fire watch shall be established for the Unit 1 Cable Spread Room and for the Balance of Plant busses in the Unit 1 Turbine Building 20 foot elevation.

285 The licensee shall not operate the facility within Upon implementation of the MELLLA+ operating domain with Feedwater Amendment No. 285 Temperature Reduction (FWTR), as defined in the Core Operating Limits Report.

TNSER\ UNIT\

Brunswick Unit 1 App. B-4 Amendment No. 85- I

INSERT UNIT 1 Amendment Additional Conditions Implementation Number Date

[NUMBER] Duke Energy is approved to implement 10 Upon implementation of CFR 50.69 using the processes for Amendment No. [XXX].

categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 1 License Amendment No. [XXX] dated

[DATE].

Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 1, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Amendment Number Add~onalCond~ons Implementation Date 310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, dedicated non- Amendment No. 310.

licensed operators (NLOs) shall be briefed, each shift, regarding cross tying the 4160 V emergency bus E2 to 4160 V emergency bus E4 per plant procedure 0AOP-36.1, Loss of Any 4kV OR 480V Bus.

310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, dedicated Amendment No. 310.

NLOs will be briefed, each shift, regarding cross-tying 480 V E7 bus to the 480 V E8 bus per 0AOP-36.1, Loss of Any 4kV OR 480V Bus.

310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, dedicated Amendment No. 310.

NLOs will be briefed, each shift, regarding starting and tying the SUPP-DG to 4160 V emergency bus E4 per plant procedure 0EOP-01-SBO-08, Supplemental DG Alignment.

310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, designated Amendment No. 310.

NLOs will be briefed, each shift, regarding load shed procedures and alignment of the FLEX diesel generators.

310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, a continuous Amendment No. 310.

fire watch shall be established for the Unit 2 Cable Spread Room and for the Balance of Plant busses in the Unit 2 Turbine Building 20 foot elevation.

310 During the extended EOG Completion Times Upon implementation of authorized by Amendment No. 310, the FLEX Amendment No. 310.

pump and FLEX Unit 2 hose trailer shall be staged at the south side of the Unit 2 Condensate Storage Tank to support rapid deployment in the event the FLEX pump is needed for Unit 2 inventory control.

313 The licensee shall not operate the facility within the Upon implementation of MELLLA+ operating domain with Feedwater Amendment No. 313.

Temperature Reduction (FWTR), as defined in the Core Operating Limits Report.

Brunswick Unit 2 App. B-4 Amendment No.--a+a-

INSERT UNIT 2 Amendment Additional Conditions Implementation Number Date

[NUMBER] Duke Energy is approved to implement 10 Upon implementation of CFR 50.69 using the processes for Amendment No. [XXX].

categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and external flood; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non PRA evaluations that are based on the IPEEE Screening Assessment for External Hazards, i.e., seismic margin analysis (SMA) to evaluate seismic risk, and a screening of other external hazards updated using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in Unit 2 License Amendment No. [XXX] dated

[DATE].

Duke Energy will complete the implementation items list in Attachment 1 of Duke letter to NRC dated November 1, 2018 prior to implementation of 10 CFR 50.69. All issues identified in the attachment will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

Serial: RA-18-0178 Brunswick Steam Electric Plan, Unit Nos. 1 and 2 Docket Nos. 50-325 and 50-324 / Renewed License Nos. DPR-71 and DPR-62 Response to NRC Request for Additional Information (RAI) Regarding Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Reactors Attachment 3 Brunswick 50.69 LAR Supplement (Revision to High Winds PRA CDF and LERF)

U.S. Nuclear Regulatory Commission Page 1 of 1 Serial RA-18-0178 Several changes have been incorporated into the Brunswick Steam Electric Plant (BSEP), Unit Nos. 1 and 2 High Winds (HW) PRA resulting in a substantial reduction in the core damage frequency (CDF) and large early release frequency (LERF). The HW CDF and LERF given in the original BSEP LAR Attachment 2 is superseded with the following:

Baseline Baseline Units Model Comments CDF LERF This model 1.98E-06 4.69E-08 represents (Unit 1) (Unit 1) the current High Winds 1&2 HW PRA PRA 1.81E-06 4.40E-08 Model of (Unit 2) (Unit 2) Record (MOR).

Note: only the HW CDF and LERF frequencies from Attachment 2 of the original LAR are superseded. Everything else from Attachment 2 of the original LAR remains as a part of the application to adopt 10 CFR 50.69.